Week 1, 2025
30 December to 5 January 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 523CVEs publishedin the whole week
- 31CriticalCVSS 9.0 and above
- 131HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-3393
PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
Palo Alto Networks · Cloud NGFW
ExploitedHigh8.7
Most severe new CVEsBy CVSS score
- CVE-2024-56064
WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability
azzaroco · WP SuperBackup
Critical10.0 - CVE-2024-56829
Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element…
Product not named
Critical10.0 - CVE-2024-56046
WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability
VibeThemes · WPLMS
Critical10.0 - CVE-2024-56799
Simofa Allows Unauthenticated Access to API Routes
TrueWinter · simofa
Critical10.0 - CVE-2024-12828
Webmin CGI Command Injection Remote Code Execution Vulnerability
Webmin · Webmin
Critical9.9 - CVE-2024-12583
Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection
alexacrm · Dynamics 365 Integration
Critical9.9 - CVE-2024-11972
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
Unknown · Hunk Companion
Critical9.8 - CVE-2024-47919
Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Tiki Wiki · CMS
Critical9.8 - CVE-2024-13061
2100 Technology Electronic Official Document Management System - Authentication Bypass
2100 Technology Electronic · Official Document Management System
Critical9.8 - CVE-2024-56044
WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability
VibeThemes · WPLMS
Critical9.8