2025 CVE Vulnerabilities
45,347 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-43713 | MEDIUM | 6.5 | 0.4% | Jul 3, 2025 | ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows ... |
| CVE-2025-49618 | MEDIUM | 5.8 | 0.3% | Jul 3, 2025 | In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, reg... |
| CVE-2025-49595 | MEDIUM | 4.9 | 0.4% | Jul 3, 2025 | n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/bina... |
| CVE-2025-49032 | MEDIUM | 6.5 | 0.2% | Jul 3, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Guten... |
| CVE-2025-3702 | MEDIUM | 5.4 | 0.2% | Jul 3, 2025 | Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting I... |
| CVE-2025-2537 | MEDIUM | 6.4 | 0.2% | Jul 3, 2025 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScrip... |
| CVE-2025-6563 | MEDIUM | 4.8 | 0.6% | Jul 3, 2025 | A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attac... |
| CVE-2025-40723 | MEDIUM | 5.1 | 0.3% | Jul 3, 2025 | Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a s... |
| CVE-2025-40722 | MEDIUM | 5.1 | 0.3% | Jul 3, 2025 | Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a s... |
| CVE-2025-2540 | MEDIUM | 6.4 | 0.3% | Jul 3, 2025 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto librar... |
| CVE-2025-27461 | MEDIUM | 6.8 | 0.2% | Jul 3, 2025 | During startup, the device automatically logs in the EPC2 Windows user without requesting a password. |
| CVE-2025-27460 | MEDIUM | 6.8 | 0.1% | Jul 3, 2025 | The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an... |
| CVE-2025-27455 | MEDIUM | 6.1 | 0.3% | Jul 3, 2025 | The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an atta... |
| CVE-2025-27454 | MEDIUM | 4.3 | 0.2% | Jul 3, 2025 | The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitti... |
| CVE-2025-27453 | MEDIUM | 6.5 | 0.4% | Jul 3, 2025 | The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such ... |
| CVE-2025-27451 | MEDIUM | 5.3 | 0.3% | Jul 3, 2025 | For failed login attempts, the application returns different error messages depending on whether the login failed due to... |
| CVE-2025-27450 | MEDIUM | 6.5 | 0.2% | Jul 3, 2025 | The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to esta... |
| CVE-2025-27448 | MEDIUM | 5.4 | 0.3% | Jul 3, 2025 | The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject... |
| CVE-2025-27447 | MEDIUM | 6.1 | 0.3% | Jul 3, 2025 | The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects... |
| CVE-2025-1709 | MEDIUM | 6.5 | 0.3% | Jul 3, 2025 | Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded). |
| CVE-2025-6587 | MEDIUM | 5.2 | 0.1% | Jul 3, 2025 | System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This lead... |
| CVE-2025-38173 | MEDIUM | 5.5 | 0.2% | Jul 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher ... |
| CVE-2025-38171 | MEDIUM | 5.5 | 0.1% | Jul 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Fix workqueue error handli... |
| CVE-2025-38170 | MEDIUM | 5.5 | 0.1% | Jul 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Discard stale CPU state when handling... |
| CVE-2025-38169 | MEDIUM | 5.5 | 0.1% | Jul 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Avoid clobbering kernel FPSIMD state ... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now