Week 37, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2025-54236 Adobe Commerce | Improper Input Validation (CWE-20)

  Adobe · Adobe Commerce

  EPSS 96%
• Critical 9.8
  CVE-2025-58434 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

  FlowiseAI · Flowise

  EPSS 83%
• Critical 10.0
  CVE-2025-54261 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

  Adobe · ColdFusion

  EPSS 27%
• Critical 9.8
  CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

  SpectoLabs · hoverfly

  EPSS 11%
• Critical 9.8
  CVE-2024-45434 OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the la…
  EPSS 7.3%
• Critical 9.3
  CVE-2025-10364 Unauthenticated Arbitrary Command Injection in Evertz SDVN

  Evertz · 3080ipx-10G · cVIP · CC Access Server

  EPSS 6.2%
• Critical 9.3
  CVE-2025-10365 Authentication Bypass in Evertz SDVN

  Evertz · 3080ipx-10G · cVIP · CC Access Server

  EPSS 5.6%
• Critical 9.8
  CVE-2025-56266 A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.
  EPSS 3%
• Critical 10.0
  CVE-2025-42944 Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

  SAP · SAP Netweaver (RMI-P4)

  EPSS 3%
• Critical 9.8
  CVE-2025-57285 CodeceptJS's incomprehensive sanitation can lead to Command Injection
  EPSS 2.2%
• Critical 9.8
  CVE-2025-55232 Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

  Microsoft · Microsoft HPC Pack 2019

  EPSS 2.1%
• Critical 9.8
  CVE-2025-57633 A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html e…
  EPSS 1.4%
• Critical 9.3
  CVE-2025-54994 @akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` API

  akoskm · create-mcp-server-stdio

  EPSS 1.3%
• Critical 10.0
  CVE-2025-58321 DIALink - Directory Traversal Authentication Bypass Vulnerability

  Delta Electronics · DIALink

  EPSS 1.3%
• Critical 9.8
  CVE-2025-59046 interactive-git-checkout has Command Injection vulnerability

  ninofiliu · interactive-git-checkout

  EPSS 1.2%

All 75 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2025-21042 Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.

  Samsung Mobile · Samsung Mobile Devices

  EPSS 36%
• High 8.8
  CVE-2025-54918 Windows NTLM Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 27%
• High 7.5
  CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

  OctoPrint · OctoPrint

  EPSS 26%
• High 8.8
  CVE-2025-9712 Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote cod…

  ivanti · Endpoint Manager

  EPSS 26%
• Medium 5.1
  CVE-2025-34175 Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting

  Netgate · pfSense CE

  EPSS 24%
• High 8.8
  CVE-2025-54897 Microsoft SharePoint Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 23%
• High 8.8
  CVE-2025-55234 Windows SMB Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 21%
• Medium 5.3
  CVE-2025-34176 Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

  Netgate · pfSense CE

  EPSS 20%