2025 CVE Vulnerabilities
45,168 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-14850 | CRITICAL | 9.1 | 0.8% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. |
| CVE-2025-14849 | CRITICAL | 9.8 | 0.5% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute ar... |
| CVE-2025-14848 | MEDIUM | 5.3 | 0.6% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the ex... |
| CVE-2025-13911 | HIGH | 7.3 | 0.2% | Dec 18, 2025 | The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The v... |
| CVE-2025-67163 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary ... |
| CVE-2025-65566 | HIGH | 7.5 | 0.3% | Dec 18, 2025 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.... |
| CVE-2025-64400 | MEDIUM | 4.1 | 0.2% | Dec 18, 2025 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. Th... |
| CVE-2025-14889 | MEDIUM | 6.3 | 0.2% | Dec 18, 2025 | A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unkno... |
| CVE-2025-67745 | HIGH | 7.5 | 0.1% | Dec 18, 2025 | MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1... |
| CVE-2025-65568 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.... |
| CVE-2025-65567 | HIGH | 7.5 | 0.3% | Dec 18, 2025 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.... |
| CVE-2025-65565 | HIGH | 7.5 | 0.3% | Dec 18, 2025 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.... |
| CVE-2025-65564 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. Whe... |
| CVE-2025-65563 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version up... |
| CVE-2025-65562 | HIGH | 7.5 | 0.5% | Dec 18, 2025 | The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An un... |
| CVE-2025-65561 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or o... |
| CVE-2025-65559 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), th... |
| CVE-2025-63387 | HIGH | 7.5 | 28.0% | Dec 18, 2025 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to th... |
| CVE-2025-59949 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vuln... |
| CVE-2025-56157 | CRITICAL | 9.8 | 0.8% | Dec 18, 2025 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file inclu... |
| CVE-2025-14885 | HIGH | 8.8 | 0.3% | Dec 18, 2025 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file ... |
| CVE-2025-14739 | MEDIUM | 6.8 | 0.2% | Dec 18, 2025 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the a... |
| CVE-2025-14738 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download th... |
| CVE-2025-14737 | HIGH | 8 | 1.0% | Dec 18, 2025 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbi... |
| CVE-2025-66058 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectl... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now