2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-36075 | MEDIUM | 5.3 | 0.2% | Nov 8, 2026 | IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7... |
| CVE-2025-1837 | MEDIUM | 5.4 | 0.2% | Nov 8, 2026 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an aut... |
| CVE-2025-55002 | MEDIUM | 5.5 | 0.2% | Nov 6, 2026 | JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for ma... |
| CVE-2025-54991 | MEDIUM | 5.5 | 0.2% | Nov 6, 2026 | JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for ma... |
| CVE-2025-66365 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | Incorrect handling of SIP packets leads to baseband crashes |
| CVE-2025-71455 | MEDIUM | 5.3 | 0.3% | Nov 4, 2026 | vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSI... |
| CVE-2025-71454 | MEDIUM | 6.5 | 0.2% | Nov 4, 2026 | vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/Vte... |
| CVE-2025-71453 | MEDIUM | 6.1 | 0.2% | Nov 4, 2026 | vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php t... |
| CVE-2025-71452 | MEDIUM | 6.1 | 0.3% | Nov 3, 2026 | Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clients... |
| CVE-2025-71451 | MEDIUM | 6.1 | 0.3% | Nov 3, 2026 | Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/servers... |
| CVE-2025-5769 | MEDIUM | 6.1 | 0.2% | Nov 3, 2026 | The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This l... |
| CVE-2025-1397 | MEDIUM | 4.8 | 0.2% | Nov 3, 2026 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider ... |
| CVE-2025-62819 | MEDIUM | 6.5 | 0.2% | Nov 2, 2026 | Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the... |
| CVE-2025-12544 | MEDIUM | 4.8 | 0.2% | Nov 2, 2026 | The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to... |
| CVE-2025-13647 | MEDIUM | 5.8 | 0.2% | Nov 2, 2026 | The affected component fails to enforce expected validation constraints on the `content-type` header when processing cer... |
| CVE-2025-9462 | MEDIUM | 6.5 | 0.3% | Oct 31, 2026 | The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up... |
| CVE-2025-11455 | MEDIUM | 4.3 | 0.2% | Oct 31, 2026 | The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c... |
| CVE-2025-68395 | MEDIUM | 5.1 | 0.2% | Oct 30, 2026 | ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged... |
| CVE-2025-68392 | MEDIUM | 5.1 | 0.2% | Oct 30, 2026 | ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved f... |
| CVE-2025-68391 | MEDIUM | 5.3 | 0.2% | Oct 30, 2026 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbi... |
| CVE-2025-12523 | MEDIUM | 6.5 | 0.2% | Oct 29, 2026 | Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user |
| CVE-2025-13050 | MEDIUM | 5.4 | 0.3% | Oct 29, 2026 | Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user |
| CVE-2025-64394 | MEDIUM | 4.3 | 0.1% | Oct 27, 2026 | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installa... |
| CVE-2025-71439 | MEDIUM | 5.5 | 0.1% | Oct 27, 2026 | llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows a... |
| CVE-2025-58403 | MEDIUM | 5.1 | 0.5% | Oct 23, 2026 | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data.... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now