Week 23, 2025

2–8 June 2025

New CVEs: 860
Critical: 48
High: 295
Newly exploited: 9
Advisories: 275
Malicious pkgs: 162

Newly exploited 9

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2025-5419 KEV Jun 5, 2025 Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …
Google · Chrome

EPSS 7.6%
High 8.6
CVE-2025-21479 KEV Jun 3, 2025 Incorrect Authorization in Graphics
Qualcomm · Snapdragon
High 8.6
CVE-2025-21480 KEV Jun 3, 2025 Incorrect Authorization in Graphics Windows
Qualcomm · Snapdragon
High 7.5
CVE-2025-27038 KEV Jun 3, 2025 Use After Free in Graphics
Qualcomm · Snapdragon

EPSS 1%
Critical 9.8
CVE-2021-32030 KEV Jun 2, 2025 The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when proce…
EPSS 99%
Critical 9.3
CVE-2024-56145 KEV Jun 2, 2025 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
craftcms · cms

EPSS 97%
High 8.8
CVE-2023-39780 KEV Jun 2, 2025 On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: f…
ASUS · RT-AX55

EPSS 40%
High 8.1
CVE-2025-3935 KEV Jun 2, 2025 ScreenConnect Exposure to ASP.NET ViewState Code Injection
ConnectWise · ScreenConnect

EPSS 3.6%
Medium 5.3
CVE-2025-35939 KEV Jun 2, 2025 Craft CMS stores user-provided content in session files
Craft · CMS

EPSS 1.4%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.9
CVE-2025-49113 Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
Roundcube · Webmail

EPSS 100%
Critical 9.0
CVE-2025-5086 Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso

EPSS 97%
Critical 9.8
CVE-2025-44148 Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component
EPSS 55%
Critical 9.8
CVE-2025-41646 RevPi Webstatus application is vulnerable to an authentication bypass
KUNBUS · Revolution Pi webstatus

EPSS 51%
Critical 9.8
CVE-2025-5623 D-Link DIR-816 qosClassifier stack-based overflow
D-Link · DIR-816

EPSS 19%
Critical 10.0
CVE-2025-45854 /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.
JEHc · JEHC-BPM

EPSS 3.2%
Critical 9.8
CVE-2025-5630 D-Link DIR-816 form2lansetup.cgi stack-based overflow
D-Link · DIR-816

EPSS 2.7%
Critical 9.8
CVE-2025-5624 D-Link DIR-816 QoSPortSetup stack-based overflow
D-Link · DIR-816

EPSS 2.6%
Critical 9.8
CVE-2025-5622 D-Link DIR-816 wirelessApcli_5g stack-based overflow
D-Link · DIR-816

EPSS 2.6%
Critical 9.4
CVE-2025-4517 Arbitrary writes via tarfile realpath overflow
Python Software Foundation · CPython

EPSS 1.5%
Critical 9.8
CVE-2025-5600 TOTOLINK EX1200T cstecgi.cgi setLanguageCfg stack-based overflow
Toto Link · EX1200T

EPSS 1.3%
Critical 9.8
CVE-2025-32105 A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution.
EPSS 1.3%
Critical 9.8
CVE-2025-47966 Power Automate Elevation of Privilege Vulnerability
Microsoft · Power Automate for Desktop

EPSS 1.2%
Critical 9.9
CVE-2025-20286 ISE on AWS Static Credential
Cisco · Cisco Identity Services Engine Software

EPSS 1.2%
Critical 9.8
CVE-2025-37093 An authentication bypass vulnerability exists in HPE StoreOnce Software.
Hewlett Packard Enterprise (HPE) · HPE StoreOnce Software

EPSS 1.2%

All 48 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.2
CVE-2025-49002 Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
dataease · dataease

EPSS 51%
Medium 4.3
CVE-2025-20297 Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component
Splunk · Splunk Enterprise · Splunk Cloud Platform

EPSS 34%
Medium 6.3
CVE-2025-5447 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injection
Linksys · RE7000 · RE6250 · RE6500

EPSS 33%
Medium 6.3
CVE-2025-5438 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 WPS command injection
Linksys · RE7000 · RE6250 · RE6350

EPSS 26%
High 7.8
CVE-2025-5473 GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability
GIMP · GIMP

EPSS 25%
High 7.7
CVE-2025-49001 Dataease Authentication Bypass Vulnerability
dataease · dataease

EPSS 23%
High 8.5
CVE-2025-49619 Skyvern has a Jinja runtime leak
Skyvern · Skyvern

EPSS 22%
Medium 6.8
CVE-2024-7074 Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
WSO2 · WSO2 API Manager · WSO2 Open Banking AM · WSO2 Enterprise Integrator

EPSS 18%

Advisories

SUSE-SU-2025:20374-1 Security update for python311 16 CVEs
RHSA-2025:8607 Red Hat Security Advisory: thunderbird security update 9 CVEs
RHSA-2025:8608 Red Hat Security Advisory: thunderbird security update 9 CVEs
RHSA-2025:8598 Red Hat Security Advisory: thunderbird security update 9 CVEs
RHSA-2025:8599 Red Hat Security Advisory: thunderbird security update 9 CVEs
SUSE-SU-2025:01802-1 Security update for libsoup2 8 CVEs
SUSE-SU-2025:01801-1 Security update for libsoup 8 CVEs
SUSE-SU-2025:01794-1 Security update for libsoup 8 CVEs
ICSA-25-155-01 CyberData 011209 SIP Emergency Intercom 5 CVEs
SUSE-SU-2025:01813-1 Security update for MozillaThunderbird 2 CVEs