Week 30, 2025

21–27 July 2025

New CVEs: 833
Critical: 91
High: 368
Newly exploited: 6
Advisories: 314
Malicious pkgs: 233

Newly exploited 6

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.3
CVE-2025-2775 KEV Jul 22, 2025 SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
SysAid · SysAid On-Prem

EPSS 43%
Critical 9.3
CVE-2025-2776 KEV Jul 22, 2025 SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
SysAid · SysAid On-Prem

EPSS 65%
Critical 9.0
CVE-2025-54309 KEV Jul 22, 2025 CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers t…
CrushFTP · CrushFTP

EPSS 93%
High 8.8
CVE-2025-49704 KEV Jul 22, 2025 · ransomware Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016

EPSS 100%
High 8.8
CVE-2025-6558 KEV Jul 22, 2025 Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox…
Google · Chrome

EPSS 11%
Medium 6.5
CVE-2025-49706 KEV Jul 22, 2025 · ransomware Microsoft SharePoint Server Spoofing Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2025-32429 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
xwiki · xwiki-platform

EPSS 85%
Critical 9.3
CVE-2025-34143 ETQ Reliance CG Authentication Bypass via Trailing Space RCE
ETQ · Reliance CG (legacy)

EPSS 38%
Critical 9.8
CVE-2019-25224 WP Database Backup < 5.2 - Unauthenticated OS Command Injection
databasebackup · WP Database Backup – Unlimited Database & Files Backup by Backup for WP

EPSS 22%
Critical 9.8
CVE-2025-6704 An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth …
Sophos · Sophos Firewall

EPSS 12%
Critical 9.8
CVE-2025-7624 An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code executio…
Sophos · Sophos Firewall

EPSS 11%
Critical 9.1
CVE-2025-40599 An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges ca…
SonicWall · SMA 100 Series

EPSS 9.7%
Critical 9.3
CVE-2014-125117 D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE
D-Link · DSP-W215

EPSS 9.3%
Critical 9.3
CVE-2015-10141 Xdebug Remote Debugger Unauthenticated OS Command Execution
Xdebug · Xdebug

EPSS 7.1%
Critical 9.8
CVE-2015-10137 Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload
N-Media · Website Contact Form With File Upload

EPSS 5.4%
Critical 9.8
CVE-2025-36846 An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that …
EPSS 4.9%
Critical 9.4
CVE-2014-125118 eScan 5.5-2 Web Management Console Command Injection
MicroWorld · eScan Web Management Console

EPSS 4.8%
Critical 9.8
CVE-2012-10020 FoxyPress <= 0.4.2.1 - Arbitrary File Upload
WebMovementLLC · FoxyPress

EPSS 4.8%
Critical 9.3
CVE-2018-25114 osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
Os Commerce · Online Merchant

EPSS 4.6%
Critical 9.8
CVE-2015-10143 Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update
PageLines · Platform

EPSS 3.1%
Critical 9.3
CVE-2014-125116 HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
HybridAuth · HybridAuth

EPSS 2.7%

All 91 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 6.1
CVE-2025-40598 A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execu…
SonicWall · SMA 100 Series

EPSS 46%
High 7.3
CVE-2025-40596 A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or pote…
SonicWall · SMA 100 Series

EPSS 45%
High 8.8
CVE-2025-54453 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.Th…
Samsung Electronics · MagicINFO 9 Server

EPSS 34%
High 7.6
CVE-2025-5120 Sandbox Escape Vulnerability in huggingface/smolagents
Hugging Face · huggingface/smolagents

EPSS 31%
Low 3.5
CVE-2025-8155 D-Link DCS-6010L Management Application vb.htm cross site scripting
D-Link · DCS-6010L

EPSS 25%
Medium 6.3
CVE-2025-7952 TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection
Toto Link · T6

EPSS 25%
High 7.5
CVE-2025-40597 A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or poten…
SonicWall · SMA 100 Series

EPSS 23%
High 8.8
CVE-2025-8159 D-Link DIR-513 HTTP POST Request formLanguageChange stack-based overflow
D-Link · DIR-513

EPSS 21%

Advisories

USN-7651-6 linux-raspi vulnerabilities 117 CVEs
USN-7651-5 linux-raspi-realtime vulnerabilities 117 CVEs
USN-7651-4 linux-gcp, linux-gcp-6.8 vulnerabilities 117 CVEs
USN-7651-3 linux-aws-6.8, linux-gke, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle, linux-oracle-6.8 vulnerabilities 117 CVEs
USN-7665-2 linux-aws-6.14 vulnerabilities 52 CVEs
USN-7663-1 thunderbird vulnerabilities 52 CVEs
USN-7665-1 linux-oracle vulnerabilities 46 CVEs
USN-7649-2 linux-aws vulnerabilities 46 CVEs
SUSE-SU-2025:02529-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE 27 CVEs
openSUSE-SU-2025:15371-1 firefox-esr-140.1.0-1.1 on GA media 22 CVEs