Week 13, 2025
24 March to 30 March 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,035CVEs publishedin the whole week
- 77CriticalCVSS 9.0 and above
- 341HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-2783
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a…
Google · Chrome
ExploitedHigh8.3 - CVE-2019-9874
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an…
Product not named
ExploitedCritical9.8 - CVE-2019-9875
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a…
Product not named
ExploitedHigh8.8 - CVE-2025-30154
Multiple Reviewdog actions were compromised during a specific time period
reviewdog · reviewdog
ExploitedHigh8.6
Most severe new CVEsBy CVSS score
- CVE-2025-2857
Incorrect handle could lead to sandbox escapes
Mozilla · Firefox
Critical10.0 - CVE-2025-30364
WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-30367
WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-28893
WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerability
Govind · Visual Text Editor
Critical9.9 - CVE-2025-26512
CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter
NetApp · SnapCenter
Critical9.9 - CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-1974
ingress-nginx admission controller RCE escalation
kubernetes · ingress-nginx
Critical9.8 - CVE-2025-2294
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
extendthemes · Kubio AI Page Builder
Critical9.8 - CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
Product not named
Critical9.8