Week 24, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.9
  CVE-2025-30220 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

  geoserver · geoserver

  EPSS 44%
• Critical 9.4
  CVE-2025-49596 MCP Inspector proxy server lacks authentication between the Inspector client and proxy

  Model Context Protocol · inspector

  EPSS 40%
• Critical 9.8
  CVE-2025-45988 Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL…
  EPSS 9.8%
• Critical 9.3
  CVE-2025-32711 M365 Copilot Information Disclosure Vulnerability

  Microsoft · Microsoft 365 Copilot

  EPSS 7.2%
• Critical 9.8
  CVE-2025-45985 Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL…
  EPSS 6.8%
• Critical 9.6
  CVE-2025-3835 Remote Code Execution

  ManageEngine · Exchange Reporter Plus

  EPSS 2.4%
• Critical 9.8
  CVE-2025-45987 Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL…
  EPSS 1.7%
• Critical 9.8
  CVE-2025-45984 Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_A…
  EPSS 1.7%
• Critical 9.8
  CVE-2025-45986 Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL…
  EPSS 1.7%
• Critical 9.1
  CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

  knadh · listmonk

  EPSS 1.6%
• Critical 9.3
  CVE-2025-48281 WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability

  mystyleplatform · MyStyle Custom Product Designer

  EPSS 1.4%
• Critical 10.0
  CVE-2025-29902 Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.

  RTS · Telex · VLink Virtual Matrix Software · Remote Dispatch Console Server

  EPSS 1.2%
• Critical 9.3
  CVE-2025-47608 WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

  sonalsinha21 · Recover abandoned cart for WooCommerce

  EPSS 1.2%
• Critical 9.6
  CVE-2024-38824 CVE-2024-38824 salt advisory

  VMware · SALT

  EPSS 1.1%
• Critical 9.8
  CVE-2025-46060 Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component
  EPSS 1%

All 71 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2025-33053 Internet Shortcut Files Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 87%
• High 8.8
  CVE-2025-33073 Windows SMB Client Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 83%
• High 7.5
  CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability

  Apache Software Foundation · Apache Kafka Client

  EPSS 70%
• Medium 6.1
  CVE-2025-5301 Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

  ONLYOFFICE · Docs (DocumentServer)

  EPSS 63%
• High 8.1
  CVE-2025-33071 Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 23%
• High 8.8
  CVE-2025-47166 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 23%
• High 8.8
  CVE-2025-47163 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 22%
• High 8.4
  CVE-2025-5964 Path traversal in M-Files API

  M-Files · M-Files Server

  EPSS 14%