Week 4, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-23006 Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management…

  SonicWall · SMA1000

  EPSS 27%
• Critical 9.3
  CVE-2024-51818 WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability

  radykal · Fancy Product Designer

  EPSS 16%
• Critical 9.1
  CVE-2024-54794 The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.
  EPSS 13%
• Critical 9.6
  CVE-2024-52325 ECOVACS robot lawnmowers and vacuums command injection

  ECOVACS · DEEBOT X2 OMNI · DEEBOT X2S · DEEBOT X5 PRO ULTRA

  EPSS 3.1%
• Critical 9.1
  CVE-2025-23942 WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability

  ngocuct0912 · WP Load Gallery

  EPSS 2.8%
• Critical 9.8
  CVE-2024-13545 Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion

  eminozlem · Bootstrap Ultimate

  EPSS 1.3%
• Critical 9.9
  CVE-2025-20156 Cisco Meeting Management Client-Server Privilege Escalation Vulnerability

  Cisco · Cisco Meeting Management

  EPSS 1.2%
• Critical 9.1
  CVE-2024-55573 An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with …
  EPSS 1.2%
• Critical 9.8
  CVE-2024-42936 The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker mess…
  EPSS 1.1%
• Critical 9.8
  CVE-2025-0357 WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload

  Iqonic Design · WPBookit

  EPSS 1.1%
• Critical 9.8
  CVE-2024-24421 A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execu…
• Critical 9.8
  CVE-2024-13091 WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload

  Quantum Cloud · WPBot Pro Wordpress Chatbot

• Critical 9.1
  CVE-2024-55959 Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
• Critical 9.8
  CVE-2025-21535 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1…

  Oracle · Oracle WebLogic Server

• Critical 9.8
  CVE-2025-21524 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affec…

  Oracle · JD Edwards EnterpriseOne Tools

All 61 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.0
  CVE-2025-0411 7-Zip Mark-of-the-Web Bypass Vulnerability

  7-Zip · 7-Zip

  EPSS 48%
• Medium 4.6
  CVE-2024-57041 NodeBB Cross-site scripting (XSS) vulnerability
  EPSS 40%
• High 7.6
  CVE-2025-24587 WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerability

  Nks · Email Subscription Popup

  EPSS 33%
• Medium 4.6
  CVE-2025-24459 In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page

  JetBrains · TeamCity

  EPSS 2.9%
• Medium 5.9
  CVE-2025-23184 Apache CXF: Denial of Service vulnerability with temporary files

  Apache Software Foundation · Apache CXF

  EPSS 2.2%
• High 7.5
  CVE-2024-13496 GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter

  rubengc · GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

  EPSS 2.2%
• High 7.6
  CVE-2025-23369 Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

  GitHub · Enterprise Server

  EPSS 2.1%
• Medium 5.3
  CVE-2025-20128 ClamAV OLE2 File Format Decryption Denial of Service Vulnerability

  Cisco · Cisco Secure Endpoint

  EPSS 1.8%