Week 8, 2025
17 February to 23 February 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 596CVEs publishedin the whole week
- 54CriticalCVSS 9.0 and above
- 162HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-24989
Microsoft Power Pages Elevation of Privilege Vulnerability
Microsoft · Microsoft Power Pages
ExploitedHigh8.2 - CVE-2025-23209
Potential RCE with a compromised security key in craft/cms
craftcms · cms
ExploitedHigh8.1 - CVE-2025-0111
PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
Palo Alto Networks · Cloud NGFW
ExploitedHigh7.1 - CVE-2025-0108
PAN-OS: Authentication Bypass in the Management Web Interface
Palo Alto Networks · Cloud NGFW
ExploitedHigh8.8 - CVE-2024-53704
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
SonicWall · SonicOS
ExploitedHigh8.2
Most severe new CVEsBy CVSS score
- CVE-2025-26613
OS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-22654
WordPress Simplified Plugin Plugin <= 1.0.6 - Arbitrary File Upload vulnerability
kodeshpa · Simplified
Critical10.0 - CVE-2025-26615
Path Traversal endpoint 'examples.php' parameter 'src' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-26616
Path Traversal endpoint 'exportar_dump.php' parameter 'file' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-26776
WordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerability
NotFound · Chaty Pro
Critical10.0 - CVE-2025-26606
SQL Injection endpoint 'informacao_adicional.php' parameter 'id_descricao' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-26607
SQL Injection endpoint 'documento_excluir.php' parameter 'id_funcionario' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-26608
SQL Injection endpoint 'dependente_docdependente.php' parameter 'id_dependente', 'id_doc' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-26609
SQL Injection endpoint 'familiar_docfamiliar.php' parameter 'id_dependente', 'id_doc' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-26617
SQL Injection endpoint 'historico_paciente.php' parameter 'id_fichamedica' in WeGIA
LabRedesCefetRJ · WeGIA
Critical10.0