Week 38, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-10035 Deserialization Vulnerability in GoAnywhere MFT's License Servlet

  Fortra · GoAnywhere MFT

  EPSS 100%
• Critical 9.0
  CVE-2025-48703 CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total paramete…

  CentOS Web Panel · CentOS Web Panel

  EPSS 100%
• Critical 9.3
  CVE-2025-9242 WatchGuard Firebox iked Out of Bounds Write Vulnerability

  WatchGuard · Fireware OS

  EPSS 92%
• Critical 9.8
  CVE-2025-52053 TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vul…
  EPSS 4.6%
• Critical 10.0
  CVE-2025-41243 Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

  Spring · Cloud Gateway

  EPSS 3.7%
• Critical 9.8
  CVE-2025-59304 A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP requ…
  EPSS 3.5%
• Critical 9.8
  CVE-2025-59361 OS command injection in Chaos Mesh via the cleanIptables mutation
  EPSS 3.4%
• Critical 9.3
  CVE-2025-34187 Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

  Ilevia Srl. · EVE X1/X5 Server

  EPSS 3.3%
• Critical 9.4
  CVE-2025-10644 Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability

  Wondershare · Repairit

  EPSS 3.1%
• Critical 9.8
  CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation
  EPSS 3%
• Critical 9.1
  CVE-2025-10643 Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability

  Wondershare · Repairit

  EPSS 2.9%
• Critical 9.8
  CVE-2025-59360 OS command injection in Chaos Mesh via the killProcesses mutation
  EPSS 2.9%
• Critical 9.3
  CVE-2025-34184 Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code Injection

  Ilevia Srl. · EVE X1 Server

  EPSS 2.7%
• Critical 9.3
  CVE-2009-20007 Talkative IRC v0.4.4.16 Response Buffer Overflow

  Talkative · Talkative IRC

  EPSS 2.4%
• Critical 9.3
  CVE-2009-20005 InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow

  InterSystems · InterSystems Caché

  EPSS 2.4%

All 82 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.5
  CVE-2025-59456 In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

  JetBrains · TeamCity

  EPSS 15%
• Medium 6.3
  CVE-2025-10440 D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection

  D-Link · DI-8100 · DI-8200G · DI-8003

  EPSS 13%
• Medium 6.3
  CVE-2025-10441 D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injection

  D-Link · DI-8200G · DI-8003G · DI-8100G

  EPSS 13%
• Medium 6.3
  CVE-2025-10628 D-Link DIR-852 Web Management hedwig.cgi command injection

  D-Link · DIR-852

  EPSS 10%
• Medium 6.3
  CVE-2025-10442 Tenda AC9/AC15 exeCommand formexeCommand os command injection

  Tenda · AC15 · AC9

  EPSS 9.2%
• Medium 6.3
  CVE-2025-10634 D-Link DIR-823X Environment Variable goahead sub_412E7C command injection

  D-Link · DIR-823X

  EPSS 6.3%
• Medium 6.3
  CVE-2025-10629 D-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection

  D-Link · DIR-852

  EPSS 5.1%
• Medium 5.3
  CVE-2025-59474 Jenkins has a missing permission check, allowing users to obtain agent names

  Jenkins Project · Jenkins

  EPSS 5%