2025 CVE Vulnerabilities
45,326 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-63387 | HIGH | 7.5 | 29.9% | Dec 18, 2025 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to th... |
| CVE-2025-59949 | MEDIUM | 6.5 | 0.4% | Dec 18, 2025 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vuln... |
| CVE-2025-56157 | CRITICAL | 9.8 | 0.8% | Dec 18, 2025 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file inclu... |
| CVE-2025-14885 | HIGH | 8.8 | 0.3% | Dec 18, 2025 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file ... |
| CVE-2025-14739 | MEDIUM | 6.8 | 0.2% | Dec 18, 2025 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the a... |
| CVE-2025-14738 | HIGH | 7.5 | 0.4% | Dec 18, 2025 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download th... |
| CVE-2025-14737 | HIGH | 8 | 1.0% | Dec 18, 2025 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbi... |
| CVE-2025-66058 | MEDIUM | 6.5 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectl... |
| CVE-2025-64355 | MEDIUM | 6.5 | 0.1% | Dec 18, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem... |
| CVE-2025-64282 | MEDIUM | 4.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploit... |
| CVE-2025-64236 | CRITICAL | 9.8 | 0.4% | Dec 18, 2025 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.... |
| CVE-2025-64235 | MEDIUM | 6.5 | 0.3% | Dec 18, 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows... |
| CVE-2025-63043 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid a... |
| CVE-2025-63002 | MEDIUM | 5.3 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorre... |
| CVE-2025-62998 | MEDIUM | 5 | 0.2% | Dec 18, 2025 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Re... |
| CVE-2025-62961 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured ... |
| CVE-2025-62960 | MEDIUM | 5.4 | 0.2% | Dec 18, 2025 | Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrect... |
| CVE-2025-14896 | HIGH | 8.7 | 0.3% | Dec 18, 2025 | due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an a... |
| CVE-2025-14884 | HIGH | 7.2 | 11.0% | Dec 18, 2025 | A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the com... |
| CVE-2025-14879 | CRITICAL | 9.8 | 5.9% | Dec 18, 2025 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange... |
| CVE-2025-68469 | LOW | 3.3 | 0.2% | Dec 18, 2025 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14... |
| CVE-2025-68278 | HIGH | 8.8 | 0.5% | Dec 18, 2025 | Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in... |
| CVE-2025-64724 | HIGH | 7.3 | 0.1% | Dec 18, 2025 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with wo... |
| CVE-2025-64723 | MEDIUM | 4.4 | 0.1% | Dec 18, 2025 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with ... |
| CVE-2025-63391 | — | — | 0.5% | Dec 18, 2025 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now