2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-15702 | HIGH | 8.8 | 0.3% | Nov 5, 2026 | The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block as... |
| CVE-2025-15701 | LOW | 3.5 | 0.1% | Nov 5, 2026 | The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting ... |
| CVE-2025-66368 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Incorrect handling of SDP payload leads to a Denial of Service |
| CVE-2025-66367 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Improper handling of NAS DLTransport messages may lead to a baseband crash. |
| CVE-2025-66366 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash |
| CVE-2025-66365 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | Incorrect handling of SIP packets leads to baseband crashes |
| CVE-2025-66364 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Continuously sending control‑plane messages causes the baseband to crashes. |
| CVE-2025-71457 | CRITICAL | 9.8 | 0.4% | Nov 4, 2026 | vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to ch... |
| CVE-2025-71456 | HIGH | 8.1 | 0.3% | Nov 4, 2026 | vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject ... |
| CVE-2025-71455 | MEDIUM | 5.3 | 0.3% | Nov 4, 2026 | vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSI... |
| CVE-2025-71454 | MEDIUM | 6.5 | 0.2% | Nov 4, 2026 | vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/Vte... |
| CVE-2025-71453 | MEDIUM | 6.1 | 0.2% | Nov 4, 2026 | vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php t... |
| CVE-2025-11229 | HIGH | 7.2 | 0.4% | Nov 4, 2026 | The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This ... |
| CVE-2025-71452 | MEDIUM | 6.1 | 0.3% | Nov 3, 2026 | Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clients... |
| CVE-2025-71451 | MEDIUM | 6.1 | 0.3% | Nov 3, 2026 | Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/servers... |
| CVE-2025-5769 | MEDIUM | 6.1 | 0.2% | Nov 3, 2026 | The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This l... |
| CVE-2025-1397 | MEDIUM | 4.8 | 0.2% | Nov 3, 2026 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider ... |
| CVE-2025-26433 | HIGH | 8.4 | 0.1% | Nov 2, 2026 | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay a... |
| CVE-2025-22436 | HIGH | 8.4 | 0.1% | Nov 2, 2026 | In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ove... |
| CVE-2025-71450 | LOW | 3.3 | 0.1% | Nov 2, 2026 | inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read... |
| CVE-2025-62819 | MEDIUM | 6.5 | 0.2% | Nov 2, 2026 | Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the... |
| CVE-2025-12544 | MEDIUM | 4.8 | 0.2% | Nov 2, 2026 | The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to... |
| CVE-2025-13647 | MEDIUM | 5.8 | 0.2% | Nov 2, 2026 | The affected component fails to enforce expected validation constraints on the `content-type` header when processing cer... |
| CVE-2025-11969 | CRITICAL | 9.4 | 0.3% | Nov 2, 2026 | The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to ex... |
| CVE-2025-9462 | MEDIUM | 6.5 | 0.3% | Oct 31, 2026 | The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now