Week 22, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-48827 vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or late…

  vBulletin · vBulletin

  EPSS 76%
• Critical 9.3
  CVE-2025-4009 Unauthenticated Arbitrary Command Injection in Evertz SDVN

  Evertz · CC Access Server · MViP-II · 7890IXG

  EPSS 74%
• Critical 9.0
  CVE-2025-48828 Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template co…

  vBulletin · vBulletin

  EPSS 57%
• Critical 9.4
  CVE-2025-48047 MICI Network Co. Ltd. NetFax Server Command Injection

  MICI Network · NetFax Server

  EPSS 17%
• Critical 9.8
  CVE-2025-35003 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.

  Apache Software Foundation · Apache NuttX RTOS

  EPSS 1.6%
• Critical 9.6
  CVE-2025-5277 aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands o…

  alexei-led · aws-mcp-server

  EPSS 1.3%
• Critical 9.8
  CVE-2025-3357 IBM Tivoli Monitoring code execution

  IBM · Tivoli Monitoring

  EPSS 1.1%
• Critical 9.0
  CVE-2025-22252 A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.…

  Fortinet · FortiOS · FortiProxy · FortiSwitchManager

• Critical 9.8
  CVE-2025-5408 WAVLINK WL-WN576K1 HTTP POST Request login.cgi sys_login buffer overflow

  WAVLINK · QUANTUM D3G · WL-WN530HG3 · WL-WN576K1

• Critical 9.1
  CVE-2025-3755 Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU module

  Mitsubishi Electric · MELSEC iQ-F Series FX5U-32MR/DS · MELSEC iQ-F Series FX5UC-64MT/DSS · MELSEC iQ-F Series FX5U-80MT/ESS

• Critical 9.1
  CVE-2025-27528 Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read

  Apache Software Foundation · Apache InLong

• Critical 9.8
  CVE-2025-1907 Instantel Micromate Missing Authentication for Critical Function

  Instantel · Micromate

• Critical 9.3
  CVE-2025-48757 An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database…

  Lovable · Lovable

• Critical 9.8
  CVE-2025-4631 Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint

  unitybusinesstechnology · The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis

• Critical 9.8
  CVE-2025-41438 Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default

  Consilium Safety · CS5000 Fire Panel

All 39 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.3
  CVE-2025-48927 The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in M…

  TeleMessage · service

  EPSS 12%
• High 8.8
  CVE-2025-5063 Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…

  Google · Chrome

  EPSS 3.7%
• High 7.3
  CVE-2025-46701 Apache Tomcat: Security constraint bypass for CGI scripts

  Apache Software Foundation · Apache Tomcat

  EPSS 3.1%
• High 8.8
  CVE-2025-5228 D-Link DI-8100 jhttpd login.cgi httpd_get_parm stack-based overflow

  D-Link · DI-8100

  EPSS 3.1%
• High 8.8
  CVE-2025-5280 Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch…

  Google · Chrome

  EPSS 2.9%
• High 7.5
  CVE-2025-5287 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

  erumfaham · Likes and Dislikes Plugin

  EPSS 2.4%
• High 8.8
  CVE-2025-48734 Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Apache Software Foundation · Apache Commons BeanUtils 1.x · Apache Commons BeanUtils 2.x

  EPSS 2%
• High 8.8
  CVE-2025-5215 D-Link DCS-5020L ptdc.cgi websReadEvent stack-based overflow

  D-Link · DCS-5020L

  EPSS 1.5%