Week 18, 2025

28 April – 4 May 2025

New CVEs: 880
Critical: 49
High: 265
Newly exploited: 8
Advisories: 192
Malicious pkgs: 128

Newly exploited 8

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.3
CVE-2025-34028 KEV May 2, 2025 Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
Commvault · Command Center Innovation Release

EPSS 98%
Critical 9.0
CVE-2024-58136 KEV May 2, 2025 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
yiiframework · Yii

EPSS 88%
Critical 9.1
CVE-2024-38475 KEV May 1, 2025 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Apache Software Foundation · Apache HTTP Server

EPSS 100%
High 7.2
CVE-2023-44221 KEV May 1, 2025 Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to …
SonicWall · SMA100

EPSS 76%
Critical 10.0
CVE-2025-31324 KEV Apr 29, 2025 · ransomware Missing Authorization check in SAP NetWeaver (Visual Composer development server)
SAP · SAP NetWeaver (Visual Composer development server)

EPSS 99%
Critical 9.8
CVE-2025-42599 KEV Apr 28, 2025 Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sen…
QUALITIA · Active! mail 6

EPSS 3.4%
High 8.8
CVE-2025-3928 KEV Apr 28, 2025 Commvault Web Server unspecified vulnerability
Commvault · Web Server

EPSS 2.5%
High 8.6
CVE-2025-1976 KEV Apr 28, 2025 Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6
Brocade · Fabric OS

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2025-27007 WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
Brainstorm Force · OttoKit

EPSS 54%
Critical 9.8
CVE-2025-32011 KUNBUS Revolution Pi Authentication Bypass by Primary Weakness
KUNBUS · Revolution Pi PiCtory

EPSS 29%
Critical 9.0
CVE-2025-35996 KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
KUNBUS · Revolution Pi PiCtory

EPSS 19%
Critical 9.9
CVE-2025-2605 Authenticated command injection
Honeywell · MB-Secure

EPSS 16%
Critical 9.8
CVE-2025-31651 Apache Tomcat: Bypass of rules in Rewrite Valve
Apache Software Foundation · Apache Tomcat

EPSS 4.3%
Critical 9.8
CVE-2025-44868 Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vuln…
EPSS 2.7%
Critical 9.4
CVE-2025-0520 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution
ShowDoc · ShowDoc

EPSS 2.4%
Critical 9.8
CVE-2025-44877 Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerabil…
EPSS 1.9%
Critical 9.8
CVE-2025-44872 Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnera…
EPSS 1.9%
Critical 10.0
CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration
vLLM · vLLM

EPSS 1.8%
Critical 9.9
CVE-2015-2079 Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form o…
Usermin · Usermin

EPSS 1.6%
Critical 9.8
CVE-2025-37778 ksmbd: Fix dangling pointer in krb_authenticate
Linux · Linux

EPSS 1.2%
Critical 9.8
CVE-2025-30392 Azure AI Bot Elevation of Privilege Vulnerability
Microsoft · Azure AI Bot Service

EPSS 1.1%
Critical 9.9
CVE-2025-30390 Azure ML Compute Elevation of Privilege Vulnerability
Microsoft · Azure Machine Learning
Critical 9.8
CVE-2025-45800 TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, s…

All 49 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2025-31650 Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Apache Software Foundation · Apache Tomcat

EPSS 61%
Medium 6.1
CVE-2025-36558 KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
KUNBUS · Revolution Pi PiCtory

EPSS 21%
Medium 6.3
CVE-2025-4076 LB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injection
LB-LINK · BL-AC3600

EPSS 20%
Medium 6.3
CVE-2025-4185 Wangshen SecGate 3600 g=obj_area_export_save path traversal
Wangshen · SecGate 3600

EPSS 13%
Medium 6.5
CVE-2025-46631 Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the…
EPSS 7.5%
Low 2.4
CVE-2025-3994 TOTOLINK N150RT IP Port Filtering home.htm cross site scripting
Toto Link · N150RT

EPSS 5%
Medium 6.5
CVE-2025-27532 A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access sec…
Bosch Rexroth · ctrlX OS - Device Admin

EPSS 3.6%
Medium 5.0
CVE-2025-4032 inclusionAI AWorld shell_tool.py subprocess.Popen os command injection
inclusionAI · AWorld

EPSS 3.3%

Advisories

USN-7468-1 linux-azure-nvidia vulnerabilities 739 CVEs
USN-7459-2 linux-gcp-5.15 vulnerabilities 267 CVEs
SCA-2025-0006 Vulnerability affecting picoScan and multiScan 23 CVEs
USN-7475-1 linux-xilinx-zynqmp vulnerabilities 16 CVEs
openSUSE-SU-2025:15045-1 MozillaFirefox-138.0-1.1 on GA media 11 CVEs
RHSA-2025:4342 Red Hat Security Advisory: kernel security update 11 CVEs
SUSE-SU-2025:20207-1 Security update for expat 10 CVEs
SUSE-SU-2025:1436-1 Security update for MozillaFirefox 7 CVEs
USN-7474-1 docker.io vulnerabilities 7 CVEs
DSA-5912-1 thunderbird - security update 7 CVEs