2025 CVE Vulnerabilities
45,326 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-62245 | MEDIUM | 4.3 | 0.2% | Oct 10, 2025 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 thr... |
| CVE-2025-62158 | MEDIUM | 5.3 | 0.3% | Oct 10, 2025 | Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system d... |
| CVE-2025-61925 | MEDIUM | 6.5 | 0.4% | Oct 10, 2025 | Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `... |
| CVE-2025-61505 | MEDIUM | 6.5 | 0.3% | Oct 10, 2025 | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-co... |
| CVE-2025-60838 | MEDIUM | 6.5 | 0.3% | Oct 10, 2025 | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted... |
| CVE-2025-60268 | MEDIUM | 6.5 | 0.3% | Oct 10, 2025 | An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the sa... |
| CVE-2025-11618 | MEDIUM | 5.3 | 0.3% | Oct 10, 2025 | A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer derefer... |
| CVE-2025-11617 | MEDIUM | 5.4 | 0.3% | Oct 10, 2025 | A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when rec... |
| CVE-2025-11616 | MEDIUM | 5.4 | 0.3% | Oct 10, 2025 | A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when r... |
| CVE-2025-11580 | MEDIUM | 5.5 | 1.0% | Oct 10, 2025 | A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This mani... |
| CVE-2025-61780 | MEDIUM | 5.3 | 0.4% | Oct 10, 2025 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclos... |
| CVE-2025-60308 | MEDIUM | 4.1 | 0.2% | Oct 10, 2025 | code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room ... |
| CVE-2025-8887 | MEDIUM | 6.1 | 0.1% | Oct 10, 2025 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unautho... |
| CVE-2025-8886 | MEDIUM | 6.7 | 0.2% | Oct 10, 2025 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missi... |
| CVE-2025-61319 | MEDIUM | 6.1 | 0.3% | Oct 10, 2025 | ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. Whe... |
| CVE-2025-61152 | MEDIUM | 6.5 | 0.3% | Oct 10, 2025 | python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature ... |
| CVE-2025-60868 | MEDIUM | 6.5 | 0.2% | Oct 10, 2025 | The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Str... |
| CVE-2025-62239 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and L... |
| CVE-2025-62238 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 th... |
| CVE-2025-62237 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.11... |
| CVE-2025-7781 | MEDIUM | 6.4 | 0.2% | Oct 10, 2025 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘... |
| CVE-2025-7374 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions ... |
| CVE-2025-11579 | MEDIUM | 6.5 | 0.4% | Oct 10, 2025 | github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary siz... |
| CVE-2025-52624 | MEDIUM | 6.1 | 0.2% | Oct 10, 2025 | A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-... |
| CVE-2025-11190 | MEDIUM | 5.4 | 0.3% | Oct 10, 2025 | The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redire... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now