2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-61686 | CRITICAL | 9.1 | 16.1% | Jan 10, 2026 | React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version... |
| CVE-2025-15501 | CRITICAL | 9.8 | 6.4% | Jan 9, 2026 | A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the funct... |
| CVE-2025-15500 | CRITICAL | 9.8 | 5.6% | Jan 9, 2026 | A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some un... |
| CVE-2025-15499 | CRITICAL | 9.8 | 5.3% | Jan 9, 2026 | A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability af... |
| CVE-2025-70161 | CRITICAL | 9.8 | 24.1% | Jan 9, 2026 | EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passe... |
| CVE-2025-69542 | CRITICAL | 9.8 | 8.4% | Jan 9, 2026 | A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulner... |
| CVE-2025-69426 | CRITICAL | 10 | 0.4% | Jan 9, 2026 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating s... |
| CVE-2025-69425 | CRITICAL | 10 | 0.7% | Jan 9, 2026 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2... |
| CVE-2025-15496 | CRITICAL | 9.8 | 0.3% | Jan 9, 2026 | A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/... |
| CVE-2025-15493 | CRITICAL | 9.8 | 0.4% | Jan 9, 2026 | A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/... |
| CVE-2025-14598 | CRITICAL | 9.8 | 0.7% | Jan 9, 2026 | BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites.... |
| CVE-2025-7072 | CRITICAL | 9.3 | 0.5% | Jan 9, 2026 | The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all route... |
| CVE-2025-66050 | CRITICAL | 9.8 | 0.3% | Jan 9, 2026 | Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as ... |
| CVE-2025-64093 | CRITICAL | 9.8 | 0.7% | Jan 9, 2026 | Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname... |
| CVE-2025-13761 | CRITICAL | 9.6 | 0.6% | Jan 9, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 th... |
| CVE-2025-69194 | CRITICAL | 9.8 | 0.7% | Jan 9, 2026 | A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validat... |
| CVE-2025-14741 | CRITICAL | 9.1 | 0.4% | Jan 9, 2026 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modifi... |
| CVE-2025-70974 | CRITICAL | 10 | 0.7% | Jan 9, 2026 | Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key i... |
| CVE-2025-14736 | CRITICAL | 9.8 | 0.7% | Jan 9, 2026 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i... |
| CVE-2025-68717 | CRITICAL | 9.4 | 0.6% | Jan 8, 2026 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is l... |
| CVE-2025-68715 | CRITICAL | 9.1 | 0.7% | Jan 8, 2026 | An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/gofor... |
| CVE-2025-66916 | CRITICAL | 9.4 | 0.7% | Jan 8, 2026 | The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression... |
| CVE-2025-66913 | CRITICAL | 9.8 | 1.1% | Jan 8, 2026 | JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The a... |
| CVE-2025-67325 | CRITICAL | 9.8 | 0.9% | Jan 8, 2026 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated... |
| CVE-2025-61548 | CRITICAL | 9.8 | 0.6% | Jan 8, 2026 | SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpo... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now