Week 15, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-3248 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

  langflow-ai · langflow

  EPSS 100%
• Critical 9.0
  CVE-2024-58136 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

  yiiframework · Yii

  EPSS 88%
• Critical 9.8
  CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server

  bentoml · BentoML

  EPSS 52%
• Critical 9.1
  CVE-2025-30281 ColdFusion | Improper Access Control (CWE-284)

  Adobe · ColdFusion

  EPSS 24%
• Critical 9.3
  CVE-2024-48887 A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially cr…

  Fortinet · FortiSwitch

  EPSS 16%
• Critical 9.1
  CVE-2025-24447 ColdFusion | Deserialization of Untrusted Data (CWE-502)

  Adobe · ColdFusion

  EPSS 2.2%
• Critical 10.0
  CVE-2025-32028 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

  haxtheweb · issues

  EPSS 2%
• Critical 9.1
  CVE-2025-30282 ColdFusion | Improper Authentication (CWE-287)

  Adobe · ColdFusion

  EPSS 1.8%
• Critical 9.1
  CVE-2025-24446 ColdFusion | Improper Input Validation (CWE-20)

  Adobe · ColdFusion

  EPSS 1.8%
• Critical 9.8
  CVE-2025-3363 HGiga iSherlock - OS Command Injection

  HGiga · iSherlock 5.5 · iSherlock 4.5

  EPSS 1.4%
• Critical 9.8
  CVE-2025-3362 HGiga iSherlock - OS Command Injection

  HGiga · iSherlock 4.5 · iSherlock 5.5

  EPSS 1.4%
• Critical 9.8
  CVE-2025-3361 HGiga iSherlock - OS Command Injection

  HGiga · iSherlock 4.5 · iSherlock 5.5

  EPSS 1.4%
• Critical 9.8
  CVE-2025-3439 Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection

  WPEverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

  EPSS 1.2%
• Critical 9.8
  CVE-2025-27797 OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed …

  Inaba Denki Sangyo · AC-WPS-11ac-P · AC-WPSM-11ac-P · AC-PD-WPS-11ac-P

  EPSS 1%
• Critical 9.9
  CVE-2025-32461 wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, …

  Tiki · Tiki

All 66 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.1
  CVE-2025-3102 SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

  Brainstorm Force · OttoKit: All-in-One Automation Platform

  EPSS 76%
• High 8.4
  CVE-2025-30285 ColdFusion | Deserialization of Untrusted Data (CWE-502)

  Adobe · ColdFusion

  EPSS 31%
• High 7.2
  CVE-2025-29793 Microsoft SharePoint Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 24%
• High 8.7
  CVE-2025-30290 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

  Adobe · ColdFusion

  EPSS 20%
• High 7.8
  CVE-2025-29824 Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 19%
• Medium 6.8
  CVE-2025-30294 ColdFusion | Improper Input Validation (CWE-20)

  Adobe · ColdFusion

  EPSS 17%
• Medium 6.8
  CVE-2025-25254 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and…

  Fortinet · FortiWeb

  EPSS 17%
• Medium 6.1
  CVE-2025-30292 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

  Adobe · ColdFusion

  EPSS 16%