2025 CVE Vulnerabilities
45,206 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-27561 | MEDIUM | 6.9 | 0.2% | Apr 15, 2025 | Unauthenticated attackers can rename "rooms" of arbitrary users. |
| CVE-2025-26998 | MEDIUM | 5.4 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT B... |
| CVE-2025-26996 | MEDIUM | 6.5 | 0.3% | Apr 15, 2025 | Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets a... |
| CVE-2025-26951 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Bloc... |
| CVE-2025-26950 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali... |
| CVE-2025-26934 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy... |
| CVE-2025-26930 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Home S... |
| CVE-2025-26919 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainá tai... |
| CVE-2025-26906 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Del... |
| CVE-2025-26903 | MEDIUM | 4.3 | 0.1% | Apr 15, 2025 | Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Fo... |
| CVE-2025-26880 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT S... |
| CVE-2025-26870 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi... |
| CVE-2025-26857 | MEDIUM | 5.3 | 0.3% | Apr 15, 2025 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). |
| CVE-2025-26749 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Addition... |
| CVE-2025-26740 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware Spa... |
| CVE-2025-25276 | MEDIUM | 6.5 | 0.3% | Apr 15, 2025 | An unauthenticated attacker can hijack other users' devices and potentially control them. |
| CVE-2025-24850 | MEDIUM | 6.9 | 0.3% | Apr 15, 2025 | An attacker can export other users' plant information. |
| CVE-2025-24315 | MEDIUM | 6.9 | 0.5% | Apr 15, 2025 | Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
| CVE-2025-22269 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC R... |
| CVE-2025-22268 | MEDIUM | 6.5 | 0.2% | Apr 15, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncann... |
| CVE-2025-31949 | MEDIUM | 5.3 | 0.2% | Apr 15, 2025 | An authenticated attacker can obtain any plant name by knowing the plant ID. |
| CVE-2025-31941 | MEDIUM | 6.9 | 0.3% | Apr 15, 2025 | An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
| CVE-2025-31933 | MEDIUM | 6.9 | 0.3% | Apr 15, 2025 | An unauthenticated attacker can check the existence of usernames in the system by querying an API. |
| CVE-2025-31357 | MEDIUM | 6.9 | 0.3% | Apr 15, 2025 | An unauthenticated attacker can obtain a user's plant list by knowing the username. |
| CVE-2025-30740 | MEDIUM | 6.5 | 0.3% | Apr 15, 2025 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now