Week 10, 2025
3 March to 9 March 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 951CVEs publishedin the whole week
- 103CriticalCVSS 9.0 and above
- 349HighCVSS 7.0 to 8.9
- 9Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-22224
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…
VMware · ESXi
ExploitedCritical9.3 - CVE-2025-22225
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading…
VMware ESXi
ExploitedHigh8.2 - CVE-2025-22226
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with…
ESXi
ExploitedHigh7.1 - CVE-2024-50302
HID: core: zero-initialize the report buffer
Linux · Linux
ExploitedMedium5.5 - CVE-2024-4885
WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
Progress Software Corporation · WhatsUp Gold
ExploitedCritical9.8 - CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara · Pentaho Business Analytics Server
ExploitedHigh8.8 - CVE-2022-43939
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
Hitachi Vantara · Pentaho Business Analytics Server
ExploitedHigh8.6 - CVE-2018-8639
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of…
Microsoft · Windows 7
ExploitedHigh8.4 - CVE-2023-20118
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an…
Cisco · Cisco Small Business RV Series Router Firmware
ExploitedMedium6.5
Most severe new CVEsBy CVSS score
- CVE-2024-50704
Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially…
Product not named
Critical10.0 - CVE-2024-50707
Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the…
Product not named
Critical10.0 - CVE-2025-26970
WordPress Ark Theme Core plugin < 1.71.0 - Unauthenticated Remote Code Execution (RCE) vulnerability
FRESHFACE · Ark Theme Core
Critical10.0 - CVE-2025-1864
Buffer Overflow and Potential Code Execution in Radare2
radareorg · radare2
Critical10.0 - CVE-2025-1866
Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets
warmcat · libwebsockets
Critical10.0 - CVE-2024-12799
Insufficiently Protected Credentials
OpenText · Identity Manager Advanced Edition
Critical10.0 - CVE-2025-1867
HTTP Response Smuggling Vulnerability in libhv
ithewei · libhv
Critical10.0 - CVE-2025-25015
Kibana arbitrary code execution via prototype pollution
Elastic · Kibana
Critical9.9 - CVE-2025-26319
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
Product not named
Critical9.8 - CVE-2025-1307
Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
spicethemes · Newscrunch
Critical9.8