Week 16, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-32433 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

  Erlang Project · OTP

  EPSS 99%
• Critical 9.8
  CVE-2025-28137 The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the Not…
  EPSS 34%
• Critical 9.8
  CVE-2025-31200 A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, …

  Apple · macOS · iOS and iPadOS · watchOS

  EPSS 21%
• Critical 9.9
  CVE-2025-32583 WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability

  termel · PDF 2 Post

  EPSS 20%
• Critical 9.3
  CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API

  lissy93 · web-check

  EPSS 20%
• Critical 9.8
  CVE-2025-31201 This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.…

  Apple · macOS · iOS and iPadOS · tvOS

  EPSS 14%
• Critical 9.8
  CVE-2025-42599 Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sen…

  QUALITIA · Active! mail 6

  EPSS 3.4%
• Critical 9.3
  CVE-2025-32434 PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

  pytorch · pytorch

  EPSS 2.4%
• Critical 9.8
  CVE-2025-29042 An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c
  EPSS 2.3%
• Critical 9.8
  CVE-2025-29953 Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass

  Apache Software Foundation · Apache ActiveMQ NMS OpenWire Client

  EPSS 2.1%
• Critical 9.8
  CVE-2025-28242 Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack.
  EPSS 1.9%
• Critical 9.8
  CVE-2025-29043 An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234
  EPSS 1.8%
• Critical 9.8
  CVE-2025-29040 An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c
  EPSS 1.4%
• Critical 9.8
  CVE-2025-29041 An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c
  EPSS 1.4%
• Critical 9.8
  CVE-2025-29209 TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.
  EPSS 1.2%

All 111 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2025-22037 ksmbd: fix null pointer dereference in alloc_preauth_hash()

  Linux · Linux

  EPSS 69%
• High 8.1
  CVE-2025-2563 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation
  EPSS 49%
• Medium 6.1
  CVE-2025-29513 Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
  EPSS 43%
• Medium 5.0
  CVE-2025-32103 CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at …

  CrushFTP · CrushFTP

  EPSS 18%
• Medium 6.8
  CVE-2025-27892 Shopware Vulnerable to Blind SQL-injection in DAL aggregations
  EPSS 13%
• High 8.8
  CVE-2025-3785 D-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflow

  D-Link · DWR-M961

  EPSS 13%
• High 8.8
  CVE-2025-3820 Tenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflow

  Tenda · W12 · i24

  EPSS 13%
• Medium 5.3
  CVE-2025-3663 TOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control

  Toto Link · A3700R

  EPSS 11%