Week 47, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.3
  CVE-2025-13315 Unauthenticated log access in Twonky Server

  Lynxtechnology · Twonky Server

  EPSS 31%
• Critical 9.0
  CVE-2025-9501 W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
  EPSS 22%
• Critical 10.0
  CVE-2025-41115 Incorrect privilege assignment

  Grafana · Grafana Enterprise

  EPSS 17%
• Critical 9.8
  CVE-2025-63207 The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on t…
  EPSS 7.4%
• Critical 9.8
  CVE-2025-13284 ThinPLUS｜ThinPLUS - OS Command Injection

  ThinPLUS · ThinPLUS

  EPSS 1.7%
• Critical 9.3
  CVE-2025-34329 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php

  AudioCodes · AudioCodes Fax/IVR Appliance

  EPSS 1.2%
• Critical 9.8
  CVE-2025-59245 Microsoft SharePoint Online Elevation of Privilege Vulnerability

  Microsoft · Microsoft SharePoint Online

  EPSS 1.1%
• Critical 9.1
  CVE-2025-40549 SolarWinds Serv-U Path Restriction Bypass Vulnerability

  SolarWinds · Serv-U

  EPSS 1.1%
• Critical 9.8
  CVE-2025-60738 An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arb…
  EPSS 1.1%
• Critical 9.1
  CVE-2025-40547 SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability

  SolarWinds · Serv-U

• Critical 10.0
  CVE-2025-65108 md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

  simonhaenisch · md-to-pdf

• Critical 9.8
  CVE-2025-63213 The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/…
• Critical 10.0
  CVE-2025-49752 Azure Bastion Elevation of Privilege Vulnerability

  Microsoft · Azure Bastion Developer

• Critical 9.3
  CVE-2025-34320 BASIS BBj < 25.00 Unauthenticated Arbitrary File Read RCE

  BASIS International · BASIS BBj

• Critical 9.8
  CVE-2025-63228 The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php end…

All 55 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.7
  CVE-2025-58034 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 t…

  Fortinet · FortiWeb

  EPSS 55%
• High 7.0
  CVE-2025-11001 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

  7-Zip · 7-Zip

  EPSS 27%
• High 7.3
  CVE-2025-13442 UTT 进取 750W formPdbUpConfig system command injection

  UTT · 750W

  EPSS 20%
• Medium 6.3
  CVE-2025-64408 Apache Causeway: Java deserialization vulnerability to authenticated attackers

  Apache Software Foundation · Apache Causeway

  EPSS 12%
• High 8.6
  CVE-2025-34322 Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

  Nagios · Log Server

  EPSS 9.2%
• Medium 6.3
  CVE-2025-13306 D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection

  D-Link · DWR-M920 · DWR-M921 · DIR-822K

  EPSS 8.3%
• High 7.3
  CVE-2025-63932 D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin d…
  EPSS 8.1%
• Medium 6.2
  CVE-2025-13087 Command Injection in Opto22 Groov REST API

  Opto22 · groov RIO GRV-R7-MM2001-10 · GRV-EPIC-PR1 · groov RIO GRV-R7-MM1001-10

  EPSS 7.3%