2025 CVE Vulnerabilities
45,181 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-6071 | MEDIUM | 6.3 | 0.2% | Jul 3, 2025 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to sal... |
| CVE-2025-53502 | MEDIUM | 6.5 | 0.2% | Jul 3, 2025 | Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Sc... |
| CVE-2025-53500 | MEDIUM | 5.6 | 0.2% | Jul 3, 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F... |
| CVE-2025-53489 | MEDIUM | 5.6 | 0.2% | Jul 3, 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F... |
| CVE-2025-49846 | MEDIUM | 4.1 | 0.1% | Jul 3, 2025 | wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages t... |
| CVE-2025-48939 | MEDIUM | 4.2 | 0.2% | Jul 3, 2025 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in... |
| CVE-2025-53490 | MEDIUM | 5.6 | 0.2% | Jul 3, 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F... |
| CVE-2025-45938 | MEDIUM | 5.4 | 0.2% | Jul 3, 2025 | Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName paramete... |
| CVE-2025-43713 | MEDIUM | 6.5 | 0.4% | Jul 3, 2025 | ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows ... |
| CVE-2025-49618 | MEDIUM | 5.8 | 0.3% | Jul 3, 2025 | In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, reg... |
| CVE-2025-49595 | MEDIUM | 4.9 | 0.4% | Jul 3, 2025 | n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/bina... |
| CVE-2025-49032 | MEDIUM | 6.5 | 0.2% | Jul 3, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Guten... |
| CVE-2025-3702 | MEDIUM | 5.4 | 0.2% | Jul 3, 2025 | Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting I... |
| CVE-2025-2537 | MEDIUM | 6.4 | 0.2% | Jul 3, 2025 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScrip... |
| CVE-2025-6563 | MEDIUM | 4.8 | 0.6% | Jul 3, 2025 | A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attac... |
| CVE-2025-40723 | MEDIUM | 5.1 | 0.3% | Jul 3, 2025 | Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a s... |
| CVE-2025-40722 | MEDIUM | 5.1 | 0.3% | Jul 3, 2025 | Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a s... |
| CVE-2025-2540 | MEDIUM | 6.4 | 0.3% | Jul 3, 2025 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto librar... |
| CVE-2025-27461 | MEDIUM | 6.8 | 0.2% | Jul 3, 2025 | During startup, the device automatically logs in the EPC2 Windows user without requesting a password. |
| CVE-2025-27460 | MEDIUM | 6.8 | 0.1% | Jul 3, 2025 | The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an... |
| CVE-2025-27455 | MEDIUM | 6.1 | 0.3% | Jul 3, 2025 | The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an atta... |
| CVE-2025-27454 | MEDIUM | 4.3 | 0.2% | Jul 3, 2025 | The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitti... |
| CVE-2025-27453 | MEDIUM | 6.5 | 0.4% | Jul 3, 2025 | The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such ... |
| CVE-2025-27451 | MEDIUM | 5.3 | 0.3% | Jul 3, 2025 | For failed login attempts, the application returns different error messages depending on whether the login failed due to... |
| CVE-2025-27450 | MEDIUM | 6.5 | 0.2% | Jul 3, 2025 | The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to esta... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now