Week 39, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

  SolarWinds · Web Help Desk

  EPSS 91%
• Critical 10.0
  CVE-2025-59528 Flowise has Remote Code Execution vulnerability

  FlowiseAI · Flowise

  EPSS 87%
• Critical 9.9
  CVE-2025-20333 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softwa…

  Cisco · Cisco Secure Firewall Threat Defense (FTD) Software · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

  EPSS 72%
• Critical 9.3
  CVE-2025-52906 TOTOLINK X6000R Command Injection Vulnerability

  Toto Link · X6000R

  EPSS 14%
• Critical 9.4
  CVE-2025-59934 Formbricks missing JWT signature verification

  formbricks · formbricks

  EPSS 9.5%
• Critical 9.0
  CVE-2025-20363 A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, C…

  Cisco · Cisco IOS XE Software · Cisco Firepower Threat Defense Software · Cisco Adaptive Security Appliance (ASA) Software

  EPSS 7.2%
• Critical 9.6
  CVE-2025-59434 Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function

  FlowiseAI · Flowise

  EPSS 4.4%
• Critical 9.8
  CVE-2025-56819 An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
  EPSS 3.2%
• Critical 9.8
  CVE-2025-59834 Command Injection in adb-mcp MCP Server

  srmorete · adb-mcp

  EPSS 2.6%
• Critical 9.3
  CVE-2025-11005 TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

  Toto Link · X6000R

  EPSS 1.3%
• Critical 10.0
  CVE-2025-9962 Unauthenticated Buffer Overflow

  Novakon · P series (P07, P10, P12, P15)

  EPSS 1.2%
• Critical 10.0
  CVE-2025-9588 OS Command Injection in Iron Mountain's enVision

  Iron Mountain Archiving Services · enVision

  EPSS 1.1%
• Critical 10.0
  CVE-2025-9846 Unrestricted File Upload in TaletSys Inka.Net

  TalentSys Consulting Information Technology Industry · Inka.Net

  EPSS 1.1%
• Critical 9.8
  CVE-2025-10147 Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload

  eteubert · Podlove Podcast Publisher

• Critical 9.8
  CVE-2025-9321 WPCasa <= 1.4.1 - Unauthenticated Code Injection

  wpsight · WPCasa

All 46 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2025-20362 Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases…

  Cisco · Cisco Secure Firewall Threat Defense (FTD) Software · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

  EPSS 87%
• High 7.7
  CVE-2025-20352 A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authen…

  Cisco · Cisco IOS XE Software · IOS · Cisco IOS XE Catalyst SD-WAN

  EPSS 41%
• High 8.6
  CVE-2025-34227 Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

  Nagios · Nagios XI

  EPSS 26%
• Medium 4.7
  CVE-2025-10775 Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injection

  WAVLINK · WL-NU516U1

  EPSS 17%
• Medium 5.3
  CVE-2025-9985 Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File

  marceljm · Featured Image from URL (FIFU)

  EPSS 13%
• High 7.2
  CVE-2025-9816 WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

  VeronaLabs · WP Statistics – Simple, privacy-friendly Google Analytics alternative

  EPSS 12%
• High 7.0
  CVE-2025-52905 TOTOLINK X6000R Argument Injection Vulnerability

  Toto Link · X6000R

  EPSS 10%
• High 8.8
  CVE-2025-10585 Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi…

  Google · Chrome

  EPSS 9%