2025 CVE Vulnerabilities
45,348 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-6694 | MEDIUM | 4.1 | 0.3% | Jun 26, 2025 | A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects ... |
| CVE-2025-6677 | MEDIUM | 5.4 | 0.2% | Jun 26, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs ... |
| CVE-2025-6676 | MEDIUM | 5.4 | 0.2% | Jun 26, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML ... |
| CVE-2025-6675 | MEDIUM | 4.8 | 0.2% | Jun 26, 2025 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows ... |
| CVE-2025-6674 | MEDIUM | 6.1 | 0.2% | Jun 26, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Y... |
| CVE-2025-5682 | MEDIUM | 4.3 | 0.2% | Jun 26, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cooki... |
| CVE-2025-52573 | MEDIUM | 6 | 0.7% | Jun 26, 2025 | iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulator... |
| CVE-2025-48923 | MEDIUM | 6.1 | 0.2% | Jun 26, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allo... |
| CVE-2025-48922 | MEDIUM | 6.1 | 0.2% | Jun 26, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox a... |
| CVE-2025-3773 | MEDIUM | 5.5 | 0.1% | Jun 26, 2025 | A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authentic... |
| CVE-2025-3722 | MEDIUM | 4.4 | 0.2% | Jun 26, 2025 | A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privi... |
| CVE-2025-6703 | MEDIUM | 6.5 | 0.2% | Jun 26, 2025 | Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0... |
| CVE-2025-6212 | MEDIUM | 6.1 | 0.3% | Jun 26, 2025 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database m... |
| CVE-2025-5842 | MEDIUM | 5.4 | 0.3% | Jun 26, 2025 | The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in... |
| CVE-2025-5338 | MEDIUM | 5.4 | 0.2% | Jun 26, 2025 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all... |
| CVE-2025-5846 | MEDIUM | 4.3 | 0.2% | Jun 26, 2025 | An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1... |
| CVE-2025-5315 | MEDIUM | 4.3 | 0.2% | Jun 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18... |
| CVE-2025-48497 | MEDIUM | 5.1 | 0.1% | Jun 26, 2025 | Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a speci... |
| CVE-2025-41404 | MEDIUM | 5.3 | 0.2% | Jun 26, 2025 | Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is e... |
| CVE-2025-3279 | MEDIUM | 6.5 | 0.3% | Jun 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18... |
| CVE-2025-1754 | MEDIUM | 5.3 | 0.2% | Jun 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18... |
| CVE-2025-6546 | MEDIUM | 5.4 | 0.2% | Jun 26, 2025 | The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ para... |
| CVE-2025-6540 | MEDIUM | 6.4 | 0.2% | Jun 26, 2025 | The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions u... |
| CVE-2025-6537 | MEDIUM | 5.4 | 0.2% | Jun 26, 2025 | The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parame... |
| CVE-2025-5932 | MEDIUM | 4.3 | 0.2% | Jun 26, 2025 | The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now