Week 35, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-57819 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

  FreePBX · endpoint

  EPSS 95%
• Critical 9.8
  CVE-2025-53118 Securden Unified PAM Authentication Bypass

  Securden · Unified PAM

  EPSS 35%
• Critical 9.2
  CVE-2025-7775 Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service

  NetScaler · ADC · Gateway

  EPSS 21%
• Critical 10.0
  CVE-2024-13985 Dahua EIMS capture_handle.action RCE

  Zhejiang Dahua Technology · EIMS

  EPSS 15%
• Critical 9.4
  CVE-2025-53120 Securden Unified PAM Path Traversal In File Upload

  Securden · Unified PAM

  EPSS 12%
• Critical 9.1
  CVE-2025-50989 OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span P…

  opnsense · OPNsense

  EPSS 11%
• Critical 10.0
  CVE-2018-25115 D-Link DIR-110/412/600/615/645/815 RCE via service.cgi

  D-Link · DIR-615 · DIR-600 · DIR-645

  EPSS 10%
• Critical 9.8
  CVE-2025-55583 D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endp…
  EPSS 7%
• Critical 9.8
  CVE-2025-49388 WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability

  kamleshyadav · Miraculous Core Plugin

  EPSS 6.6%
• Critical 9.8
  CVE-2025-9605 Tenda AC21/AC23 GetParentControlInfo stack-based overflow

  Tenda · AC23 · AC21

  EPSS 6%
• Critical 9.3
  CVE-2024-13979 St. Joe ERP System SingleRowQueryConverter SQL Injection

  Hangzhou Shengqiao Technology · St. Joe ERP System ("圣乔ERP系统")

  EPSS 3.1%
• Critical 9.4
  CVE-2025-34161 Coolify Git Repository Field Command Injection in Project Deployment Workflow

  coolLabs Technologies · Coolify

  EPSS 3%
• Critical 10.0
  CVE-2009-20011 ContentKeeper Web Appliance < 125.10 RCE via mimencode

  ContentKeeper Technologies · ContentKeeper Web Appliance

  EPSS 1.9%
• Critical 9.3
  CVE-2009-20010 Dogfood CRM spell.php RCE

  Dogfood CRM · Dogfood CRM

  EPSS 1.9%
• Critical 9.3
  CVE-2009-20009 Belkin Bulldog Plus Web Service Buffer Overflow

  Belkin International · Bulldog Plus UPS Monitoring Software

  EPSS 1.8%

All 108 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.0
  CVE-2025-9491 Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

  Microsoft · Windows

  EPSS 76%
• Medium 4.7
  CVE-2025-9528 Linksys E1700 systemCommand os command injection

  Linksys · E1700

  EPSS 54%
• High 8.6
  CVE-2025-9377 Authenticated RCE via Parental Control command injection

  TP-Link Systems · TL-WR841N/ND(MS) V9 · Archer C7(EU) V2

  EPSS 41%
• Medium 4.7
  CVE-2025-9424 Ruijie WS7204-A branch_import.php os command injection

  Ruijie · WS7204-A

  EPSS 15%
• High 7.5
  CVE-2025-53119 Securden Unified PAM Unauthenticated Unrestricted File Upload

  Securden · Unified PAM

  EPSS 15%
• Medium 5.4
  CVE-2025-55177 Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp…

  Facebook · WhatsApp for iOS · WhatsApp Business for iOS · WhatsApp Desktop for Mac

  EPSS 14%
• Medium 4.7
  CVE-2025-9745 D-Link DI-500WF jhttpd version_upgrade.asp os command injection

  D-Link · DI-500WF

  EPSS 13%
• High 7.3
  CVE-2025-9533 TOTOLINK T10 formLoginAuth.htm improper authentication

  Toto Link · T10

  EPSS 12%