2025 CVE Vulnerabilities
45,153 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-41099 | MEDIUM | 6.5 | 0.3% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41097 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41096 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41095 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41094 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41093 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41092 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-41091 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con... |
| CVE-2025-11163 | MEDIUM | 4.3 | 0.2% | Sep 30, 2025 | The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data... |
| CVE-2025-10196 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplace_e... |
| CVE-2025-10191 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's... |
| CVE-2025-10189 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shor... |
| CVE-2025-10182 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all ... |
| CVE-2025-10179 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in a... |
| CVE-2025-10168 | MEDIUM | 6.4 | 0.3% | Sep 30, 2025 | The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shor... |
| CVE-2025-10131 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' sho... |
| CVE-2025-10130 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all ... |
| CVE-2025-10128 | MEDIUM | 6.4 | 0.2% | Sep 30, 2025 | The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' ... |
| CVE-2025-10000 | MEDIUM | 6.4 | 0.4% | Sep 30, 2025 | The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missin... |
| CVE-2025-61586 | MEDIUM | 5.3 | 0.4% | Sep 30, 2025 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by s... |
| CVE-2025-59950 | MEDIUM | 5.4 | 0.3% | Sep 30, 2025 | FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking p... |
| CVE-2025-59948 | MEDIUM | 5.4 | 0.3% | Sep 29, 2025 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attrib... |
| CVE-2025-59941 | MEDIUM | 6.5 | 0.2% | Sep 29, 2025 | go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification ... |
| CVE-2025-59940 | MEDIUM | 6.5 | 0.3% | Sep 29, 2025 | mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerabil... |
| CVE-2025-43817 | MEDIUM | 6.1 | 0.2% | Sep 29, 2025 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay ... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now