Week 40, 2025

29 September – 5 October 2025

New CVEs: 945
Critical: 74
High: 286
Newly exploited: 10
Advisories: 497
Malicious pkgs: 88

Newly exploited 10

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2017-1000353 KEV Oct 2, 2025 Deserialization of Untrusted Data in Jenkins
EPSS 100%
Critical 9.8
CVE-2015-7755 KEV Oct 2, 2025 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r1…
EPSS 61%
High 8.8
CVE-2025-21043 KEV Oct 2, 2025 Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
Samsung Mobile · Samsung Mobile Devices

EPSS 2.2%
High 8.8
CVE-2014-6278 KEV Oct 2, 2025 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute a…
EPSS 100%
High 8.7
CVE-2025-4008 KEV Oct 2, 2025 Arbitrary Command Injection in Smartbedded MeteoBridge
Smartbedded · MeteoBridge

EPSS 93%
Critical 10.0
CVE-2025-10035 KEV Sep 29, 2025 · ransomware Deserialization Vulnerability in GoAnywhere MFT's License Servlet
Fortra · GoAnywhere MFT

EPSS 100%
Critical 9.3
CVE-2025-32463 KEV Sep 29, 2025 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
sudo-project · sudo

EPSS 56%
High 7.7
CVE-2025-20352 KEV Sep 29, 2025 A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authen…
Cisco · Cisco IOS XE Software · IOS · Cisco IOS XE Catalyst SD-WAN

EPSS 41%
High 7.2
CVE-2021-21311 KEV Sep 29, 2025 SSRF in adminer
vrana · adminer

EPSS 98%
Medium 6.1
CVE-2025-59689 KEV Sep 29, 2025 Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ES…
Libraesva · Email Security Gateway

EPSS 2%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2025-61882 Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affecte…
Oracle · Oracle Concurrent Processing

EPSS 100%
Critical 10.0
CVE-2025-49844 Redis Lua Use-After-Free may lead to remote code execution
Redis · Redis

EPSS 83%
Critical 9.8
CVE-2025-61622 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
Apache Software Foundation · Apache Fory

EPSS 49%
Critical 9.8
CVE-2025-8868 Chef Automate compliance service SQL Injection Vulnerability
Progress Software · Chef Automate

EPSS 28%
Critical 9.8
CVE-2025-39946 tls: make sure to abort the stream if headers are bogus
Linux · Linux

EPSS 10%
Critical 9.2
CVE-2025-59951 Termix' official Docker image contains an authentication bypass vulnerability
LukeGus · Termix

EPSS 4.9%
Critical 9.8
CVE-2025-9209 RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
magnigenie · RestroPress – Online Food Ordering System

EPSS 2.3%
Critical 9.8
CVE-2025-9230 Out-of-bounds read & write in RFC 3211 KEK Unwrap
OpenSSL · OpenSSL

EPSS 1.7%
Critical 9.3
CVE-2025-59735 Multiple vulnerabilities in AndSoft's e-TMS
AndSoft · e-TMS

EPSS 1.5%
Critical 10.0
CVE-2025-34221 Vasion Print (formerly PrinterLogic)
Vasion · Print Virtual Appliance Host · Print Application

EPSS 1.5%
Critical 9.8
CVE-2025-11148 check-branches is vulnerable to command Injection
EPSS 1.4%
Critical 9.3
CVE-2025-59740 Multiple vulnerabilities in AndSoft's e-TMS
AndSoft · e-TMS

EPSS 1.4%
Critical 9.3
CVE-2025-59739 Multiple vulnerabilities in AndSoft's e-TMS
AndSoft · e-TMS

EPSS 1.4%
Critical 9.3
CVE-2025-59738 Multiple vulnerabilities in AndSoft's e-TMS
AndSoft · e-TMS

EPSS 1.4%
Critical 9.3
CVE-2025-59737 Multiple vulnerabilities in AndSoft's e-TMS
AndSoft · e-TMS

EPSS 1.4%

All 74 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2025-61734 Apache Kylin: improper restriction of file read
Apache Software Foundation · Apache Kylin

EPSS 27%
High 8.7
CVE-2025-59536 Claude Code's startup trust dialog could lead to Command Execution attack
anthropics · claude-code

EPSS 25%
High 7.2
CVE-2025-60787 motionEye vulnerable to RCE via unsanitized motion config parameter
EPSS 18%
High 7.8
CVE-2025-41244 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
VMware · VMware Aria Operations · VMware Telco Cloud Platform · VMware Cloud Foundation

EPSS 16%
High 7.5
CVE-2025-59538 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
argoproj · Argo CD

EPSS 11%
Medium 6.3
CVE-2025-11285 samanhappy MCPHub serverController.ts os command injection
samanhappy · MCPHub

EPSS 7.9%
Medium 6.3
CVE-2025-43400 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.1 and iPadOS 18.7.1, iOS 26.0.1 and iPadOS 26.0.1, ma…
Apple · macOS · iOS and iPadOS · watchOS

EPSS 7.3%
Medium 6.3
CVE-2025-11292 Belkin F9K1015 formBSSetSitesurvey command injection
Belkin · F9K1015

EPSS 6.8%

Advisories

USN-7789-1 linux-oracle-6.14 vulnerabilities 184 CVEs
USN-7775-3 linux-azure-5.15 vulnerabilities 143 CVEs
USN-7774-4 linux-kvm vulnerabilities 142 CVEs
USN-7801-1 linux-hwe-6.8 vulnerabilities 107 CVEs
USN-7802-1 linux-azure, linux-azure-6.8 vulnerabilities 106 CVEs
USN-7800-1 linux-raspi-realtime vulnerabilities 106 CVEs
USN-7790-1 linux-raspi vulnerabilities 100 CVEs
openSUSE-SU-2025:15589-1 docker-stable-24.0.9_ce-15.1 on GA media 43 CVEs
ICSA-25-273-04 Festo Controller CECC-S,-LK,-D Family Firmware (Update A) 33 CVEs
SCA-2025-0011 Vulnerabilities affecting Endress+Hauser SSG-E210GC 23 CVEs