2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-71457 | CRITICAL | 9.8 | 0.4% | Nov 4, 2026 | vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to ch... |
| CVE-2025-11969 | CRITICAL | 9.4 | 0.3% | Nov 2, 2026 | The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to ex... |
| CVE-2025-49602 | CRITICAL | 9.8 | 0.4% | Oct 30, 2026 | An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having ... |
| CVE-2025-31704 | CRITICAL | 9.8 | 1.4% | Oct 30, 2026 | A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially craf... |
| CVE-2025-30054 | CRITICAL | 9.3 | 0.1% | Oct 23, 2026 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with roo... |
| CVE-2025-30050 | CRITICAL | 9.4 | 0.2% | Oct 23, 2026 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified ... |
| CVE-2025-30047 | CRITICAL | 9.4 | 0.4% | Oct 23, 2026 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an H... |
| CVE-2025-30046 | CRITICAL | 9 | 0.3% | Oct 23, 2026 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run w... |
| CVE-2025-65200 | CRITICAL | 9.6 | 0.3% | Oct 22, 2026 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a... |
| CVE-2025-71429 | CRITICAL | 9.8 | 2.9% | Oct 12, 2026 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthen... |
| CVE-2025-70521 | CRITICAL | 9.8 | 0.4% | Oct 7, 2026 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied inp... |
| CVE-2025-70520 | CRITICAL | 9.8 | 0.5% | Oct 7, 2026 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions agai... |
| CVE-2025-70518 | CRITICAL | 10 | 0.6% | Oct 7, 2026 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied inp... |
| CVE-2025-70516 | CRITICAL | 9.1 | 0.3% | Oct 7, 2026 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions agai... |
| CVE-2025-64393 | CRITICAL | 9.4 | 0.4% | Oct 7, 2026 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backu... |
| CVE-2025-71383 | CRITICAL | 9.8 | 0.4% | Oct 6, 2026 | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) ... |
| CVE-2025-41753 | CRITICAL | 9.8 | 0.6% | Oct 1, 2026 | The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.... |
| CVE-2025-63564 | CRITICAL | 9.8 | 0.5% | Sep 23, 2026 | SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code... |
| CVE-2025-12999 | CRITICAL | 9.1 | 0.3% | Sep 21, 2026 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwa... |
| CVE-2025-66455 | CRITICAL | 9.8 | 0.7% | Sep 18, 2026 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior... |
| CVE-2025-53837 | CRITICAL | 9.9 | 0.6% | Sep 18, 2026 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) int... |
| CVE-2025-15399 | CRITICAL | 10 | 0.2% | Sep 18, 2026 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cro... |
| CVE-2025-55787 | CRITICAL | 9.8 | 0.5% | Sep 17, 2026 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. |
| CVE-2025-56563 | CRITICAL | 9.8 | 0.6% | Sep 16, 2026 | A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts ... |
| CVE-2025-59953 | CRITICAL | 9.8 | 0.8% | Sep 16, 2026 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now