Week 11, 2025

10–16 March 2025

New CVEs: 779
Critical: 55
High: 337
Newly exploited: 13
Advisories: 392
Malicious pkgs: 223

Newly exploited 13

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2025-24201 KEV Mar 13, 2025 An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15…
Apple · macOS · iOS and iPadOS · watchOS

EPSS 3.8%
Medium 4.4
CVE-2025-21590 KEV Mar 13, 2025 Junos OS: An local attacker with shell access can execute arbitrary code
Juniper Networks · Junos OS

EPSS 1.7%
High 7.8
CVE-2025-24985 KEV Mar 11, 2025 Windows Fast FAT File System Driver Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 3.9%
High 7.8
CVE-2025-24993 KEV Mar 11, 2025 Windows NTFS Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 2.2%
High 7.0
CVE-2025-26633 KEV Mar 11, 2025 · ransomware Microsoft Management Console Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 30%
High 7.0
CVE-2025-24983 KEV Mar 11, 2025 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Microsoft · Windows Server 2016 · Windows Server 2016 (Server Core installation) · Windows 10 Version 1607

EPSS 1.9%
Medium 5.5
CVE-2025-24991 KEV Mar 11, 2025 Windows NTFS Information Disclosure Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 2%
Medium 4.6
CVE-2025-24984 KEV Mar 11, 2025 Windows NTFS Information Disclosure Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 2%
Critical 9.9
CVE-2024-57968 KEV Mar 10, 2025 Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsin…
Advantive · VeraCore

EPSS 32%
Critical 9.8
CVE-2024-13159 KEV Mar 10, 2025 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at…
ivanti · Endpoint Manager

EPSS 100%
Critical 9.8
CVE-2024-13160 KEV Mar 10, 2025 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at…
ivanti · Endpoint Manager

EPSS 91%
Critical 9.8
CVE-2024-13161 KEV Mar 10, 2025 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at…
ivanti · Endpoint Manager

EPSS 90%
Medium 5.8
CVE-2025-25181 KEV Mar 10, 2025 A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the Pm…
Advantive · VeraCore

EPSS 55%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Software Foundation · Apache Tomcat

EPSS 100%
Critical 9.3
CVE-2025-25292 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
SAML-Toolkits · ruby-saml

EPSS 65%
Critical 10.0
CVE-2024-54085 Redfish Authentication Bypass
AMI · MegaRAC-SPx

EPSS 61%
Critical 9.8
CVE-2025-1661 HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
RealMag777 · HUSKY – Products Filter Professional for WooCommerce

EPSS 56%
Critical 10.0
CVE-2025-22954 GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
Koha · Koha

EPSS 26%
Critical 9.3
CVE-2025-25291 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
SAML-Toolkits · ruby-saml

EPSS 21%
Critical 9.3
CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
node-saml · xml-crypto

EPSS 10%
Critical 9.3
CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
node-saml · xml-crypto

EPSS 9.1%
Critical 10.0
CVE-2025-24201 An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15…
Apple · macOS · iOS and iPadOS · watchOS

EPSS 3.8%
Critical 9.1
CVE-2025-27407 Remote code execution when loading a crafted GraphQL schema
rmosolgo · graphql-ruby

EPSS 3.1%
Critical 9.8
CVE-2025-29384 In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary co…
EPSS 1.9%
Critical 9.1
CVE-2025-28915 WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability
Theme Egg · ThemeEgg ToolKit

EPSS 1.3%
Critical 9.8
CVE-2025-2263 Santesoft Sante PACS Server Stack-based Buffer Overflow
Santesoft · Sante PACS Server

EPSS 1.2%
Critical 9.3
CVE-2025-1497 Remote Code Execution in PlotAI
mljar · PlotAI

EPSS 1%
Critical 9.8
CVE-2025-29386 In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code …

All 55 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 4.8
CVE-2025-29891 Apache Camel: Camel Message Header Injection through request parameters
Apache Software Foundation · Apache Camel

EPSS 76%
High 8.6
CVE-2025-30066 tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
tj-actions · changed-files

EPSS 72%
Medium 6.5
CVE-2025-24054 NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 62%
High 7.5
CVE-2025-2264 Santesoft Sante PACS Server Path Traversal Information Disclosure
Santesoft · Sante PACS Server

EPSS 35%
High 7.0
CVE-2025-26633 Microsoft Management Console Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 30%
High 8.1
CVE-2025-27363 An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph stru…
FreeType · FreeType

EPSS 28%
Medium 6.5
CVE-2025-24071 Microsoft Windows File Explorer Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 23%
Medium 4.8
CVE-2023-33300 A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker…
Fortinet · FortiNAC

EPSS 14%

Advisories

SUSE-SU-2025:0577-1 Security update for the Linux Kernel 94 CVEs
SUSE-SU-2025:0577-2 Security update for the Linux Kernel 94 CVEs
SUSE-SU-2025:0847-1 Security update for the Linux Kernel 83 CVEs
SUSE-SU-2025:0201-1 Security update for the Linux Kernel 77 CVEs
SUSE-SU-2025:0201-2 Security update for the Linux Kernel 77 CVEs
SUSE-SU-2025:0856-1 Security update for the Linux Kernel 72 CVEs
SUSE-SU-2025:0834-1 Security update for the Linux Kernel 71 CVEs
USN-7344-2 linux-azure, linux-azure-4.15 vulnerabilities 39 CVEs
USN-7344-1 linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle vulnerabilities 39 CVEs
USN-7342-1 linux, linux-hwe vulnerabilities 38 CVEs