2025 CVE Vulnerabilities
45,223 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-61780 | MEDIUM | 5.3 | 0.4% | Oct 10, 2025 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclos... |
| CVE-2025-61689 | HIGH | 8.7 | 0.3% | Oct 10, 2025 | HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl... |
| CVE-2025-60308 | MEDIUM | 4.1 | 0.2% | Oct 10, 2025 | code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room ... |
| CVE-2025-60306 | CRITICAL | 9.9 | 0.4% | Oct 10, 2025 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privil... |
| CVE-2025-60269 | CRITICAL | 9.4 | 0.3% | Oct 10, 2025 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework... |
| CVE-2025-60307 | CRITICAL | 9.8 | 0.4% | Oct 10, 2025 | code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in t... |
| CVE-2025-60305 | HIGH | 8.8 | 0.4% | Oct 10, 2025 | SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains a... |
| CVE-2025-59530 | HIGH | 7.5 | 0.4% | Oct 10, 2025 | quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving ... |
| CVE-2025-48043 | HIGH | 8.6 | 0.5% | Oct 10, 2025 | Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated ... |
| CVE-2025-60869 | HIGH | 7.3 | 0.2% | Oct 10, 2025 | Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fie... |
| CVE-2025-60378 | HIGH | 8.1 | 1.1% | Oct 10, 2025 | Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into in... |
| CVE-2025-8887 | MEDIUM | 6.1 | 0.1% | Oct 10, 2025 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unautho... |
| CVE-2025-8886 | MEDIUM | 6.7 | 0.2% | Oct 10, 2025 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missi... |
| CVE-2025-61319 | MEDIUM | 6.1 | 0.3% | Oct 10, 2025 | ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. Whe... |
| CVE-2025-61152 | MEDIUM | 6.5 | 0.3% | Oct 10, 2025 | python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature ... |
| CVE-2025-60868 | MEDIUM | 6.5 | 0.2% | Oct 10, 2025 | The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Str... |
| CVE-2025-62239 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and L... |
| CVE-2025-62238 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 th... |
| CVE-2025-62237 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.11... |
| CVE-2025-7781 | MEDIUM | 6.4 | 0.2% | Oct 10, 2025 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘... |
| CVE-2025-7374 | MEDIUM | 5.4 | 0.2% | Oct 10, 2025 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions ... |
| CVE-2025-11579 | MEDIUM | 6.5 | 0.4% | Oct 10, 2025 | github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary siz... |
| CVE-2025-61864 | HIGH | 8.4 | 0.2% | Oct 10, 2025 | A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially craft... |
| CVE-2025-61863 | HIGH | 8.4 | 0.2% | Oct 10, 2025 | An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier. Opening sp... |
| CVE-2025-61862 | HIGH | 8.4 | 0.2% | Oct 10, 2025 | An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier. Opening sp... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now