2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-59529 | MEDIUM | 5.5 | 0.2% | Dec 18, 2025 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions... |
| CVE-2025-14848 | MEDIUM | 5.3 | 0.6% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the ex... |
| CVE-2025-13911 | MEDIUM | 6.4 | 0.2% | Dec 18, 2025 | Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system t... |
| CVE-2025-67163 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary ... |
| CVE-2025-64400 | MEDIUM | 4.1 | 0.2% | Dec 18, 2025 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. Th... |
| CVE-2025-14889 | MEDIUM | 6.3 | 0.2% | Dec 18, 2025 | A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unkno... |
| CVE-2025-63387 | MEDIUM | 4.3 | 29.9% | Dec 18, 2025 | Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return... |
| CVE-2025-59949 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vuln... |
| CVE-2025-14739 | MEDIUM | 6.8 | 0.2% | Dec 18, 2025 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the a... |
| CVE-2025-66058 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectl... |
| CVE-2025-64355 | MEDIUM | 6.5 | 0.1% | Dec 18, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem... |
| CVE-2025-64282 | MEDIUM | 4.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploit... |
| CVE-2025-64235 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows... |
| CVE-2025-63043 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid a... |
| CVE-2025-63002 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorre... |
| CVE-2025-62998 | MEDIUM | 5 | 0.2% | Dec 18, 2025 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Re... |
| CVE-2025-62961 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured ... |
| CVE-2025-62960 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrect... |
| CVE-2025-64723 | MEDIUM | 4.4 | 0.1% | Dec 18, 2025 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with ... |
| CVE-2025-63390 | MEDIUM | 5.3 | 0.6% | Dec 18, 2025 | An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fa... |
| CVE-2025-14823 | MEDIUM | 5.3 | 0.1% | Dec 18, 2025 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure... |
| CVE-2025-9787 | MEDIUM | 6.1 | 1.1% | Dec 18, 2025 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulne... |
| CVE-2025-7047 | MEDIUM | 5.4 | 0.1% | Dec 18, 2025 | Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue aff... |
| CVE-2025-14744 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, poten... |
| CVE-2025-65000 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now