2025 CVE Vulnerabilities
45,168 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-64355 | MEDIUM | 6.5 | 0.1% | Dec 18, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem... |
| CVE-2025-64282 | MEDIUM | 4.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploit... |
| CVE-2025-64236 | CRITICAL | 9.8 | 0.4% | Dec 18, 2025 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.... |
| CVE-2025-64235 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows... |
| CVE-2025-63043 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid a... |
| CVE-2025-63002 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorre... |
| CVE-2025-62998 | MEDIUM | 5 | 0.2% | Dec 18, 2025 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Re... |
| CVE-2025-62961 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured ... |
| CVE-2025-62960 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrect... |
| CVE-2025-14896 | HIGH | 8.7 | 0.3% | Dec 18, 2025 | due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an a... |
| CVE-2025-14884 | HIGH | 7.3 | 9.4% | Dec 18, 2025 | A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the com... |
| CVE-2025-14879 | CRITICAL | 9.8 | 5.9% | Dec 18, 2025 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange... |
| CVE-2025-68469 | LOW | 3.3 | 0.2% | Dec 18, 2025 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14... |
| CVE-2025-68278 | HIGH | 8.8 | 0.4% | Dec 18, 2025 | Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in... |
| CVE-2025-64724 | HIGH | 7.3 | 0.1% | Dec 18, 2025 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with wo... |
| CVE-2025-64723 | MEDIUM | 4.4 | 0.1% | Dec 18, 2025 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with ... |
| CVE-2025-63391 | — | — | 0.5% | Dec 18, 2025 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2025-63390 | MEDIUM | 5.3 | 0.5% | Dec 18, 2025 | An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fa... |
| CVE-2025-63389 | CRITICAL | 9.8 | 0.6% | Dec 18, 2025 | A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and includ... |
| CVE-2025-63388 | CRITICAL | 9.1 | 0.2% | Dec 18, 2025 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-f... |
| CVE-2025-63386 | CRITICAL | 9.1 | 0.2% | Dec 18, 2025 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup en... |
| CVE-2025-14878 | CRITICAL | 9.8 | 0.8% | Dec 18, 2025 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirele... |
| CVE-2025-14877 | CRITICAL | 9.8 | 0.3% | Dec 18, 2025 | A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file... |
| CVE-2025-14823 | MEDIUM | 5.3 | 0.1% | Dec 18, 2025 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure... |
| CVE-2025-9787 | MEDIUM | 6.1 | 0.9% | Dec 18, 2025 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulne... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now