2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-61676 | MEDIUM | 4.8 | 0.2% | Jan 10, 2026 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripti... |
| CVE-2025-61674 | MEDIUM | 4.8 | 0.2% | Jan 10, 2026 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripti... |
| CVE-2025-68470 | MEDIUM | 6.5 | 0.2% | Jan 10, 2026 | React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path ... |
| CVE-2025-46299 | MEDIUM | 4.3 | 0.3% | Jan 9, 2026 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 ... |
| CVE-2025-46298 | MEDIUM | 6.5 | 0.3% | Jan 9, 2026 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, mac... |
| CVE-2025-46297 | MEDIUM | 5.5 | 0.1% | Jan 9, 2026 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be a... |
| CVE-2025-46286 | MEDIUM | 4.3 | 0.2% | Jan 9, 2026 | A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a ... |
| CVE-2025-60538 | MEDIUM | 6.5 | 0.4% | Jan 9, 2026 | A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a bru... |
| CVE-2025-51626 | MEDIUM | 6.5 | 0.2% | Jan 9, 2026 | SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint. |
| CVE-2025-67811 | MEDIUM | 6.5 | 0.3% | Jan 9, 2026 | Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient in... |
| CVE-2025-67810 | MEDIUM | 6.5 | 0.3% | Jan 9, 2026 | In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST req... |
| CVE-2025-66715 | MEDIUM | 6.5 | 0.2% | Jan 9, 2026 | A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DL... |
| CVE-2025-67004 | MEDIUM | 6.5 | 5.6% | Jan 9, 2026 | ** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via t... |
| CVE-2025-67282 | MEDIUM | 5.4 | 0.2% | Jan 9, 2026 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileg... |
| CVE-2025-67281 | MEDIUM | 5.4 | 0.2% | Jan 9, 2026 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and ... |
| CVE-2025-67280 | MEDIUM | 5.4 | 0.2% | Jan 9, 2026 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a... |
| CVE-2025-67279 | MEDIUM | 5.3 | 0.3% | Jan 9, 2026 | An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges vi... |
| CVE-2025-67278 | MEDIUM | 6.5 | 0.3% | Jan 9, 2026 | An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges vi... |
| CVE-2025-46676 | MEDIUM | 4.9 | 0.3% | Jan 9, 2026 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.... |
| CVE-2025-46644 | MEDIUM | 6.7 | 0.5% | Jan 9, 2026 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.... |
| CVE-2025-46643 | MEDIUM | 4.4 | 0.1% | Jan 9, 2026 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.... |
| CVE-2025-66051 | MEDIUM | 6.5 | 0.7% | Jan 9, 2026 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated a... |
| CVE-2025-14172 | MEDIUM | 6.5 | 0.4% | Jan 9, 2026 | The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and i... |
| CVE-2025-13967 | MEDIUM | 6.4 | 0.2% | Jan 9, 2026 | The Woodpecker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_name' param... |
| CVE-2025-13908 | MEDIUM | 6.4 | 0.2% | Jan 9, 2026 | The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortco... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now