2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-68640 | MEDIUM | 5.3 | 0.4% | Jul 21, 2026 | The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint T... |
| CVE-2025-71397 | MEDIUM | 6.5 | 0.6% | Jul 18, 2026 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permi... |
| CVE-2025-71396 | MEDIUM | 6.5 | 0.6% | Jul 18, 2026 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on em... |
| CVE-2025-71395 | MEDIUM | 6.5 | 0.4% | Jul 18, 2026 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to ... |
| CVE-2025-71394 | MEDIUM | 4.3 | 0.4% | Jul 18, 2026 | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows aut... |
| CVE-2025-71393 | MEDIUM | 6.5 | 0.5% | Jul 18, 2026 | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain e... |
| CVE-2025-71391 | MEDIUM | 6.5 | 0.6% | Jul 18, 2026 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated ... |
| CVE-2025-45870 | MEDIUM | 6.5 | 0.5% | Jul 16, 2026 | LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet c... |
| CVE-2025-32781 | MEDIUM | 6.5 | 0.4% | Jul 15, 2026 | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior... |
| CVE-2025-56365 | MEDIUM | 5.7 | 0.3% | Jul 14, 2026 | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model co... |
| CVE-2025-56364 | MEDIUM | 5.7 | 0.2% | Jul 14, 2026 | A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestin... |
| CVE-2025-56363 | MEDIUM | 5.7 | 0.4% | Jul 14, 2026 | A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevi... |
| CVE-2025-56362 | MEDIUM | 5.7 | 0.3% | Jul 14, 2026 | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Lev... |
| CVE-2025-56361 | MEDIUM | 5.7 | 0.3% | Jul 14, 2026 | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Lev... |
| CVE-2025-62826 | MEDIUM | 4.3 | 0.4% | Jul 14, 2026 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnera... |
| CVE-2025-62675 | MEDIUM | 4.3 | 0.3% | Jul 14, 2026 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnera... |
| CVE-2025-43892 | MEDIUM | 4.3 | — | Jul 14, 2026 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v... |
| CVE-2025-40945 | MEDIUM | 6.7 | 0.2% | Jul 14, 2026 | A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1),... |
| CVE-2025-15665 | MEDIUM | 5.4 | 0.2% | Jul 14, 2026 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Sl... |
| CVE-2025-5017 | MEDIUM | 4.9 | 0.4% | Jul 11, 2026 | The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’... |
| CVE-2025-13968 | MEDIUM | 6.4 | 0.3% | Jul 11, 2026 | The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcod... |
| CVE-2025-30008 | MEDIUM | 5.4 | 0.3% | Jul 10, 2026 | HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users... |
| CVE-2025-11977 | MEDIUM | 6.6 | 0.9% | Jul 10, 2026 | The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin fo... |
| CVE-2025-12506 | MEDIUM | 4.3 | 0.3% | Jul 8, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and ... |
| CVE-2025-14785 | MEDIUM | 6.4 | 0.3% | Jul 8, 2026 | The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for Wor... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now