2025 CVE Vulnerabilities
45,324 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-66224 | HIGH | 8.8 | 0.5% | Nov 29, 2025 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains a... |
| CVE-2025-66223 | HIGH | 8.4 | 0.2% | Nov 29, 2025 | OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not exp... |
| CVE-2025-66217 | HIGH | 7.5 | 0.6% | Nov 29, 2025 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQ... |
| CVE-2025-53939 | HIGH | 8.8 | 0.6% | Nov 29, 2025 | Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a sh... |
| CVE-2025-53900 | HIGH | 8.8 | 1.0% | Nov 29, 2025 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of rol... |
| CVE-2025-53899 | HIGH | 7.2 | 0.8% | Nov 29, 2025 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is ... |
| CVE-2025-53896 | HIGH | 8.1 | 0.2% | Nov 29, 2025 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could caus... |
| CVE-2025-66201 | HIGH | 8.1 | 0.3% | Nov 29, 2025 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-sid... |
| CVE-2025-12183 | HIGH | 8.8 | 0.6% | Nov 28, 2025 | Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service ... |
| CVE-2025-51735 | HIGH | 7.5 | 0.3% | Nov 28, 2025 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
| CVE-2025-12638 | HIGH | 8 | 0.6% | Nov 28, 2025 | Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extractin... |
| CVE-2025-13771 | HIGH | 7.1 | 0.4% | Nov 28, 2025 | WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit ... |
| CVE-2025-13770 | HIGH | 7.1 | 0.3% | Nov 28, 2025 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrar... |
| CVE-2025-13769 | HIGH | 7.1 | 0.3% | Nov 28, 2025 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrar... |
| CVE-2025-13768 | HIGH | 8.8 | 0.4% | Nov 28, 2025 | WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log in... |
| CVE-2025-66384 | HIGH | 8.2 | 0.3% | Nov 28, 2025 | app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, rela... |
| CVE-2025-64312 | HIGH | 7.5 | 0.1% | Nov 28, 2025 | Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability ma... |
| CVE-2025-58311 | HIGH | 7.1 | 0.1% | Nov 28, 2025 | UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availabili... |
| CVE-2025-64315 | HIGH | 7.1 | 0.1% | Nov 28, 2025 | Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability ... |
| CVE-2025-58314 | HIGH | 7.1 | 0.1% | Nov 28, 2025 | Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulner... |
| CVE-2025-58309 | HIGH | 7.1 | 0.1% | Nov 28, 2025 | Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability w... |
| CVE-2025-66360 | HIGH | 8.8 | 0.3% | Nov 28, 2025 | An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpo... |
| CVE-2025-13757 | HIGH | 8.8 | 0.5% | Nov 27, 2025 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025... |
| CVE-2025-13692 | HIGH | 7.2 | 0.3% | Nov 27, 2025 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uplo... |
| CVE-2025-59890 | HIGH | 7.3 | 0.1% | Nov 27, 2025 | Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths ... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now