Week 2, 2025
6 January to 12 January 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,039CVEs publishedin the whole week
- 101CriticalCVSS 9.0 and above
- 283HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-0282
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA…
Ivanti · Connect Secure
ExploitedCritical9.0 - CVE-2020-2883
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0,…
Oracle Corporation · WebLogic Server
ExploitedCritical9.8 - CVE-2024-41713
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to…
Product not named
ExploitedCritical9.1 - CVE-2024-55550
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input…
Product not named
ExploitedMedium4.4
Most severe new CVEsBy CVSS score
- CVE-2024-50603
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS…
Aviatrix · Controller
ExploitedCritical10.0 - CVE-2025-22133
WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)
nilsonLazarin · WeGIA
Critical10.0 - CVE-2024-43243
WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability
themeglow · JobBoard Job listing
Critical10.0 - CVE-2025-22504
WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability
jumpdemand · 4ECPS Web Forms
Critical10.0 - CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
Apache Software Foundation · Apache OpenMeetings
Critical9.8 - CVE-2024-55556
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by…
Product not named
Critical9.8 - CVE-2024-12847
NETGEAR DGN setup.cgi OS Command Injection
NETGEAR · DGN1000
Critical9.8 - CVE-2025-0247
Memory safety bugs fixed in Firefox 134 and Thunderbird 134
Mozilla · Firefox
Critical9.8 - CVE-2024-11613
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
nickboss · Iptanus File Upload
Critical9.8 - CVE-2024-12252
SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)
seobeginner · SEO LAT Auto Post
Critical9.8