2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-13801 | HIGH | 7.5 | 1.7% | Jan 7, 2026 | The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via t... |
| CVE-2025-13493 | HIGH | 7.5 | 0.3% | Jan 7, 2026 | The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, a... |
| CVE-2025-13371 | HIGH | 8.6 | 0.4% | Jan 7, 2026 | The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including... |
| CVE-2025-11877 | HIGH | 7.5 | 0.3% | Jan 7, 2026 | The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed... |
| CVE-2025-11235 | HIGH | 7.5 | 0.2% | Jan 7, 2026 | Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MO... |
| CVE-2025-31642 | HIGH | 7.1 | 0.2% | Jan 7, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHU... |
| CVE-2025-30631 | HIGH | 7.1 | 0.2% | Jan 6, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerc... |
| CVE-2025-29004 | HIGH | 8.8 | 0.3% | Jan 6, 2026 | Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Re... |
| CVE-2025-32304 | HIGH | 8.1 | 0.5% | Jan 6, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2025-15382 | HIGH | 8.1 | 0.4% | Jan 6, 2026 | A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote att... |
| CVE-2025-69356 | HIGH | 7.5 | 0.4% | Jan 6, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2025-69351 | HIGH | 8.5 | 0.2% | Jan 6, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ni... |
| CVE-2025-69342 | HIGH | 7.5 | 0.4% | Jan 6, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2025-69086 | HIGH | 8.1 | 0.4% | Jan 6, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2025-69085 | HIGH | 7.1 | 0.2% | Jan 6, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank ... |
| CVE-2025-69084 | HIGH | 7.1 | 0.2% | Jan 6, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Ga... |
| CVE-2025-69083 | HIGH | 8.1 | 0.4% | Jan 6, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2025-47553 | HIGH | 8.8 | 0.3% | Jan 6, 2026 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This is... |
| CVE-2025-36589 | HIGH | 7.1 | 0.3% | Jan 6, 2026 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vul... |
| CVE-2025-59379 | HIGH | 7.5 | 0.4% | Jan 6, 2026 | DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information f... |
| CVE-2025-14979 | HIGH | 7.8 | 0.2% | Jan 6, 2026 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privilege... |
| CVE-2025-14026 | HIGH | 7.8 | 0.2% | Jan 6, 2026 | Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5... |
| CVE-2025-14997 | HIGH | 8.8 | 0.7% | Jan 6, 2026 | The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic... |
| CVE-2025-12793 | HIGH | 7.8 | 0.1% | Jan 6, 2026 | An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the ap... |
| CVE-2025-20801 | HIGH | 7 | 0.1% | Jan 6, 2026 | In seninf, there is a possible memory corruption due to a race condition. This could lead to local escalation of privile... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now