2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-10878 | CRITICAL | 10 | 0.6% | Feb 3, 2026 | A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The... |
| CVE-2025-69983 | CRITICAL | 9.8 | 0.4% | Feb 3, 2026 | FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly s... |
| CVE-2025-69981 | CRITICAL | 9.8 | 0.7% | Feb 3, 2026 | FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks aut... |
| CVE-2025-69971 | CRITICAL | 9.8 | 2.0% | Feb 3, 2026 | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-code... |
| CVE-2025-69970 | CRITICAL | 9.3 | 0.5% | Feb 3, 2026 | FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' ... |
| CVE-2025-67188 | CRITICAL | 9.8 | 0.6% | Feb 3, 2026 | A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg ... |
| CVE-2025-67187 | CRITICAL | 9.8 | 0.4% | Feb 3, 2026 | A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists i... |
| CVE-2025-67186 | CRITICAL | 9.8 | 0.7% | Feb 3, 2026 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /... |
| CVE-2025-65875 | CRITICAL | 9.8 | 0.4% | Feb 3, 2026 | An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute a... |
| CVE-2025-63624 | CRITICAL | 9.8 | 0.6% | Feb 3, 2026 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows... |
| CVE-2025-61506 | CRITICAL | 9.8 | 0.6% | Feb 3, 2026 | An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of ... |
| CVE-2025-57529 | CRITICAL | 9.8 | 0.6% | Feb 3, 2026 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to... |
| CVE-2025-52626 | CRITICAL | 9.8 | 0.6% | Feb 3, 2026 | A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially ... |
| CVE-2025-5319 | CRITICAL | 9.8 | 0.4% | Feb 3, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics a... |
| CVE-2025-67856 | CRITICAL | 9.8 | 0.3% | Feb 3, 2026 | A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awa... |
| CVE-2025-67484 | CRITICAL | 9.8 | 0.4% | Feb 3, 2026 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFor... |
| CVE-2025-66480 | CRITICAL | 9.8 | 1.4% | Feb 2, 2026 | Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists ... |
| CVE-2025-8587 | CRITICAL | 9.8 | 0.3% | Feb 2, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Tech... |
| CVE-2025-15030 | CRITICAL | 9.8 | 0.5% | Feb 2, 2026 | The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few u... |
| CVE-2025-24293 | CRITICAL | 9.2 | 2.4% | Jan 30, 2026 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of pote... |
| CVE-2025-51958 | CRITICAL | 9.8 | 0.6% | Jan 30, 2026 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system com... |
| CVE-2025-7964 | CRITICAL | 9.2 | 0.3% | Jan 30, 2026 | After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigb... |
| CVE-2025-26385 | CRITICAL | 9.5 | 1.4% | Jan 30, 2026 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Com... |
| CVE-2025-69929 | CRITICAL | 9.8 | 0.4% | Jan 29, 2026 | An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the passw... |
| CVE-2025-7714 | CRITICAL | 9.8 | 0.3% | Jan 29, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now