2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-23390 | MEDIUM | 6.3 | 0.2% | Oct 15, 2026 | A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s cer... |
| CVE-2025-68404 | HIGH | 7.5 | 0.2% | Oct 15, 2026 | A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, th... |
| CVE-2025-68403 | MEDIUM | 4.6 | 0.1% | Oct 15, 2026 | An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local at... |
| CVE-2025-66275 | MEDIUM | 6.5 | 0.4% | Oct 15, 2026 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, the... |
| CVE-2025-66272 | MEDIUM | 6.5 | 0.4% | Oct 15, 2026 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, the... |
| CVE-2025-29897 | LOW | 2.3 | 0.3% | Oct 15, 2026 | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attack... |
| CVE-2025-29896 | LOW | 2.3 | 0.3% | Oct 15, 2026 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user ac... |
| CVE-2025-29895 | LOW | 2.3 | 0.3% | Oct 15, 2026 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user ac... |
| CVE-2025-71433 | HIGH | 7.5 | 0.6% | Oct 14, 2026 | Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other worksp... |
| CVE-2025-9373 | MEDIUM | 6.4 | 0.3% | Oct 14, 2026 | The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and i... |
| CVE-2025-57739 | HIGH | 8.8 | 0.3% | Oct 13, 2026 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerabi... |
| CVE-2025-46773 | HIGH | 8.8 | 0.3% | Oct 13, 2026 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi... |
| CVE-2025-58774 | HIGH | 8.3 | 0.1% | Oct 13, 2026 | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local a... |
| CVE-2025-58773 | HIGH | 7.1 | 0.1% | Oct 13, 2026 | AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exp... |
| CVE-2025-58772 | HIGH | 8.2 | 0.1% | Oct 13, 2026 | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful... |
| CVE-2025-58771 | HIGH | 7.1 | 0.1% | Oct 13, 2026 | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Succ... |
| CVE-2025-71432 | HIGH | 8.1 | 0.3% | Oct 12, 2026 | Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to mis... |
| CVE-2025-71431 | MEDIUM | 5.3 | 0.3% | Oct 12, 2026 | Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not ... |
| CVE-2025-71430 | MEDIUM | 5.4 | 0.2% | Oct 12, 2026 | Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard p... |
| CVE-2025-71429 | CRITICAL | 9.8 | 2.9% | Oct 12, 2026 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthen... |
| CVE-2025-27902 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external si... |
| CVE-2025-27897 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a... |
| CVE-2025-27896 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a... |
| CVE-2025-27895 | MEDIUM | 6.1 | 0.2% | Oct 12, 2026 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability a... |
| CVE-2025-15703 | LOW | 3.5 | 0.1% | Oct 12, 2026 | The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now