2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-55654 | MEDIUM | 5.5 | 0.2% | Oct 19, 2026 | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attacker... |
| CVE-2025-7203 | MEDIUM | 4.9 | 0.2% | Oct 19, 2026 | The Management Console and product files expose sensitive data, including remote log server credentials, truststore pass... |
| CVE-2025-7043 | MEDIUM | 5.4 | 0.2% | Oct 19, 2026 | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid ac... |
| CVE-2025-6623 | MEDIUM | 4.3 | 0.3% | Oct 19, 2026 | The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowin... |
| CVE-2025-13591 | MEDIUM | 5.3 | 0.3% | Oct 19, 2026 | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does n... |
| CVE-2025-13173 | MEDIUM | 6.5 | 0.2% | Oct 19, 2026 | Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another S... |
| CVE-2025-71435 | MEDIUM | 4.2 | 0.2% | Oct 17, 2026 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access ... |
| CVE-2025-55653 | MEDIUM | 5.5 | 0.2% | Oct 16, 2026 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Pr... |
| CVE-2025-55640 | MEDIUM | 5.5 | 0.2% | Oct 16, 2026 | A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to caus... |
| CVE-2025-52097 | MEDIUM | 5.4 | 0.3% | Oct 16, 2026 | Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary c... |
| CVE-2025-23390 | MEDIUM | 6.3 | 0.2% | Oct 15, 2026 | A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s cer... |
| CVE-2025-68403 | MEDIUM | 4.6 | 0.1% | Oct 15, 2026 | An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local at... |
| CVE-2025-66275 | MEDIUM | 6.5 | 0.4% | Oct 15, 2026 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, the... |
| CVE-2025-66272 | MEDIUM | 6.5 | 0.4% | Oct 15, 2026 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, the... |
| CVE-2025-9373 | MEDIUM | 6.4 | 0.3% | Oct 14, 2026 | The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and i... |
| CVE-2025-71431 | MEDIUM | 5.3 | 0.3% | Oct 12, 2026 | Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not ... |
| CVE-2025-71430 | MEDIUM | 5.4 | 0.2% | Oct 12, 2026 | Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard p... |
| CVE-2025-27902 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external si... |
| CVE-2025-27897 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a... |
| CVE-2025-27896 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a... |
| CVE-2025-27895 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a... |
| CVE-2025-14123 | MEDIUM | 6.8 | 0.2% | Oct 9, 2026 | The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5... |
| CVE-2025-71428 | MEDIUM | 4.9 | 0.4% | Oct 8, 2026 | Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenti... |
| CVE-2025-70519 | MEDIUM | 6.1 | 0.2% | Oct 7, 2026 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user s... |
| CVE-2025-70515 | MEDIUM | 6.1 | 0.3% | Oct 7, 2026 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user s... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now