2025 CVE Vulnerabilities
45,321 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-68388 | MEDIUM | 5.3 | 0.3% | Dec 18, 2025 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excess... |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated... |
| CVE-2025-68383 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbea... |
| CVE-2025-68382 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the ... |
| CVE-2025-68381 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (... |
| CVE-2025-13427 | MEDIUM | 6.9 | 0.5% | Dec 18, 2025 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact... |
| CVE-2025-68161 | MEDIUM | 4.8 | 0.7% | Dec 18, 2025 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of... |
| CVE-2025-63949 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remot... |
| CVE-2025-63948 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute ar... |
| CVE-2025-63947 | MEDIUM | 5.4 | 0.1% | Dec 18, 2025 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An ... |
| CVE-2025-59529 | MEDIUM | 5.5 | 0.2% | Dec 18, 2025 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions... |
| CVE-2025-14848 | MEDIUM | 5.3 | 0.6% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the ex... |
| CVE-2025-13911 | MEDIUM | 6.4 | 0.2% | Dec 18, 2025 | Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system t... |
| CVE-2025-67163 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary ... |
| CVE-2025-64400 | MEDIUM | 4.1 | 0.2% | Dec 18, 2025 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. Th... |
| CVE-2025-14889 | MEDIUM | 6.3 | 0.2% | Dec 18, 2025 | A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unkno... |
| CVE-2025-59949 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vuln... |
| CVE-2025-14739 | MEDIUM | 6.8 | 0.2% | Dec 18, 2025 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the a... |
| CVE-2025-66058 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectl... |
| CVE-2025-64355 | MEDIUM | 6.5 | 0.1% | Dec 18, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem... |
| CVE-2025-64282 | MEDIUM | 4.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploit... |
| CVE-2025-64235 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows... |
| CVE-2025-63043 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid a... |
| CVE-2025-63002 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorre... |
| CVE-2025-62998 | MEDIUM | 5 | 0.2% | Dec 18, 2025 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Re... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now