2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-43428 | CRITICAL | 9.8 | 0.7% | Dec 17, 2025 | A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS... |
| CVE-2025-67787 | CRITICAL | 9.6 | 0.3% | Dec 17, 2025 | An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allow... |
| CVE-2025-67781 | CRITICAL | 9.9 | 0.3% | Dec 17, 2025 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged ... |
| CVE-2025-67073 | CRITICAL | 9.8 | 0.7% | Dec 17, 2025 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remot... |
| CVE-2025-34434 | CRITICAL | 9.1 | 0.4% | Dec 17, 2025 | AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and dele... |
| CVE-2025-62521 | CRITICAL | 9.8 | 4.2% | Dec 17, 2025 | ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code executio... |
| CVE-2025-67165 | CRITICAL | 9.8 | 0.5% | Dec 17, 2025 | An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. |
| CVE-2025-67164 | CRITICAL | 9.9 | 0.5% | Dec 17, 2025 | An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows att... |
| CVE-2025-20393 | CRITICAL | 10 | 29.1% | Dec 17, 2025 | A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure... |
| CVE-2025-44005 | CRITICAL | 10 | 3.3% | Dec 17, 2025 | An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without ... |
| CVE-2025-67895 | CRITICAL | 9.8 | 0.8% | Dec 17, 2025 | Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you in... |
| CVE-2025-59374 | CRITICAL | 9.8 | 1.2% | Dec 17, 2025 | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modificat... |
| CVE-2025-14700 | CRITICAL | 9.9 | 6.0% | Dec 17, 2025 | An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authentica... |
| CVE-2025-53619 | CRITICAL | 9.1 | 0.3% | Dec 16, 2025 | An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A ... |
| CVE-2025-53618 | CRITICAL | 9.1 | 0.3% | Dec 16, 2025 | An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A ... |
| CVE-2025-48429 | CRITICAL | 9.1 | 0.4% | Dec 16, 2025 | An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A sp... |
| CVE-2025-65834 | CRITICAL | 9.8 | 0.4% | Dec 16, 2025 | Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT projec... |
| CVE-2025-68270 | CRITICAL | 9.9 | 0.3% | Dec 16, 2025 | The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, Cours... |
| CVE-2025-62864 | CRITICAL | 9.8 | 0.4% | Dec 16, 2025 | Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.... |
| CVE-2025-62863 | CRITICAL | 9.8 | 0.4% | Dec 16, 2025 | Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.... |
| CVE-2025-46295 | CRITICAL | 9.8 | 0.9% | Dec 16, 2025 | Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications pass... |
| CVE-2025-33210 | CRITICAL | 9 | 0.5% | Dec 16, 2025 | NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to cod... |
| CVE-2025-63414 | CRITICAL | 10 | 1.6% | Dec 16, 2025 | A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to a... |
| CVE-2025-50401 | CRITICAL | 9.8 | 0.4% | Dec 16, 2025 | Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the pa... |
| CVE-2025-50398 | CRITICAL | 9.8 | 0.4% | Dec 16, 2025 | Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the pa... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now