2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-71257 | CRITICAL | 9.1 | 5.2% | Mar 19, 2026 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to imprope... |
| CVE-2025-60237 | CRITICAL | 9.8 | 0.5% | Mar 19, 2026 | Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from... |
| CVE-2025-60233 | CRITICAL | 9.8 | 0.4% | Mar 19, 2026 | Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n... |
| CVE-2025-15031 | CRITICAL | 9.1 | 0.9% | Mar 18, 2026 | A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar a... |
| CVE-2025-67830 | CRITICAL | 9.8 | 0.3% | Mar 18, 2026 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. |
| CVE-2025-67829 | CRITICAL | 9.8 | 0.3% | Mar 18, 2026 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. |
| CVE-2025-69902 | CRITICAL | 9.8 | 2.1% | Mar 16, 2026 | A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to e... |
| CVE-2025-69809 | CRITICAL | 9.8 | 0.5% | Mar 16, 2026 | A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values t... |
| CVE-2025-69808 | CRITICAL | 9.1 | 0.3% | Mar 16, 2026 | An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive... |
| CVE-2025-62319 | CRITICAL | 9.8 | 0.3% | Mar 16, 2026 | Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Bool... |
| CVE-2025-69246 | CRITICAL | 9.8 | 0.4% | Mar 16, 2026 | Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automa... |
| CVE-2025-52648 | CRITICAL | 9.8 | 0.1% | Mar 16, 2026 | HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow ... |
| CVE-2025-15060 | CRITICAL | 9.8 | 1.6% | Mar 16, 2026 | claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows rem... |
| CVE-2025-70245 | CRITICAL | 9.8 | 0.6% | Mar 12, 2026 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode. |
| CVE-2025-59388 | CRITICAL | 9.8 | 0.5% | Mar 12, 2026 | A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can th... |
| CVE-2025-70041 | CRITICAL | 9.8 | 0.4% | Mar 11, 2026 | An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master. |
| CVE-2025-70024 | CRITICAL | 9.8 | 0.5% | Mar 11, 2026 | An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benk... |
| CVE-2025-66956 | CRITICAL | 9.9 | 0.6% | Mar 11, 2026 | Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers t... |
| CVE-2025-67039 | CRITICAL | 9.8 | 0.3% | Mar 11, 2026 | An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appe... |
| CVE-2025-67038 | CRITICAL | 9.8 | 22.0% | Mar 11, 2026 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when ... |
| CVE-2025-69615 | CRITICAL | 9.1 | 0.4% | Mar 10, 2026 | Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with n... |
| CVE-2025-69614 | CRITICAL | 9.4 | 0.4% | Mar 10, 2026 | Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets... |
| CVE-2025-56422 | CRITICAL | 9.8 | 0.9% | Mar 10, 2026 | A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code o... |
| CVE-2025-41709 | CRITICAL | 9.8 | 2.2% | Mar 10, 2026 | An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write a... |
| CVE-2025-40943 | CRITICAL | 9.6 | 0.5% | Mar 10, 2026 | Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code throug... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now