Week 9, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-1128 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

  WPEverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

  EPSS 42%
• Critical 9.8
  CVE-2024-53944 An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M7628xUSAxUIv2_v1.0.148…
  EPSS 40%
• Critical 10.0
  CVE-2025-27364 In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation funct…

  MITRE · Caldera

  EPSS 26%
• Critical 9.9
  CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive

  Mattermost · Mattermost

  EPSS 24%
• Critical 9.8
  CVE-2024-8425 WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload

  WP Swings · WooCommerce Ultimate Gift Card

  EPSS 4.1%
• Critical 9.8
  CVE-2024-9193 WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update

  creativeon · WHMpress - WHMCS WordPress Integration Plugin

  EPSS 3.3%
• Critical 9.8
  CVE-2025-22952 Memos Server-Side Request Forgery (SSRF)
  EPSS 2.9%
• Critical 10.0
  CVE-2025-27140 WeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)

  LabRedesCefetRJ · WeGIA

  EPSS 2.9%
• Critical 9.8
  CVE-2024-12824 Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

  scriptsbundle · Nokri – Job Board WordPress Theme

  EPSS 2.4%
• Critical 9.8
  CVE-2025-25570 Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
  EPSS 2.1%
• Critical 9.1
  CVE-2024-47051 Remote Code Execution & File Deletion in Asset Uploads

  Mautic · mautic/core

  EPSS 1.8%
• Critical 9.8
  CVE-2025-25789 FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
  EPSS 1.3%
• Critical 9.8
  CVE-2024-54820 XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attacke…
  EPSS 1.3%
• Critical 9.8
  CVE-2024-57040 TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account…
  EPSS 1.2%
• Critical 9.8
  CVE-2024-51138 Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832…
  EPSS 1.1%

All 85 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.9
  CVE-2025-26466 Openssh: denial-of-service in openssh

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 39%
• High 8.1
  CVE-2025-21760 ndisc: extend RCU protection in ndisc_send_skb()

  Linux · Linux

  EPSS 38%
• High 8.8
  CVE-2025-26264 GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings fea…
  EPSS 24%
• High 7.8
  CVE-2025-21758 ipv6: mcast: add RCU protection to mld_newpack()

  Linux · Linux

  EPSS 17%
• Medium 6.3
  CVE-2025-1610 LB-LINK AC1900 Router set_blacklist websGetVar os command injection

  LB-LINK · AC1900 Router

  EPSS 13%
• Medium 6.3
  CVE-2025-1829 TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection

  Toto Link · X18

  EPSS 12%
• Medium 6.3
  CVE-2025-1609 LB-LINK AC1900 Router set_cmd websGetVar os command injection

  LB-LINK · AC1900 Router

  EPSS 10%
• Medium 6.3
  CVE-2025-1608 LB-LINK AC1900 Router set_manpwd websGetVar os command injection

  LB-LINK · AC1900 Router

  EPSS 10%