Week 2, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.0
  CVE-2025-0282 A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gatewa…

  ivanti · Connect Secure · Policy Secure · Neurons for ZTA gateways

  EPSS 100%
• Critical 10.0
  CVE-2024-50603 An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS …

  Aviatrix · Controller

  EPSS 99%
• Critical 9.8
  CVE-2024-54676 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

  Apache Software Foundation · Apache OpenMeetings

  EPSS 69%
• Critical 9.3
  CVE-2024-56511 DataEase has an unauthorized vulnerability

  dataease · dataease

  EPSS 50%
• Critical 9.8
  CVE-2024-55556 A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipul…
  EPSS 44%
• Critical 9.8
  CVE-2024-12847 NETGEAR DGN setup.cgi OS Command Injection

  NETGEAR · DGN1000

  EPSS 30%
• Critical 9.1
  CVE-2024-54819 I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php
  EPSS 21%
• Critical 9.8
  CVE-2025-0247 Memory safety bugs fixed in Firefox 134 and Thunderbird 134

  Mozilla · Firefox · Thunderbird

  EPSS 11%
• Critical 9.8
  CVE-2024-11613 WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

  Nickboss · Iptanus File Upload

  EPSS 4.4%
• Critical 9.8
  CVE-2024-12252 SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

  seobeginner · SEO LAT Auto Post

  EPSS 3.3%
• Critical 9.8
  CVE-2024-57687 An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to e…
  EPSS 2.6%
• Critical 9.3
  CVE-2024-43654 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

  Iocharger · Iocharger firmware for AC models

  EPSS 2.2%
• Critical 9.3
  CVE-2024-43653 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

  Iocharger · Iocharger firmware for AC models

  EPSS 2.2%
• Critical 9.3
  CVE-2024-43652 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

  Iocharger · Iocharger firmware for AC chargers

  EPSS 2%
• Critical 9.8
  CVE-2025-22949 Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution.
  EPSS 2%

All 101 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.2
  CVE-2024-53704 An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

  SonicWall · SonicOS

  EPSS 95%
• High 7.7
  CVE-2025-0107 Expedition: OS Command Injection Vulnerability

  Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

  EPSS 78%
• High 7.5
  CVE-2024-12849 Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read

  wpguruin · Error Log Viewer By WP Guru

  EPSS 48%
• High 8.8
  CVE-2025-21385 Microsoft Purview Information Disclosure Vulnerability

  Microsoft · Microsoft Purview

  EPSS 28%
• High 7.0
  CVE-2025-0283 A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gatewa…

  ivanti · Connect Secure · Policy Secure · Neurons for ZTA gateways

  EPSS 17%
• High 8.8
  CVE-2024-55656 RedisBloom Integer Overflow Remote Code Execution Vulnerability

  RedisBloom · RedisBloom

  EPSS 17%
• High 7.5
  CVE-2024-48456 An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3…
  EPSS 17%
• Medium 6.5
  CVE-2025-0242 Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6

  Mozilla · Firefox · Thunderbird

  EPSS 15%