2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-14267 | MEDIUM | 4.9 | 0.4% | Dec 19, 2025 | Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows d... |
| CVE-2025-13754 | MEDIUM | 5.3 | 0.3% | Dec 19, 2025 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive ... |
| CVE-2025-14546 | MEDIUM | 6.3 | 0.4% | Dec 19, 2025 | Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the imprope... |
| CVE-2025-67846 | MEDIUM | 6.5 | 0.4% | Dec 19, 2025 | The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches ... |
| CVE-2025-67845 | MEDIUM | 5.4 | 0.5% | Dec 19, 2025 | A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows rem... |
| CVE-2025-67844 | MEDIUM | 4.3 | 0.4% | Dec 19, 2025 | The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository... |
| CVE-2025-67842 | MEDIUM | 5.4 | 0.3% | Dec 19, 2025 | The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HT... |
| CVE-2025-14910 | MEDIUM | 6.5 | 0.4% | Dec 19, 2025 | A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon... |
| CVE-2025-68422 | MEDIUM | 4.3 | 0.2% | Dec 18, 2025 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated use... |
| CVE-2025-68390 | MEDIUM | 4.9 | 0.3% | Dec 18, 2025 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with sna... |
| CVE-2025-68389 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user t... |
| CVE-2025-68387 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated ... |
| CVE-2025-68386 | MEDIUM | 4.3 | 0.2% | Dec 18, 2025 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated use... |
| CVE-2025-68385 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated us... |
| CVE-2025-68279 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the ... |
| CVE-2025-68388 | MEDIUM | 5.3 | 0.3% | Dec 18, 2025 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excess... |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated... |
| CVE-2025-68383 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbea... |
| CVE-2025-68382 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the ... |
| CVE-2025-68381 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (... |
| CVE-2025-13427 | MEDIUM | 6.9 | 0.5% | Dec 18, 2025 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact... |
| CVE-2025-68161 | MEDIUM | 4.8 | 0.7% | Dec 18, 2025 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of... |
| CVE-2025-63949 | MEDIUM | 6.1 | 0.3% | Dec 18, 2025 | A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remot... |
| CVE-2025-63948 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute ar... |
| CVE-2025-63947 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An ... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now