Week 26, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-20281 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

  Cisco · Cisco Identity Services Engine Software

  EPSS 98%
• Critical 10.0
  CVE-2025-34037 Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

  Linksys · E3200 · E2000 · E1500 v1

  EPSS 96%
• Critical 10.0
  CVE-2025-20282 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

  Cisco · Cisco Identity Services Engine Software

  EPSS 39%
• Critical 10.0
  CVE-2025-34036 Shenzhen TVT CCTV-DVR Command Injection

  Shenzhen TVT · CCTV-DVR

  EPSS 31%
• Critical 10.0
  CVE-2025-34035 EnGenius EnShare IoT Gigabit Cloud Service Command Injection

  EnGenius · EnShare IoT Gigabit Cloud Service

  EPSS 25%
• Critical 9.8
  CVE-2024-51978 Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.

  BROTHER INDUSTRIES · DCP-L8410CDW · MFC-L8690CDW · MFC-L8610CDW

  EPSS 16%
• Critical 10.0
  CVE-2025-34040 Seeyon Zhiyuan OA System Path Traversal File Upload

  Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) · Zhiyuan OA Web Application System

  EPSS 15%
• Critical 9.0
  CVE-2025-36038 IBM WebSphere Application Server code execution

  IBM · WebSphere Application Server

  EPSS 13%
• Critical 9.2
  CVE-2025-6543 Memory overflow vulnerability leading to unintended control flow and Denial of Service

  NetScaler · ADC · Gateway

  EPSS 10%
• Critical 9.8
  CVE-2025-6424 Use-after-free in FontFaceSet

  Mozilla · Firefox · Thunderbird

  EPSS 7.9%
• Critical 10.0
  CVE-2025-34043 Vacron NVR Remote Command Execution

  Vacron · Network Video Recorder (NVR)

  EPSS 7.5%
• Critical 10.0
  CVE-2025-34041 Sangfor Endpoint Detection and Response OS Command Injection

  Sangfor · Endpoint Detection and Response Platform

  EPSS 7.5%
• Critical 9.4
  CVE-2025-34044 WIFISKY 7-Layer Flow Control Router Remote Command Execution

  Shenzhen Lingkong Technology · WIFISKY 7-layer flow control router

  EPSS 3.9%
• Critical 9.8
  CVE-2025-4334 Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

  N-Media · Simple User Registration

  EPSS 2.6%
• Critical 10.0
  CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1…
  EPSS 2.5%

All 94 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.3
  CVE-2024-51977 Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Ko…

  BROTHER INDUSTRIES · MFC-L8610CDW · DCP-L8410CDW · MFC-L8690CDW

  EPSS 47%
• Medium 5.4
  CVE-2025-52876 In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

  JetBrains · TeamCity

  EPSS 39%
• Medium 4.8
  CVE-2025-52877 In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

  JetBrains · TeamCity

  EPSS 37%
• High 7.0
  CVE-2025-5306 Command Injection in Netflow path

  Pandora FMS · Pandora FMS

  EPSS 36%
• High 8.4
  CVE-2025-2828 SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

  langchain-ai · langchain-ai/langchain

  EPSS 21%
• High 7.7
  CVE-2025-34033 5VTechnologies Blue Angel Software Suite OS Command Injection

  5VTechnologies · Blue Angel Software Suite

  EPSS 13%
• Medium 6.6
  CVE-2025-2172 Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing …

  Aviatrix · Controller

  EPSS 12%
• High 7.5
  CVE-2024-51983 Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ric…

  BROTHER INDUSTRIES · MFC-L8610CDW · DCP-L8410CDW · MFC-L8690CDW

  EPSS 12%