2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-14733 | CRITICAL | 9.8 | 26.5% | Dec 19, 2025 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attac... |
| CVE-2025-64675 | CRITICAL | 9.6 | 0.6% | Dec 19, 2025 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauth... |
| CVE-2025-68398 | CRITICAL | 9.1 | 0.8% | Dec 18, 2025 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration re... |
| CVE-2025-65041 | CRITICAL | 9.8 | 0.7% | Dec 18, 2025 | Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2025-65037 | CRITICAL | 10 | 0.9% | Dec 18, 2025 | Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to exe... |
| CVE-2025-34449 | CRITICAL | 9.1 | 0.4% | Dec 18, 2025 | Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability i... |
| CVE-2025-14850 | CRITICAL | 9.1 | 0.8% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. |
| CVE-2025-14849 | CRITICAL | 9.8 | 0.6% | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute ar... |
| CVE-2025-56157 | CRITICAL | 9.8 | 0.9% | Dec 18, 2025 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file inclu... |
| CVE-2025-64236 | CRITICAL | 9.8 | 0.4% | Dec 18, 2025 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.... |
| CVE-2025-14879 | CRITICAL | 9.8 | 5.9% | Dec 18, 2025 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange... |
| CVE-2025-63389 | CRITICAL | 9.8 | 0.7% | Dec 18, 2025 | A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and includ... |
| CVE-2025-63388 | CRITICAL | 9.1 | 0.2% | Dec 18, 2025 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-f... |
| CVE-2025-63386 | CRITICAL | 9.1 | 0.2% | Dec 18, 2025 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup en... |
| CVE-2025-14878 | CRITICAL | 9.8 | 0.8% | Dec 18, 2025 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirele... |
| CVE-2025-14877 | CRITICAL | 9.8 | 0.3% | Dec 18, 2025 | A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file... |
| CVE-2025-7358 | CRITICAL | 9.8 | 0.3% | Dec 18, 2025 | Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc. SoliClub allows Authentication Abuse. T... |
| CVE-2025-65008 | CRITICAL | 9.4 | 2.7% | Dec 18, 2025 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in ... |
| CVE-2025-14860 | CRITICAL | 9.8 | 0.3% | Dec 18, 2025 | Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1. |
| CVE-2025-10910 | CRITICAL | 9.3 | 0.4% | Dec 18, 2025 | A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online... |
| CVE-2025-66078 | CRITICAL | 9.1 | 0.3% | Dec 18, 2025 | Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hote... |
| CVE-2025-66074 | CRITICAL | 9 | 0.2% | Dec 18, 2025 | Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversa... |
| CVE-2025-64374 | CRITICAL | 9.9 | 0.4% | Dec 18, 2025 | Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Fil... |
| CVE-2025-64233 | CRITICAL | 9.8 | 0.4% | Dec 18, 2025 | Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects C... |
| CVE-2025-64231 | CRITICAL | 9.9 | 0.3% | Dec 18, 2025 | Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google S... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now