Week 21, 2025

19–25 May 2025

New CVEs: 895
Critical: 130
High: 348
Newly exploited: 7
Advisories: 332
Malicious pkgs: 419

Newly exploited 7

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2025-4632 KEV May 22, 2025 Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitr…
Samsung Electronics · MagicINFO 9 Server

EPSS 24%
High 7.5
CVE-2023-38950 KEV May 19, 2025 A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payl…
EPSS 92%
High 7.2
CVE-2025-27920 KEV May 19, 2025 Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attack…
Srimax · Output Messenger

EPSS 1.9%
High 7.2
CVE-2025-4428 KEV May 19, 2025 Remote Code Execution
ivanti · Endpoint Manager Mobile

EPSS 88%
Medium 6.1
CVE-2024-27443 KEV May 19, 2025 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimb…
EPSS 25%
Medium 5.3
CVE-2024-11182 KEV May 19, 2025 Stored XSS vulnerability in MDaemon Email Server
MDaemon · Email Server

EPSS 33%
Medium 5.3
CVE-2025-4427 KEV May 19, 2025 Authentication Bypass
ivanti · Endpoint Manager Mobile

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.2
CVE-2025-34026 Versa Concerto Actuator Authentication Bypass Information Leak
Versa · Concerto

EPSS 82%
Critical 10.0
CVE-2025-34027 Versa Concerto Authentication Bypass File Write Remote Code Execution
Versa · Concerto

EPSS 46%
Critical 9.8
CVE-2025-32814 An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.
EPSS 37%
Critical 9.8
CVE-2025-47539 WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability
Arraytics · Eventin

EPSS 25%
Critical 9.8
CVE-2025-47646 WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability
Gilblas Ngunte Possi · PSW Front-end Login & Registration

EPSS 25%
Critical 9.8
CVE-2025-37924 ksmbd: fix use-after-free in kerberos authentication
Linux · Linux

EPSS 25%
Critical 9.8
CVE-2025-44084 D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the com…
EPSS 23%
Critical 9.8
CVE-2025-4978 Netgear DGND3700 Basic Authentication BRS_top.html improper authentication
NETGEAR · DGND3700

EPSS 22%
Critical 9.8
CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing
EPSS 17%
Critical 9.8
CVE-2025-4322 Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
StylemixThemes · Motors - Car Dealer, Rental & Listing WordPress theme

EPSS 15%
Critical 9.8
CVE-2025-4524 Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
WPStylish · Madara – Responsive and modern WordPress theme for manga sites

EPSS 11%
Critical 10.0
CVE-2025-47577 WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
templateinvaders · TI WooCommerce Wishlist

EPSS 4.6%
Critical 9.8
CVE-2025-44881 A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp…
EPSS 1.9%
Critical 9.8
CVE-2025-44882 A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafte…
EPSS 1.9%
Critical 9.8
CVE-2025-44880 A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp…
EPSS 1.9%

All 130 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.6
CVE-2025-4123 Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin
Grafana · Grafana

EPSS 97%
High 8.7
CVE-2025-4008 Arbitrary Command Injection in Smartbedded MeteoBridge
Smartbedded · MeteoBridge

EPSS 93%
High 7.2
CVE-2025-32813 An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.
EPSS 45%
High 8.3
CVE-2025-36527 SQL Injection
ManageEngine · ADAudit Plus

EPSS 42%
Medium 6.5
CVE-2025-32815 An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
EPSS 41%
High 7.5
CVE-2025-40775 DNS message with invalid TSIG causes an assertion failure
ISC · BIND 9

EPSS 15%
High 7.5
CVE-2025-26086 An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler. Attacke…
EPSS 15%
High 7.6
CVE-2025-43860 OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics
Open-Emr · openemr

EPSS 15%

Advisories

USN-7523-1 linux-raspi-realtime vulnerabilities 704 CVEs
DLA-4178-1 linux - security update 242 CVEs
USN-7521-1 linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities 228 CVEs
SUSE-SU-2025:01614-1 Security update for the Linux Kernel 170 CVEs
USN-7522-1 linux-azure-nvidia vulnerabilities 136 CVEs
USN-7515-2 linux-gcp, linux-gcp-6.8, linux-gkeop vulnerabilities 134 CVEs
USN-7513-3 linux-azure, linux-azure-6.8, linux-oem-6.8 vulnerabilities 133 CVEs
USN-7511-3 linux-gke vulnerabilities 126 CVEs
USN-7510-5 linux-azure-fips vulnerabilities 124 CVEs
USN-7510-4 linux-intel-iot-realtime, linux-realtime vulnerabilities 124 CVEs