Week 5, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-0851 Path traversal issue in Deep Java Library

  AWS · DeepJavaLibrary

  EPSS 26%
• Critical 10.0
  CVE-2025-24085 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS…

  Apple · macOS · iOS and iPadOS · watchOS

  EPSS 17%
• Critical 9.1
  CVE-2025-22604 Cacti has Authenticated RCE via multi-line SNMP responses

  Cacti · cacti

  EPSS 5.3%
• Critical 10.0
  CVE-2024-48841 Remote Code Execution (RCE) Vulnerabilities

  ABB · FLXEON

  EPSS 4.4%
• Critical 9.8
  CVE-2024-53584 OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
  EPSS 4.3%
• Critical 9.8
  CVE-2025-24118 The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to cau…

  Apple · macOS · iPadOS

  EPSS 3.8%
• Critical 10.0
  CVE-2025-23211 Tandoor Recipes - SSTI - Remote Code Execution

  Tandoor Recipes · recipes

  EPSS 3.7%
• Critical 9.4
  CVE-2024-48852 Information disclosures

  ABB · FLXEON

  EPSS 2.4%
• Critical 9.1
  CVE-2024-53537 An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.
  EPSS 2.4%
• Critical 9.8
  CVE-2022-3365 Emote Interactive Remote Mouse Server command injection due to weak encoding

  Emote Interactive · Remote Mouse Server

  EPSS 2.1%
• Critical 9.8
  CVE-2025-24126 An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 1…

  Apple · macOS · iOS and iPadOS · tvOS

  EPSS 1.4%
• Critical 9.8
  CVE-2024-12248 Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor

  Contec Health · CMS8000 Patient Monitor

  EPSS 1.3%
• Critical 9.8
  CVE-2025-20061 mySCADA myPRO Manager OS Command Injection

  mySCADA · myPRO Manager · myPRO Runtime

  EPSS 1.3%
• Critical 9.8
  CVE-2025-20014 mySCADA myPRO Manager OS Command Injection

  mySCADA · myPRO Manager · myPRO Runtime

  EPSS 1.3%
• Critical 9.8
  CVE-2024-12649 Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to …

  Canon · i-SENSYS LBP631Cdw · Color imageCLASS MF652Cdw · Color imageCLASS LBP632Cdw

  EPSS 1.2%

All 67 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.7
  CVE-2025-24367 Cacti allows Arbitrary File Creation leading to RCE

  Cacti · cacti

  EPSS 59%
• Medium 5.4
  CVE-2024-52012 Apache Solr: Configset upload on Windows allows arbitrary path write-access

  Apache Software Foundation · Apache Solr

  EPSS 47%
• High 7.6
  CVE-2024-54146 Cacti has a SQL Injection vulnerability when view host template

  Cacti · cacti

  EPSS 46%
• High 8.8
  CVE-2024-52875 An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.c…

  GFI Software · Kerio Control

  EPSS 29%
• Low 3.5
  CVE-2024-55416 DevDojo Voyager vulnerable to reflected Cross-site Scripting
  EPSS 20%
• High 7.5
  CVE-2024-12705 DNS-over-HTTPS implementation suffers from multiple issues under heavy query load

  ISC · BIND 9

  EPSS 19%
• Medium 5.7
  CVE-2024-55415 DevDojo Voyager vulnerable to path traversal
  EPSS 18%
• High 7.5
  CVE-2024-11187 Many records in the additional section cause CPU exhaustion

  ISC · BIND 9

  EPSS 16%