Week 34, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-43300 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, …

  Apple · macOS · iOS and iPadOS · iPadOS

  EPSS 63%
• Critical 9.8
  CVE-2025-8723 Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook

  mecanik · Cloudflare Image Resizing – Optimize & Accelerate Your Images

  EPSS 19%
• Critical 10.0
  CVE-2025-48148 WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

  StoreKeeper · StoreKeeper for WooCommerce

  EPSS 18%
• Critical 9.3
  CVE-2010-20103 ProFTPD 1.3.3c Backdoor Command Execution

  ProFTPD Project · ProFTPD (Professional FTP Daemon)

  EPSS 15%
• Critical 9.8
  CVE-2025-55591 TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.
  EPSS 7.3%
• Critical 9.3
  CVE-2010-20121 EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

  KMiNT21 Software · EasyFTP Server

  EPSS 5.1%
• Critical 9.3
  CVE-2011-10026 Spreecommerce < 0.50.x API RCE

  Spreecommerce · Spreecommerce

  EPSS 4%
• Critical 9.8
  CVE-2025-57105 The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in m…
  EPSS 2.9%
• Critical 9.3
  CVE-2010-20113 EasyFTP Server list.html path Stack Buffer Overflow

  KMiNT21 Software · EasyFTP Server

  EPSS 2.5%
• Critical 9.8
  CVE-2025-27129 An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can le…

  Tenda · AC6 V5.0

  EPSS 2.3%
• Critical 9.3
  CVE-2025-9074 Docker Desktop allows unauthenticated access to Docker Engine API from containers

  Docker · Docker Desktop

  EPSS 1.9%
• Critical 9.3
  CVE-2010-20112 Amlibweb NetOpacs webquery.dll Stack Buffer Overflow

  Amlib · Amlibweb Library Management System

  EPSS 1.8%
• Critical 9.3
  CVE-2010-20059 FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

  iXsystems · FreeNAS

  EPSS 1.6%
• Critical 9.3
  CVE-2025-54726 WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability

  Miguel Useche · JS Archive List

  EPSS 1.6%
• Critical 9.3
  CVE-2010-20122 Xftp FTP Client <= 3.0 PWD Response Buffer Overflow

  NetSarang Computer · Xftp FTP Client

  EPSS 1.6%

All 118 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.7
  CVE-2025-57790 Path Traversal Vulnerability

  Commvault · CommCell

  EPSS 44%
• Medium 6.9
  CVE-2025-57791 Argument Injection Vulnerability in CommServe

  Commvault · CommCell

  EPSS 39%
• High 8.4
  CVE-2025-54988 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

  Apache Software Foundation · Apache Tika PDF parser module

  EPSS 36%
• Medium 5.5
  CVE-2025-55296 LibreNMS allows stored XSS in Alert Template name field

  librenms · librenms

  EPSS 18%
• Unscored
  CVE-2025-38562 ksmbd: fix null pointer dereference error in generate_encryptionkey

  Linux · Linux

  EPSS 15%
• Medium 6.9
  CVE-2025-57788 Unauthorized API Access Risk

  Commvault · CommCell

  EPSS 7.8%
• Medium 6.3
  CVE-2025-9387 DCN DCME-720 Web Management Backend ip_block.php os command injection

  DCN · DCME-720

  EPSS 7.7%
• High 8.8
  CVE-2025-9299 Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow

  Tenda · M3

  EPSS 6%