Week 7, 2025
10 February to 16 February 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 945CVEs publishedin the whole week
- 71CriticalCVSS 9.0 and above
- 378HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-57727
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to…
Product not named
ExploitedCritical9.1 - CVE-2024-41710
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could…
Product not named
ExploitedMedium6.8 - CVE-2025-24200
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS…
Apple · iOS and iPadOS
ExploitedMedium6.1 - CVE-2024-40891
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A…
Zyxel · VMG4325-B10A firmware
ExploitedHigh8.8 - CVE-2024-40890
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware…
Zyxel · VMG4325-B10A firmware
ExploitedHigh8.8 - CVE-2025-21418
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2025-21391
Windows Storage Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.1
Most severe new CVEsBy CVSS score
- CVE-2025-24865
mySCADA myPRO Manager Missing Authentication for Critical Function
mySCADA · myPRO Manager
Critical10.0 - CVE-2025-26793
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom,…
Hirsch · Enterphone MESH
Critical10.0 - CVE-2024-13152
SQLi in BSS Software's Mobuy Online Machinery Monitoring Panel
BSS Software · Mobuy Online Machinery Monitoring Panel
Critical10.0 - CVE-2025-24016
Remote code execution in Wazuh server
wazuh · wazuh
ExploitedCritical9.9 - CVE-2025-22467
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution.
Ivanti · Connect Secure
Critical9.9 - CVE-2025-22630
WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability
Marketing Fire · Widget Options
Critical9.9 - CVE-2024-10960
Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads
themefusecom · Brizy – Page Builder
Critical9.9 - CVE-2025-0867
Privilege Escalation in MEAC300
SICK AG · SICK MEAC300
Critical9.9 - CVE-2025-1044
Logsign Unified SecOps Platform Authentication Bypass Vulnerability
Logsign · Unified SecOps Platform
Critical9.8 - CVE-2022-3180
WPGateway <= 3.5 - Unauthenticated Privilege Escalation
Jack Hopman · WPGateway
Critical9.8