2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-53699 | HIGH | 7 | — | Nov 13, 2026 | Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Con... |
| CVE-2025-53698 | HIGH | 7 | — | Nov 13, 2026 | Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson ... |
| CVE-2025-53697 | HIGH | 8.4 | — | Nov 13, 2026 | Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Contr... |
| CVE-2025-43874 | HIGH | 8.7 | — | Nov 13, 2026 | : Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johns... |
| CVE-2025-43867 | HIGH | 8.5 | — | Nov 13, 2026 | - Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and... |
| CVE-2025-71459 | HIGH | 8.1 | 0.5% | Nov 13, 2026 | Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside... |
| CVE-2025-0043 | HIGH | 7 | 0.1% | Nov 12, 2026 | Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalat... |
| CVE-2025-10935 | HIGH | 7.8 | 0.2% | Nov 12, 2026 | libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remo... |
| CVE-2025-0008 | HIGH | 8.4 | 0.1% | Nov 10, 2026 | Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potential... |
| CVE-2025-61625 | HIGH | 8.1 | 0.7% | Nov 10, 2026 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyze... |
| CVE-2025-10248 | HIGH | 7.2 | 0.3% | Nov 9, 2026 | XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a maliciou... |
| CVE-2025-71458 | HIGH | 7.5 | 0.4% | Nov 6, 2026 | FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection ... |
| CVE-2025-15702 | HIGH | 8.8 | 0.3% | Nov 5, 2026 | The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block as... |
| CVE-2025-66368 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Incorrect handling of SDP payload leads to a Denial of Service |
| CVE-2025-66367 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Improper handling of NAS DLTransport messages may lead to a baseband crash. |
| CVE-2025-66366 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash |
| CVE-2025-66364 | HIGH | 7.5 | 0.1% | Nov 5, 2026 | Continuously sending control‑plane messages causes the baseband to crashes. |
| CVE-2025-71456 | HIGH | 8.1 | 0.3% | Nov 4, 2026 | vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject ... |
| CVE-2025-11229 | HIGH | 7.2 | 0.4% | Nov 4, 2026 | The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This ... |
| CVE-2025-26433 | HIGH | 8.4 | 0.1% | Nov 2, 2026 | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay a... |
| CVE-2025-22436 | HIGH | 8.4 | 0.1% | Nov 2, 2026 | In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ove... |
| CVE-2025-8574 | HIGH | 8.7 | 0.4% | Oct 30, 2026 | The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including... |
| CVE-2025-68394 | HIGH | 8.4 | 0.2% | Oct 30, 2026 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o... |
| CVE-2025-68393 | HIGH | 8.4 | 0.2% | Oct 30, 2026 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o... |
| CVE-2025-62841 | HIGH | 8.7 | 0.2% | Oct 29, 2026 | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Bac... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now