Week 11, 2025
10 March to 16 March 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 769CVEs publishedin the whole week
- 52CriticalCVSS 9.0 and above
- 330HighCVSS 7.0 to 8.9
- 13Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-24201
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS…
Apple · Safari
ExploitedCritical10.0 - CVE-2025-21590
Junos OS: An local attacker with shell access can execute arbitrary code
Juniper Networks · Junos OS
ExploitedMedium6.7 - CVE-2025-24993
Windows NTFS Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2025-24985
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2025-26633
Microsoft Management Console Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.0 - CVE-2025-24983
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.0 - CVE-2025-24991
Windows NTFS Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedMedium5.5 - CVE-2025-24984
Windows NTFS Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedMedium4.6 - CVE-2024-57968
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web…
Advantive · VeraCore
ExploitedCritical9.9 - CVE-2024-13159
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
Ivanti · Endpoint Manager
ExploitedCritical9.8 - CVE-2024-13160
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
Ivanti · Endpoint Manager
ExploitedCritical9.8 - CVE-2024-13161
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
Ivanti · Endpoint Manager
ExploitedCritical9.8 - CVE-2025-25181
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the…
Advantive · VeraCore
ExploitedMedium5.8
Most severe new CVEsBy CVSS score
- CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Software Foundation · Apache Tomcat
ExploitedCritical10.0 - CVE-2024-54085
Redfish Authentication Bypass
AMI · MegaRAC-SPx
ExploitedCritical10.0 - CVE-2025-24201
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS…
Apple · Safari
ExploitedCritical10.0 - CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
Koha · Koha
Critical10.0 - CVE-2025-26936
WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerability
FRESHFACE · Fresh Framework
Critical10.0 - CVE-2025-26701
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root,…
Percona · Monitoring and Management
Critical10.0 - CVE-2025-1661
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
realmag777 · HUSKY – Products Filter Professional for WooCommerce
Critical9.8 - CVE-2025-29384
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary…
Product not named
Critical9.8 - CVE-2025-2263
Santesoft Sante PACS Server Stack-based Buffer Overflow
Santesoft · Sante PACS Server
Critical9.8 - CVE-2025-29386
In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code…
Product not named
Critical9.8