Week 12, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2025-29927 Authorization Bypass in Next.js Middleware

  vercel · next.js

  EPSS 99%
• Critical 9.9
  CVE-2025-23120 A vulnerability allowing remote code execution (RCE) for domain users.

  Veeam · Backup and Recovery

  EPSS 24%
• Critical 9.8
  CVE-2025-2620 D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow

  D-Link · DAP-1620

  EPSS 8.9%
• Critical 9.8
  CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai

  invoke-ai · invoke-ai/invokeai

  EPSS 6%
• Critical 9.8
  CVE-2025-2505 Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'

  philsbury · Age Gate

  EPSS 4.9%
• Critical 9.3
  CVE-2025-29814 Microsoft Partner Center Elevation of Privilege Vulnerability

  Microsoft · Microsoft Partner Center

  EPSS 2.3%
• Critical 9.8
  CVE-2025-2621 D-Link DAP-1620 storage check_dws_cookie stack-based overflow

  D-Link · DAP-1620

  EPSS 2.1%
• Critical 9.8
  CVE-2025-2619 D-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflow

  D-Link · DAP-1620

  EPSS 2.1%
• Critical 9.8
  CVE-2025-2618 D-Link DAP-1620 Path api set_ws_action heap-based overflow

  D-Link · DAP-1620

  EPSS 2.1%
• Critical 9.8
  CVE-2024-8502 Remote Code Execution via Deserialization in modelscope/agentscope

  modelscope · modelscope/agentscope

  EPSS 1.8%
• Critical 9.8
  CVE-2024-11041 Remote Code Execution in vllm-project/vllm

  vLLM · vllm-project/vllm

  EPSS 1.7%
• Critical 9.8
  CVE-2024-12433 Remote Code Execution in infiniflow/ragflow

  InfiniFlow · infiniflow/ragflow

  EPSS 1.7%
• Critical 9.8
  CVE-2024-10553 Jdbc Deserialization in h2oai/h2o-3

  h2oai · h2oai/h2o-3

  EPSS 1.6%
• Critical 9.1
  CVE-2024-5752 Path Traversal in stitionai/devika

  stitionai · stitionai/devika

  EPSS 1.6%
• Critical 9.1
  CVE-2024-11042 Arbitrary File Delete in invoke-ai/invokeai

  invoke-ai · invoke-ai/invokeai

  EPSS 1.6%

All 87 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2025-24799 GLPI allows unauthenticated SQL injection through the inventory endpoint

  GLPI · glpi

  EPSS 87%
• High 8.1
  CVE-2024-4990 Unsafe Reflection in base Component class in yiisoft/yii2

  yiisoft · yiisoft/yii2

  EPSS 80%
• High 8.6
  CVE-2024-12971 QuickShell Authenticated Command Injection

  Pandora FMS · Pandora FMS

  EPSS 61%
• High 7.5
  CVE-2024-6842 Exposure of Sensitive Information in mintplex-labs/anything-llm

  Mintplex-Labs · mintplex-labs/anything-llm

  EPSS 36%
• Medium 5.3
  CVE-2024-50629 Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager…

  Synology · DiskStation Manager (DSM) · BeeStation OS (BSM)

  EPSS 35%
• High 7.8
  CVE-2025-2449 NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability

  NI · FlexLogger

  EPSS 34%
• High 7.2
  CVE-2025-30349 Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail mes…

  horde · imp

  EPSS 31%
• High 7.5
  CVE-2024-50631 Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before…

  Synology · Synology Drive Server

  EPSS 27%