2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-50005 | MEDIUM | 6.5 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Comp... |
| CVE-2025-49375 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access ... |
| CVE-2025-49336 | MEDIUM | 5.9 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pondol Pondol BBS ... |
| CVE-2025-47600 | MEDIUM | 5.3 | 0.3% | Jan 22, 2026 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart ... |
| CVE-2025-47500 | MEDIUM | 5.9 | 0.3% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Intal Sta... |
| CVE-2025-31413 | MEDIUM | 4.3 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite all... |
| CVE-2025-69820 | MEDIUM | 6 | 1.0% | Jan 22, 2026 | Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via t... |
| CVE-2025-69612 | MEDIUM | 6.5 | 0.9% | Jan 22, 2026 | A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.... |
| CVE-2025-32057 | MEDIUM | 6.5 | 0.3% | Jan 22, 2026 | The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-... |
| CVE-2025-32056 | MEDIUM | 4 | 0.3% | Jan 22, 2026 | The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head... |
| CVE-2025-15523 | MEDIUM | 4.8 | 0.1% | Jan 22, 2026 | MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permis... |
| CVE-2025-67683 | MEDIUM | 6.1 | 0.3% | Jan 22, 2026 | Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when ope... |
| CVE-2025-4763 | MEDIUM | 6.1 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Comput... |
| CVE-2025-13335 | MEDIUM | 6.5 | 0.5% | Jan 22, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 1... |
| CVE-2025-71176 | MEDIUM | 6.8 | 0.1% | Jan 22, 2026 | pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users... |
| CVE-2025-27379 | MEDIUM | 4.6 | 0.2% | Jan 22, 2026 | A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker... |
| CVE-2025-27377 | MEDIUM | 5.3 | 0.2% | Jan 22, 2026 | Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capa... |
| CVE-2025-69285 | MEDIUM | 6.1 | 0.4% | Jan 21, 2026 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a mi... |
| CVE-2025-69209 | MEDIUM | 6.9 | 0.1% | Jan 21, 2026 | ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in ... |
| CVE-2025-68140 | MEDIUM | 4.3 | 0.1% | Jan 21, 2026 | EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has b... |
| CVE-2025-68139 | MEDIUM | 4.3 | 0.1% | Jan 21, 2026 | EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminat... |
| CVE-2025-68138 | MEDIUM | 4.7 | 0.2% | Jan 21, 2026 | EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol.... |
| CVE-2025-13465 | MEDIUM | 5.3 | 1.8% | Jan 21, 2026 | The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths whi... |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.5% | Jan 21, 2026 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the... |
| CVE-2025-68135 | MEDIUM | 6.5 | 0.3% | Jan 21, 2026 | EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now