2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-64392 | MEDIUM | 4.8 | 0.3% | Oct 7, 2026 | This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal us... |
| CVE-2025-64391 | MEDIUM | 4.1 | 0.1% | Oct 7, 2026 | This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files... |
| CVE-2025-71384 | MEDIUM | 6.7 | 0.2% | Oct 6, 2026 | Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging ... |
| CVE-2025-8352 | MEDIUM | 6.9 | 0.3% | Oct 6, 2026 | Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumptio... |
| CVE-2025-15591 | MEDIUM | 5.3 | 0.3% | Oct 6, 2026 | Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor t... |
| CVE-2025-12828 | MEDIUM | 6.4 | 0.2% | Oct 3, 2026 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out w... |
| CVE-2025-71427 | MEDIUM | 6.8 | 0.3% | Oct 1, 2026 | Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and ... |
| CVE-2025-31980 | MEDIUM | 4.3 | 0.2% | Oct 1, 2026 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker t... |
| CVE-2025-14564 | MEDIUM | 6.4 | 0.2% | Sep 30, 2026 | The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in ... |
| CVE-2025-33207 | MEDIUM | 6.8 | 0.2% | Sep 29, 2026 | NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause imp... |
| CVE-2025-71422 | MEDIUM | 5.7 | 0.1% | Sep 27, 2026 | Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume fe... |
| CVE-2025-1218 | MEDIUM | 5.9 | 0.2% | Sep 25, 2026 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough b... |
| CVE-2025-14181 | MEDIUM | 6.5 | 0.3% | Sep 25, 2026 | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is und... |
| CVE-2025-14814 | MEDIUM | 6.4 | 0.2% | Sep 25, 2026 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbo... |
| CVE-2025-32000 | MEDIUM | 4.3 | 0.2% | Sep 24, 2026 | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input... |
| CVE-2025-15696 | MEDIUM | 6.8 | 0.3% | Sep 23, 2026 | The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rende... |
| CVE-2025-12767 | MEDIUM | 5.3 | 0.5% | Sep 22, 2026 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted reg... |
| CVE-2025-1280 | MEDIUM | 6.5 | 0.5% | Sep 22, 2026 | The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive... |
| CVE-2025-14487 | MEDIUM | 5.3 | 0.2% | Sep 22, 2026 | The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorizatio... |
| CVE-2025-14486 | MEDIUM | 5.3 | 0.2% | Sep 22, 2026 | The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in... |
| CVE-2025-14484 | MEDIUM | 5.3 | 0.2% | Sep 22, 2026 | The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization chec... |
| CVE-2025-71420 | MEDIUM | 4.3 | 0.3% | Sep 21, 2026 | UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allow... |
| CVE-2025-71419 | MEDIUM | 5.4 | 0.2% | Sep 21, 2026 | UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration... |
| CVE-2025-36421 | MEDIUM | 5.9 | 0.2% | Sep 18, 2026 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an... |
| CVE-2025-36178 | MEDIUM | 5.4 | 0.2% | Sep 18, 2026 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass inpu... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now