Week 44, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-11833 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email L…

  Saad Iqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

  EPSS 61%
• Critical 10.0
  CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

  dnnsoftware · Dnn.Platform

  EPSS 47%
• Critical 10.0
  CVE-2025-52665 A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a manag…

  Ubiquiti · UniFi Access Application

  EPSS 41%
• Critical 9.6
  CVE-2025-55754 Apache Tomcat: console manipulation via escape sequences in log messages

  Apache Software Foundation · Apache Tomcat

  EPSS 10%
• Critical 9.3
  CVE-2018-25120 D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test

  D-Link · DNS-343 ShareCenter

  EPSS 9.8%
• Critical 9.8
  CVE-2025-8489 King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation

  King Addons · King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor

  EPSS 9.6%
• Critical 9.4
  CVE-2024-14005 Nagios XI < 2024R1.2 Command Injection via Docker Wizard

  Nagios · XI

  EPSS 4%
• Critical 9.4
  CVE-2025-34284 Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

  Nagios · XI

  EPSS 4%
• Critical 9.8
  CVE-2025-11202 win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability

  win-cli-mcp-server · win-cli-mcp-server

  EPSS 2.8%
• Critical 9.4
  CVE-2020-36856 Nagios XI < 5.6.14 Authenticated RCE command_test.php via address

  Nagios · XI

  EPSS 2.5%
• Critical 9.4
  CVE-2024-14008 Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

  Nagios · XI

  EPSS 2.4%
• Critical 9.4
  CVE-2025-34286 Nagios XI < 2026R1 RCE via Run Check Command in CCM

  Nagios · XI

  EPSS 2.4%
• Critical 9.4
  CVE-2025-34134 Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

  Nagios · XI

  EPSS 2.4%
• Critical 9.4
  CVE-2024-14003 Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

  Nagios · XI

  EPSS 2.3%
• Critical 9.4
  CVE-2025-34277 Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID

  Nagios · Log Server

  EPSS 2.2%

All 70 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2025-55752 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

  Apache Software Foundation · Apache Tomcat

  EPSS 64%
• High 8.1
  CVE-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

  MLflow · MLflow

  EPSS 26%
• High 7.5
  CVE-2025-27225 TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint disclo…
  EPSS 20%
• High 8.9
  CVE-2025-62725 Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations

  Docker · Compose

  EPSS 16%
• High 8.7
  CVE-2025-34311 IPFire < v2.29 Command Injection via Proxy Report Creation

  IPFire.org · IPFire

  EPSS 13%
• Medium 4.7
  CVE-2025-12296 D-Link DAP-2695 Firmware Update sub_4174B0 os command injection

  D-Link · DAP-2695

  EPSS 7%
• Medium 5.1
  CVE-2025-34309 IPFire < v2.29 Stored XSS via Dynamic DNS Host

  IPFire.org · IPFire

  EPSS 5.3%
• Medium 5.1
  CVE-2025-34301 IPFire < v2.29 Stored XSS via Location Group Creation

  IPFire.org · IPFire

  EPSS 5.3%