Week 3, 2025
13 January to 19 January 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,287CVEs publishedin the whole week
- 142CriticalCVSS 9.0 and above
- 534HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-50603
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS…
Aviatrix · Controller
ExploitedCritical10.0 - CVE-2024-55591
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0…
Fortinet · FortiOS
ExploitedCritical9.6 - CVE-2025-21334
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 21H2
ExploitedHigh7.8 - CVE-2025-21333
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 21H2
ExploitedHigh7.8 - CVE-2025-21335
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 21H2
ExploitedHigh7.8 - CVE-2023-48365
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP…
Product not named
ExploitedCritical9.6 - CVE-2024-12686
Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)
ExploitedMedium6.6
Most severe new CVEsBy CVSS score
- CVE-2024-39760
Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-34166
An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-36258
A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-39761
Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-39759
Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-39608
A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-36290
A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2024-39754
A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to…
Wavlink · Wavlink AC3000
Critical10.0 - CVE-2025-23922
WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability
Harsh · iSpring Embedder
Critical10.0 - CVE-2025-23202
Improper Input Validation in Bible Module for ROBLOX
devycreates · Bible-Module
Critical10.0