2025 CVE Vulnerabilities
45,326 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-68385 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated us... |
| CVE-2025-68279 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the ... |
| CVE-2025-68388 | MEDIUM | 5.3 | 0.3% | Dec 18, 2025 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excess... |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated... |
| CVE-2025-68383 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbea... |
| CVE-2025-68382 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the ... |
| CVE-2025-68381 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (... |
| CVE-2025-65046 | LOW | 3.1 | 0.3% | Dec 18, 2025 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
| CVE-2025-65041 | CRITICAL | 9.8 | 0.7% | Dec 18, 2025 | Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2025-65037 | CRITICAL | 10 | 0.9% | Dec 18, 2025 | Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to exe... |
| CVE-2025-64677 | HIGH | 8.2 | 0.5% | Dec 18, 2025 | Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience all... |
| CVE-2025-64676 | HIGH | 7.2 | 0.9% | Dec 18, 2025 | '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. |
| CVE-2025-64663 | HIGH | 8.8 | 0.7% | Dec 18, 2025 | Custom Question Answering Elevation of Privilege Vulnerability |
| CVE-2025-34452 | HIGH | 8.7 | 5.0% | Dec 18, 2025 | Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-si... |
| CVE-2025-34451 | HIGH | 7.8 | 0.2% | Dec 18, 2025 | rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflo... |
| CVE-2025-34450 | HIGH | 7.8 | 0.2% | Dec 18, 2025 | merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vu... |
| CVE-2025-34449 | CRITICAL | 9.1 | 0.4% | Dec 18, 2025 | Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability i... |
| CVE-2025-13427 | MEDIUM | 6.9 | 0.5% | Dec 18, 2025 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact... |
| CVE-2025-68161 | MEDIUM | 4.8 | 0.7% | Dec 18, 2025 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of... |
| CVE-2025-67653 | HIGH | 7.5 | 0.6% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence o... |
| CVE-2025-63951 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project thro... |
| CVE-2025-63950 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through co... |
| CVE-2025-63949 | MEDIUM | 6.1 | 0.2% | Dec 18, 2025 | A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remot... |
| CVE-2025-63948 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute ar... |
| CVE-2025-63947 | MEDIUM | 5.4 | 0.1% | Dec 18, 2025 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An ... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now