Week 36, 2025

1–7 September 2025

New CVEs: 1,002
Critical: 61
High: 370
Newly exploited: 7
Advisories: 270
Malicious pkgs: 4,849

Newly exploited 7

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.0
CVE-2025-53690 KEV Sep 4, 2025 Sitecore Products ViewState Deserialization Vulnerability
Sitecore · Experience Platform (XP) · Experience Manager (XM)

EPSS 61%
High 8.8
CVE-2025-48543 KEV Sep 4, 2025 In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escal…
Google · Android
High 7.8
CVE-2025-38352 KEV Sep 4, 2025 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
Linux · Linux

EPSS 1.4%
High 8.6
CVE-2025-9377 KEV Sep 3, 2025 Authenticated RCE via Parental Control command injection
TP-Link Systems · Archer C7(EU) V2 · TL-WR841N/ND(MS) V9

EPSS 41%
Medium 6.5
CVE-2023-50224 KEV Sep 3, 2025 TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link Systems · TL-WR841N · Archer C5 · TL-WR740N

EPSS 20%
High 8.8
CVE-2020-24363 KEV Sep 2, 2025 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset…
EPSS 22%
Medium 5.4
CVE-2025-55177 KEV Sep 2, 2025 Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp…
Facebook · WhatsApp for iOS · WhatsApp Business for iOS · WhatsApp Desktop for Mac

EPSS 14%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.0
CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability
Sitecore · Experience Platform (XP) · Experience Manager (XM)

EPSS 61%
Critical 9.8
CVE-2024-28988 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
SolarWinds · Web Help Desk

EPSS 42%
Critical 9.9
CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
FOGProject · fogproject

EPSS 21%
Critical 9.8
CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
Sitecore · Experience Platform (XP) · Sitecore Experience Manager (XM)

EPSS 20%
Critical 9.8
CVE-2025-6507 Deserialization of Untrusted Data in h2oai/h2o-3
h2oai · h2oai/h2o-3

EPSS 17%
Critical 10.0
CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
argoproj · Argo CD

EPSS 5.7%
Critical 9.8
CVE-2025-39682 tls: fix handling of zero-length records on the rx_list
Linux · Linux

EPSS 3.3%
Critical 9.8
CVE-2025-54857 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If ex…
Seiko Solutions · SkyBridge BASIC MB-A130

EPSS 2.7%
Critical 10.0
CVE-2025-54914 Azure Networking Elevation of Privilege Vulnerability
Microsoft · Networking

EPSS 2.5%
Critical 9.8
CVE-2025-55037 TkEasyGUI Vulnerable to OS Command Injection
kujirahand · TkEasyGUI

EPSS 2.3%
Critical 9.3
CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints
xwiki · xwiki-platform

EPSS 1.8%
Critical 9.3
CVE-2025-55747 XWiki Platform's configuration files can be accessed through the webjars API
xwiki · xwiki-platform

EPSS 1.8%
Critical 9.4
CVE-2025-8311 dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query…
dotCMS · dotCMS Cloud Services (dCS)

EPSS 1.7%
Critical 10.0
CVE-2025-55241 Azure Entra ID Elevation of Privilege Vulnerability
Microsoft · Microsoft Entra

EPSS 1.6%
Critical 9.4
CVE-2025-58438 internetarchive is vulnerable to Directory Traversal through file downloads
jjjake · internetarchive

EPSS 1.6%

All 61 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 4.1
CVE-2025-9769 D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection
D-Link · DI-7400G+

EPSS 33%
High 7.1
CVE-2025-57833 Django is subject to SQL injection through its column aliases
djangoproject · Django

EPSS 28%
High 7.3
CVE-2025-9752 D-Link DIR-852 SOAP Service soap.cgi soapcgi_main os command injection
D-Link · DIR-852

EPSS 19%
High 8.6
CVE-2025-9961 Authenticated RCE by CWMP binary
TP-Link Systems · AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 · AX10 V1/V1.2/V2/V2.6/V3/V3.6

EPSS 11%
High 8.8
CVE-2025-58176 Dive's improper processing of custom urls can lead to Remote Code Execution
OpenAgentPlatform · Dive

EPSS 10%
High 7.5
CVE-2025-53694 Information Disclosure in ItemServices API
Sitecore · Experience Platform (XP) · Sitecore Experience Manager (XM)

EPSS 6.9%
Medium 6.3
CVE-2025-9934 TOTOLINK X5000R cstecgi.cgi sub_410C34 command injection
Toto Link · X5000R

EPSS 3.4%
Medium 6.5
CVE-2024-48705 Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the p…
EPSS 3.4%

Advisories

USN-7737-1 linux-azure, linux-azure-6.8, linux-azure-nvidia vulnerabilities 188 CVEs
USN-7712-2 linux-azure-5.15 vulnerabilities 170 CVEs
SUSE-SU-2025:20653-1 Security update for the Linux Kernel 96 CVEs
SUSE-SU-2025:20669-1 Security update for the Linux Kernel 96 CVEs
openSUSE-SU-2025:15531-1 libQt5Pdf5-5.15.19-1.1 on GA media 16 CVEs
RHSA-2025:15016 Red Hat Security Advisory: kernel security update 10 CVEs
openSUSE-SU-2025:15516-1 MozillaFirefox-142.0.1-1.1 on GA media 9 CVEs
RHSA-2025:15011 Red Hat Security Advisory: kernel security update 8 CVEs
RHSA-2025:15005 Red Hat Security Advisory: kernel security update 7 CVEs
RHSA-2025:15123 Red Hat Security Advisory: httpd:2.4 security update 4 CVEs