Week 48, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2025-6389 Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback

  Sneeit · Sneeit Framework

  EPSS 76%
• Critical 9.4
  CVE-2025-62593 Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

  ray-project · ray

  EPSS 60%
• Critical 9.2
  CVE-2025-59366 An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentia…

  ASUS · Router

  EPSS 12%
• Critical 9.1
  CVE-2025-35028 HexStrike AI MCP Server Command Injection

  0x4m4 · HexStrike AI

  EPSS 5.5%
• Critical 9.3
  CVE-2018-25126 TVT NVMS-9000 Hard-coded API Credentials & Command Injection

  Shenzhen TVT Digital Technology · NVMS-9000

  EPSS 4%
• Critical 10.0
  CVE-2025-64128 Zenitel TCIV-3+ OS Command Injection

  Zenitel · TCIV-3+

  EPSS 2.3%
• Critical 10.0
  CVE-2025-64127 Zenitel TCIV-3+ OS Command Injection

  Zenitel · TCIV-3+

  EPSS 2.3%
• Critical 10.0
  CVE-2025-64126 Zenitel TCIV-3+ OS Command Injection

  Zenitel · TCIV-3+

  EPSS 2.3%
• Critical 9.9
  CVE-2025-66261 Unauthenticated OS Command Injection (restore_settings.php)

  DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter

  EPSS 2.3%
• Critical 9.9
  CVE-2025-66253 Unauthenticated OS Command Injection (start_upgrade.php)

  DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter

  EPSS 2.3%
• Critical 9.3
  CVE-2025-66262 Arbitrary File Overwrite via Tar Extraction Path Traversal

  DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter

  EPSS 1.5%
• Critical 9.3
  CVE-2025-8890 Authenticated RCE in SDMC NE6037 router

  SDMC · NE6037

  EPSS 1.4%
• Critical 9.8
  CVE-2025-62354 Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are …

  cursor · cursor

  EPSS 1.3%
• Critical 9.8
  CVE-2025-13597 AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload

  soportecibeles · AI Feeds

  EPSS 1%
• Critical 9.8
  CVE-2025-13595 CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload

  soportecibeles · CIBELES AI

  EPSS 1%

All 73 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.2
  CVE-2025-58360 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

  geoserver · geoserver

  EPSS 61%
• High 8.0
  CVE-2025-65202 TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command…
  EPSS 6.7%
• Medium 6.9
  CVE-2025-66219 willitmerge has a command Injection vulnerability

  shama · willitmerge

  EPSS 2.7%
• Medium 6.5
  CVE-2025-53900 Kiteworks MFT has a Privilege Defined With Unsafe Actions

  Kiteworks · security-advisories

  EPSS 1.2%
• High 8.8
  CVE-2025-12970 CVE-2025-12970

  FluentBit · Fluent Bit

  EPSS 1.1%
• High 7.2
  CVE-2025-53899 Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel

  Kiteworks · security-advisories

  EPSS 1%