Week 46, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2025-12480 Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is com…

  TrioFox · TrioFox

  EPSS 96%
• Critical 9.4
  CVE-2025-64446 A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 th…

  Fortinet · FortiWeb

  EPSS 91%
• Critical 9.1
  CVE-2025-12762 Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

  pgadmin.org · pgAdmin 4

  EPSS 13%
• Critical 9.8
  CVE-2025-60724 GDI+ Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 6.3%
• Critical 9.3
  CVE-2021-4462 Employee Records System v1.0 Arbitrary File Upload RCE

  Employee Records System · Employee Records System

  EPSS 3.4%
• Critical 9.8
  CVE-2025-13188 D-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflow

  D-Link · DIR-816L

  EPSS 2.4%
• Critical 9.3
  CVE-2021-4464 FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow

  FiberHome · HG6245D · AN5506-04-FA

  EPSS 2.2%
• Critical 9.8
  CVE-2025-8324 SQL Injection

  Zohocorp · ManageEngine Analytics Plus

  EPSS 1.8%
• Critical 9.8
  CVE-2025-63353 A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSI…
  EPSS 1.3%
• Critical 10.0
  CVE-2025-12539 TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

  leopardhost · TNC Toolbox: Web Performance

  EPSS 1.1%
• Critical 9.8
  CVE-2025-12813 Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'

  strix-bubol5 · Holiday class post calendar

• Critical 9.3
  CVE-2025-64513 Milvus Proxy has Critical Authentication Bypass Vulnerability

  milvus-io · milvus

• Critical 9.3
  CVE-2025-59367 An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affec…

  ASUS · DSL-AC750 · DSL-N16 · DSL-AC51

• Critical 9.8
  CVE-2025-13204 CVE-2025-13204

  silentmatt · expr-eval

• Critical 9.8
  CVE-2025-11170 WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

  kddiwebcommunications · WP移行専用プラグイン for CPI

All 49 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.9
  CVE-2025-9316 N-central unauthenticated sessionID generation

  N-able · N-central

  EPSS 37%
• High 8.4
  CVE-2025-11700 N-central Multiple XXE Injection Vulnerabilities

  N-able · N-central

  EPSS 32%
• Medium 5.9
  CVE-2025-12101 Cross-Site Scripting (XSS)

  NetScaler · ADC · Gateway

  EPSS 26%
• Medium 5.4
  CVE-2025-60689 An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001…
  EPSS 18%
• High 8.8
  CVE-2025-12428 Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur…

  Google · Chrome

  EPSS 8.1%
• Medium 6.5
  CVE-2025-60687 An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41…
  EPSS 6.6%
• High 7.8
  CVE-2025-60710 Host Process for Windows Tasks Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2025 · Windows Server 2025 (Server Core installation) · Windows 11 Version 24H2

  EPSS 4.6%
• High 7.0
  CVE-2025-62215 Windows Kernel Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 4.5%