Week 45, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
  EPSS 94%
• Critical 9.8
  CVE-2025-11749 AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

  tigroumeow · AI Engine – The Chatbot, AI Framework & MCP for WordPress

  EPSS 75%
• Critical 9.3
  CVE-2025-34299 Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

  Monsta Limited of New Zealand · Monsta FTP

  EPSS 73%
• Critical 10.0
  CVE-2025-10230 Samba: command injection in wins server hook script

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 40%
• Critical 9.1
  CVE-2025-64459 Potential SQL injection via _connector keyword argument in QuerySet and Q objects

  djangoproject · Django

  EPSS 19%
• Critical 9.3
  CVE-2022-50596 D-Link DIR-1260 <= v1.20B05 GetDeviceSettings Unauthenticated Command Injection

  D-Link · DIR-1260

  EPSS 4%
• Critical 9.8
  CVE-2025-61304 OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.
  EPSS 1.9%
• Critical 9.8
  CVE-2025-12735 CVE-2025-12735

  silentmatt · expr-eval-fork · expr-eval · expr-eval-fork

  EPSS 1.8%
• Critical 9.4
  CVE-2024-13997 Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host

  Nagios · XI

  EPSS 1.2%
• Critical 9.8
  CVE-2025-63334 PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The applicati…
  EPSS 1.2%
• Critical 9.8
  CVE-2025-12352 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

  Gravity Forms · Gravity Forms

  EPSS 1.1%
• Critical 9.8
  CVE-2025-47151 A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML res…

  Entr'ouvert · Lasso

  EPSS 1.1%
• Critical 9.1
  CVE-2025-63690 In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible …
  EPSS 1.1%
• Critical 9.4
  CVE-2025-20358 Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability

  Cisco · Cisco Unified Contact Center Express

• Critical 10.0
  CVE-2025-63689 Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacke…

All 78 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.6
  CVE-2025-64328 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

  FreePBX · filestore

  EPSS 85%
• High 7.5
  CVE-2025-12197 The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s

  stellarwp · The Events Calendar

  EPSS 18%
• High 8.8
  CVE-2025-12490 Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability

  Netgate · pfSense

  EPSS 17%
• High 7.7
  CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE

  Redis · Redis

  EPSS 7.5%
• High 7.3
  CVE-2025-64496 Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

  open-webui · open-webui

  EPSS 7.2%
• High 7.5
  CVE-2025-32786 GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection

  GLPI · glpi-inventory-plugin

  EPSS 7%
• High 8.8
  CVE-2025-12618 Tenda AC8 DatabaseIniSet buffer overflow

  Tenda · AC8

  EPSS 5.4%
• Medium 6.3
  CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

  Sangfor · Operation and Maintenance Security Management System

  EPSS 5.1%