Week 3, 2025
13–19 January 2025
Newly exploited 7
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 10.0
CVE-2024-50603 KEV Jan 16, 2025 An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS …EPSS 99%
-
Critical 9.6
CVE-2024-55591 KEV Jan 14, 2025 · ransomware An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0…EPSS 94%
-
High 7.8
CVE-2025-21334 KEV Jan 14, 2025 Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityEPSS 1.6%
Microsoft · Windows 10 Version 21H2 · Windows 10 Version 22H2 · Windows Server 2025
-
High 7.8
CVE-2025-21333 KEV Jan 14, 2025 Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityEPSS 10%
Microsoft · Windows 10 Version 21H2 · Windows 10 Version 22H2 · Windows Server 2025
-
High 7.8
CVE-2025-21335 KEV Jan 14, 2025 Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityEPSS 1.4%
Microsoft · Windows 10 Version 21H2 · Windows 10 Version 22H2 · Windows Server 2025
-
Critical 9.6
CVE-2023-48365 KEV Jan 13, 2025 · ransomware Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP hea…EPSS 48%
-
Medium 6.6
CVE-2024-12686 KEV Jan 13, 2025 Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)EPSS 33%
BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2024-13159 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at…EPSS 100%
-
Critical 9.1
CVE-2024-57727 SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to d…EPSS 97%
-
Critical 9.6
CVE-2024-55591 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0…EPSS 94%
-
Critical 9.8
CVE-2024-13160 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at…EPSS 91%
-
Critical 9.8
CVE-2024-13161 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at…EPSS 90%
-
Critical 9.8
CVE-2025-21298 Windows OLE Remote Code Execution VulnerabilityEPSS 74%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 73%
Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7
-
Critical 9.9
CVE-2024-57726 SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. …EPSS 66%
-
Critical 9.6
CVE-2024-39363 A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft…EPSS 49%
-
Critical 9.8
CVE-2024-48760 An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi fi…EPSS 46%
-
Critical 9.1
CVE-2024-39280 An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reque…EPSS 35%
-
Critical 9.1
CVE-2024-37186 An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request…EPSS 23%
-
Critical 9.1
CVE-2024-21797 A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…EPSS 21%
-
Critical 9.1
CVE-2024-36295 A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead…EPSS 21%
-
Critical 9.1
CVE-2024-38666 An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft…EPSS 19%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2024-13162 SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with …EPSS 65%
-
High 7.2
CVE-2024-57728 SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (…EPSS 64%
-
High 7.3
CVE-2024-13179 Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.EPSS 64%
-
High 7.5
CVE-2025-21285 Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 56%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
- Medium 4.6 EPSS 49%
-
High 7.5
CVE-2025-21277 Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 39%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
High 7.3
CVE-2024-13181 Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes …EPSS 33%
-
High 7.5
CVE-2024-13180 Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete f…EPSS 27%
Advisories
- Microsoft Security Response Center 16010 critical
- SUSE / openSUSE Security Updates 9735 critical
- BSI CERT-Bund (WID) 683 critical
- Red Hat Security Advisories (RHSA) 4213 critical
- Ubuntu Security Notices (USN) 223 critical
- CISA ICS & IT advisories 15
- Debian Security (DSA / DLA) 143 critical
- NCSC-NL (Netherlands) 13
- Oracle Linux Security Advisories (ELSA) 13
- AlmaLinux Security Advisories 11
- Schneider Electric CPCERT 91 critical
- Siemens ProductCERT 5
- Amazon Linux Security Center (ALAS) 3
- Rocky Linux Security Advisories 3
- CERT@VDE 2
- ABB PSIRT 1
- WID-SEC-2025-0091 Microsoft Windows: Mehrere Schwachstellen 133 CVEs
- SUSE-SU-2025:0154-1 Security update for the Linux Kernel 117 CVEs
- SUSE-SU-2025:0117-1 Security update for the Linux Kernel 116 CVEs
- SUSE-SU-2025:0153-1 Security update for the Linux Kernel 114 CVEs
- SUSE-SU-2025:0158-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5) 36 CVEs
- SUSE-SU-2025:0107-1 Security update for the Linux Kernel (Live Patch 23 for SLE 15 SP4) 33 CVEs
- SUSE-SU-2025:0115-1 Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5) 32 CVEs
- SUSE-SU-2025:0109-1 Security update for the Linux Kernel (Live Patch 24 for SLE 15 SP4) 31 CVEs
- SUSE-SU-2025:0150-1 Security update for the Linux Kernel (Live Patch 25 for SLE 15 SP4) 29 CVEs
- openSUSE-SU-2025:14663-1 velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media 27 CVEs