2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-12995 | CRITICAL | 9.8 | 0.3% | Dec 4, 2025 | Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint ... |
| CVE-2025-63362 | CRITICAL | 9.8 | 0.6% | Dec 4, 2025 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00... |
| CVE-2025-14015 | CRITICAL | 9.8 | 0.8% | Dec 4, 2025 | A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /gof... |
| CVE-2025-66516 | CRITICAL | 9.8 | 79.8% | Dec 4, 2025 | Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules... |
| CVE-2025-40261 | CRITICAL | 9.8 | 0.6% | Dec 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in ... |
| CVE-2025-40258 | CRITICAL | 9.8 | 0.5% | Dec 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() ... |
| CVE-2025-40257 | CRITICAL | 9.8 | 0.5% | Dec 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptc... |
| CVE-2025-40252 | CRITICAL | 9.8 | 0.6% | Dec 4, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read ... |
| CVE-2025-65346 | CRITICAL | 9.1 | 1.0% | Dec 4, 2025 | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality ... |
| CVE-2025-54304 | CRITICAL | 9.8 | 0.5% | Dec 4, 2025 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 dis... |
| CVE-2025-54303 | CRITICAL | 9.8 | 0.4% | Dec 4, 2025 | The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for... |
| CVE-2025-53963 | CRITICAL | 9.8 | 0.5% | Dec 4, 2025 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible ov... |
| CVE-2025-14004 | CRITICAL | 9.8 | 0.4% | Dec 4, 2025 | A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind... |
| CVE-2025-64055 | CRITICAL | 9.8 | 0.5% | Dec 3, 2025 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access admi... |
| CVE-2025-66489 | CRITICAL | 9.8 | 0.8% | Dec 3, 2025 | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker ... |
| CVE-2025-66222 | CRITICAL | 9.6 | 0.6% | Dec 3, 2025 | DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting... |
| CVE-2025-66208 | CRITICAL | 9.8 | 1.8% | Dec 3, 2025 | Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing ... |
| CVE-2025-66032 | CRITICAL | 9.8 | 0.6% | Dec 3, 2025 | Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and shor... |
| CVE-2025-64443 | CRITICAL | 9.6 | 0.4% | Dec 3, 2025 | MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gatew... |
| CVE-2025-34319 | CRITICAL | 9.3 | 4.4% | Dec 3, 2025 | TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contai... |
| CVE-2025-55182 | CRITICAL | 10 | 99.8% | Dec 3, 2025 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1... |
| CVE-2025-65267 | CRITICAL | 9 | 0.4% | Dec 3, 2025 | In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to... |
| CVE-2025-13390 | CRITICAL | 9.8 | 4.6% | Dec 3, 2025 | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1... |
| CVE-2025-13342 | CRITICAL | 9.8 | 2.2% | Dec 3, 2025 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress ... |
| CVE-2025-13486 | CRITICAL | 9.8 | 67.6% | Dec 3, 2025 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 thr... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now