2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-68875 | MEDIUM | 6.5 | 0.2% | Jan 8, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming... |
| CVE-2025-68867 | MEDIUM | 6.5 | 0.2% | Jan 8, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Ef... |
| CVE-2025-67926 | MEDIUM | 6.5 | 0.3% | Jan 8, 2026 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Confi... |
| CVE-2025-67919 | MEDIUM | 6.5 | 0.3% | Jan 8, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting ... |
| CVE-2025-67917 | MEDIUM | 6.5 | 0.3% | Jan 8, 2026 | Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Cont... |
| CVE-2025-67913 | MEDIUM | 6.5 | 0.3% | Jan 8, 2026 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionali... |
| CVE-2025-22726 | MEDIUM | 6.4 | 0.2% | Jan 8, 2026 | Server-Side Request Forgery (SSRF) vulnerability in _nK nK Themes Helper nk-themes-helper allows Server Side Request For... |
| CVE-2025-15079 | MEDIUM | 5.3 | 0.5% | Jan 8, 2026 | When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenl... |
| CVE-2025-14984 | MEDIUM | 6.4 | 0.3% | Jan 8, 2026 | The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all version... |
| CVE-2025-14819 | MEDIUM | 5.3 | 0.8% | Jan 8, 2026 | When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option,... |
| CVE-2025-14524 | MEDIUM | 5.3 | 0.7% | Jan 8, 2026 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a s... |
| CVE-2025-14017 | MEDIUM | 6.3 | 0.1% | Jan 8, 2026 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadver... |
| CVE-2025-13034 | MEDIUM | 5.9 | 0.2% | Jan 8, 2026 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the p... |
| CVE-2025-13679 | MEDIUM | 6.5 | 0.2% | Jan 8, 2026 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data d... |
| CVE-2025-14275 | MEDIUM | 6.4 | 0.2% | Jan 8, 2026 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu... |
| CVE-2025-12640 | MEDIUM | 4.3 | 0.2% | Jan 8, 2026 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vul... |
| CVE-2025-12776 | MEDIUM | 5.4 | 0.1% | Jan 7, 2026 | The Report Builder component of the application stores user input directly in a web page and displays it to other users,... |
| CVE-2025-69255 | MEDIUM | 4 | 0.3% | Jan 7, 2026 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed g... |
| CVE-2025-69221 | MEDIUM | 4.3 | 0.3% | Jan 7, 2026 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when que... |
| CVE-2025-69220 | MEDIUM | 5.9 | 0.3% | Jan 7, 2026 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file... |
| CVE-2025-64305 | MEDIUM | 6.5 | 0.1% | Jan 7, 2026 | MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vend... |
| CVE-2025-61939 | MEDIUM | 4.4 | 0.3% | Jan 7, 2026 | An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authe... |
| CVE-2025-61782 | MEDIUM | 6.1 | 0.3% | Jan 7, 2026 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.... |
| CVE-2025-58441 | MEDIUM | 6.5 | 0.2% | Jan 7, 2026 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-si... |
| CVE-2025-4677 | MEDIUM | 6.5 | 0.2% | Jan 7, 2026 | Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.Thi... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now