Week 33, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-32640 MasaCMS SQL Injection vulnerability

  MasaCMS · MasaCMS

  EPSS 78%
• Critical 9.8
  CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
  EPSS 75%
• Critical 9.8
  CVE-2025-25256 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 …

  Fortinet · FortiSIEM

  EPSS 65%
• Critical 9.8
  CVE-2025-7441 StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload

  storychief · StoryChief

  EPSS 51%
• Critical 9.8
  CVE-2025-43984 An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unaut…
  EPSS 25%
• Critical 9.8
  CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers
  EPSS 24%
• Critical 10.0
  CVE-2025-20265 Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability

  Cisco · Cisco Firepower Management Center

  EPSS 16%
• Critical 9.8
  CVE-2025-50165 Windows Graphics Component Remote Code Execution Vulnerability

  Microsoft · Windows Server 2025 · Windows Server 2025 (Server Core installation) · Windows 11 Version 24H2

  EPSS 11%
• Critical 9.8
  CVE-2025-53766 GDI+ Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 8.5%
• Critical 9.7
  CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure

  CherryHQ · cherry-studio

  EPSS 8.3%
• Critical 9.1
  CVE-2023-3867 ksmbd: fix out of bounds read in smb2_sess_setup

  Linux · Linux

  EPSS 6.3%
• Critical 10.0
  CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE

  Spreecommerce · Spreecommerce

  EPSS 6.3%
• Critical 9.3
  CVE-2012-10060 Sysax Multi Server < 5.55 SSH Username Buffer Overflow

  Sysax Software · Multi Server

  EPSS 4.7%
• Critical 9.4
  CVE-2012-10059 Dolibarr ERP/CRM Post-Auth OS Command Injection

  Dolibarr · ERP CRM

  EPSS 4.5%
• Critical 9.3
  CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

  umbraco · CMS

  EPSS 4.3%

All 84 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2025-53778 Windows NTLM Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 52%
• Medium 6.5
  CVE-2025-50154 Microsoft Windows File Explorer Spoofing Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 32%
• Medium 6.3
  CVE-2025-54466 Apache OFBiz: RCE Vulnerability in scrum plugin

  Apache Software Foundation · Apache OFBiz

  EPSS 29%
• High 8.8
  CVE-2025-53772 Web Deploy Remote Code Execution Vulnerability

  Microsoft · Web Deploy 4.0

  EPSS 28%
• Medium 6.3
  CVE-2025-8956 D-Link DIR‑818L ssdpcgi cgibin getenv command injection

  D-Link · DIR‑818L

  EPSS 27%
• High 7.5
  CVE-2025-25231 Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by s…

  Omnissa · Omnissa Workspace ONE UEM

  EPSS 25%
• High 7.5
  CVE-2025-53722 Windows Remote Desktop Services Denial of Service Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 23%
• High 8.8
  CVE-2024-53945 The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticat…
  EPSS 23%