Week 50, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2025-59718 A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.…

  Fortinet · FortiOS · FortiProxy · FortiSwitchManager

  EPSS 68%
• Critical 9.6
  CVE-2025-10573 Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of …

  ivanti · Endpoint Manager

  EPSS 33%
• Critical 9.1
  CVE-2025-59719 An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may al…

  Fortinet · FortiWeb

  EPSS 29%
• Critical 10.0
  CVE-2025-34392 Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

  Barracuda Networks · RMM

  EPSS 25%
• Critical 9.8
  CVE-2025-13184 Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password

  Toto Link · X5000R's (AX1800 router)

  EPSS 20%
• Critical 9.1
  CVE-2025-61808 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

  Adobe · ColdFusion

  EPSS 11%
• Critical 9.1
  CVE-2025-42928 Deserialization Vulnerability in SAP jConnect - SDK for ASE

  SAP_SE · SAP jConnect - SDK for ASE

  EPSS 9.5%
• Critical 9.8
  CVE-2025-14534 UTT 进取 512W Endpoint formNatStaticMap strcpy buffer overflow

  UTT · 进取 512W

  EPSS 5.7%
• Critical 9.8
  CVE-2025-14535 UTT 进取 512W formConfigFastDirectionW strcpy buffer overflow

  UTT · 进取 512W

  EPSS 5.6%
• Critical 9.9
  CVE-2025-42880 Code Injection vulnerability in SAP Solution Manager

  SAP_SE · SAP Solution Manager

  EPSS 4.5%
• Critical 9.3
  CVE-2025-66039 FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

  FreePBX · framework

  EPSS 3.4%
• Critical 9.3
  CVE-2021-47728 Selea Targa IP Camera Remote Code Execution via Utils

  Selea · Selea Targa IP OCR-ANPR Camera

  EPSS 2.6%
• Critical 9.8
  CVE-2025-11693 Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File

  Recorp · Export WordPress Pages to Static HTML & PDF — Static Site Export

  EPSS 2.1%
• Critical 9.7
  CVE-2025-67511 Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool

  aliasrobotics · cai

  EPSS 2%
• Critical 9.8
  CVE-2025-67506 PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload

  pipeshub-ai · pipeshub-ai

  EPSS 1.8%

All 124 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.7
  CVE-2025-8110 File overwrite in file update API in Gogs

  Gogs · Gogs

  EPSS 85%
• High 7.5
  CVE-2025-55184 Denial of Service Vulnerability in React Server Components

  Meta · react-server-dom-turbopack · react-server-dom-webpack · react-server-dom-parcel

  EPSS 67%
• Medium 5.3
  CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components

  Meta · react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack

  EPSS 64%
• High 8.8
  CVE-2025-14174 Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a cra…

  Google · Chrome

  EPSS 55%
• High 7.1
  CVE-2025-14611 Gladinet CentreStack and TrioFox Hard Coded AES Keys

  Gladinet · CentreStack and TrioFox

  EPSS 53%
• High 7.5
  CVE-2025-67779 Denial of Service Vulnerability in React Server Components

  Meta · react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack

  EPSS 20%
• High 7.0
  CVE-2025-53949 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0…

  Fortinet · FortiSandbox

  EPSS 17%
• Medium 6.9
  CVE-2025-53679 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0…

  Fortinet · FortiSandbox · FortiSandbox Cloud

  EPSS 12%