Week 41, 2025

6–12 October 2025

New CVEs: 866
Critical: 56
High: 275
Newly exploited: 9
Advisories: 371
Malicious pkgs: 453

Newly exploited 9

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 7.5
CVE-2021-43798 KEV Oct 9, 2025 Grafana path traversal
Grafana · Grafana

EPSS 89%
Medium 5.4
CVE-2025-27915 KEV Oct 7, 2025 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client…
EPSS 4.1%
Critical 9.8
CVE-2010-3765 KEV Oct 6, 2025 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when Ja…
EPSS 83%
Critical 9.8
CVE-2025-61882 KEV Oct 6, 2025 · ransomware Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affecte…
Oracle · Oracle Concurrent Processing

EPSS 100%
High 8.8
CVE-2011-3402 KEV Oct 6, 2025 Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003…
EPSS 78%
High 8.8
CVE-2013-3918 KEV Oct 6, 2025 The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows S…
EPSS 74%
High 8.3
CVE-2021-22555 KEV Oct 6, 2025 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
EPSS 79%
High 8.1
CVE-2010-3962 KEV Oct 6, 2025 Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Styl…
EPSS 97%
High 7.8
CVE-2021-43226 KEV Oct 6, 2025 · ransomware Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 3.3%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2025-61928 Better Auth: Unauthenticated API key creation through api-key plugin
better-auth · better-auth

EPSS 20%
Critical 9.9
CVE-2025-44823 Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us…
Nagios · Log Server

EPSS 17%
Critical 10.0
CVE-2025-61913 Flowise is vulnerable to arbitrary file read, arbitrary file write
FlowiseAI · Flowise

EPSS 14%
Critical 9.8
CVE-2025-59246 Azure Entra ID Elevation of Privilege Vulnerability
Microsoft · Microsoft Entra

EPSS 7.6%
Critical 9.8
CVE-2025-11418 Tenda CH22 HTTP Request AdvSetWrlsafeset formWrlsafeset stack-based overflow
Tenda · CH22

EPSS 6.9%
Critical 9.3
CVE-2025-10353 Missing Authorization vulnerability in Melis Platform
Melis Technology · Melis Platform

EPSS 2.7%
Critical 9.3
CVE-2025-52472 XWiki Platform vulnerable to HQL injection via wiki and space search REST API
xwiki · xwiki-platform

EPSS 2.4%
Critical 9.1
CVE-2025-60964 OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary…
EPSS 1.2%
Critical 9.1
CVE-2025-60965 OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary…
EPSS 1.2%
Critical 9.9
CVE-2025-60957 OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary…
EPSS 1.2%
Critical 9.8
CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization
Newforma · Project Center
Critical 9.8
CVE-2025-7526 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
WP Travel Engine · WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Critical 9.8
CVE-2025-11423 Tenda CH22 SafeEmailFilter formSafeEmailFilter memory corruption
Tenda · CH22
Critical 9.8
CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
Newforma · Project Center
Critical 9.8
CVE-2025-6439 WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion
JMA Plugins · WooCommerce Designer Pro

All 56 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2025-61884 Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. E…
Oracle · Oracle Configurator

EPSS 96%
High 7.5
CVE-2025-11371 Gladinet CentreStack and TrioFox Local File Inclusion Flaw
Gladinet · CentreStack and TrioFox

EPSS 92%
Medium 4.7
CVE-2025-11331 IdeaCMS Website Name Config.php command injection
EPSS 17%
High 8.2
CVE-2025-50538 Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
FlowiseAI · Flowise

EPSS 15%
High 8.3
CVE-2025-61687 FlowiseAI/Flosise has File Upload vulnerability
FlowiseAI · Flowise

EPSS 12%
High 8.8
CVE-2025-11549 Tenda W12 HTTP Request modules wifiMacFilterSet stack-based overflow
Tenda · W12

EPSS 8.9%
High 8.8
CVE-2025-48826 A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to…
PLANET Technology · WGR-500

EPSS 7.2%
High 8.0
CVE-2025-53967 Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST reques…
Framelink · Figma MCP Server

EPSS 6.6%

Advisories

USN-7789-2 linux-raspi vulnerabilities 184 CVEs
USN-7774-5 linux-nvidia-tegra-igx vulnerabilities 142 CVEs
USN-7809-1 linux-azure-nvidia vulnerabilities 113 CVEs
USN-7801-2 linux-oracle vulnerabilities 107 CVEs
SUSE-SU-2025:03545-1 Security update for docker-stable 53 CVEs
SUSE-SU-2025:03540-1 Security update for docker-stable 53 CVEs
openSUSE-SU-2025:15605-1 ansible-11-11.11.0-1.1 on GA media 45 CVEs
VA-25-282-01 Newforma Project Center multiple vulnerabilities 13 CVEs
RHSA-2025:17570 Red Hat Security Advisory: kernel security update 8 CVEs
RHSA-2025:17643 Red Hat Security Advisory: webkit2gtk3 security update 7 CVEs