Week 12, 2025
17 March to 23 March 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 799CVEs publishedin the whole week
- 87CriticalCVSS 9.0 and above
- 316HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-1316
Edimax IC-7100 IP Camera OS Command Injection
Edimax · IC-7100 IP Camera
ExploitedCritical9.3 - CVE-2024-48248
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code…
NAKIVO · Backup & Replication Director
ExploitedHigh8.6 - CVE-2017-12637
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers…
Product not named
ExploitedHigh7.5 - CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on…
tj-actions · changed-files
ExploitedHigh8.6 - CVE-2025-24472
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12,…
Fortinet · FortiOS
ExploitedHigh8.1
Most severe new CVEsBy CVSS score
- CVE-2024-10442
Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified…
Synology · Unified Controller (DSMUC)
Critical10.0 - CVE-2024-12909
SQL Injection to RCE in run-llama/llama_index
run-llama · run-llama/llama_index
Critical10.0 - CVE-2024-56346
IBM AIX command execution
IBM · AIX
Critical10.0 - CVE-2025-26853
DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.
Descor · Infocad FM
Critical10.0 - CVE-2025-26852
DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.
Descor · Infocad FM
Critical10.0 - CVE-2025-23120
A vulnerability allowing remote code execution (RCE) for domain users.
Veeam · Backup and Recovery
Critical9.9 - CVE-2024-12029
Remote Code Execution via Model Deserialization in invoke-ai/invokeai
invoke-ai · invoke-ai/invokeai
Critical9.8 - CVE-2025-2505
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
philsbury · Age Gate
Critical9.8 - CVE-2024-8502
Remote Code Execution via Deserialization in modelscope/agentscope
modelscope · modelscope/agentscope
Critical9.8 - CVE-2024-11041
Remote Code Execution in vllm-project/vllm
vllm-project · vllm-project/vllm
Critical9.8