Week 14, 2025
31 March to 6 April 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,378CVEs publishedin the whole week
- 138CriticalCVSS 9.0 and above
- 364HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-22457
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before…
Ivanti · Connect Secure
ExploitedCritical9.0 - CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Software Foundation · Apache Tomcat
ExploitedCritical10.0 - CVE-2024-20439
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static…
Cisco · Cisco Smart License Utility
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2025-30065
Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Apache Software Foundation · Apache Parquet Java
Critical10.0 - CVE-2021-47667
An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute…
Zend · ZendTo
Critical10.0 - CVE-2025-2071
OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI
FAST LTA · FAST LTA Silent Brick WebUI
Critical10.0 - CVE-2025-30580
WordPress DigiWidgets Image Editor plugin <= 1.10 - Remote Code Execution (RCE) Vulnerability
kellydiek · DigiWidgets Image Editor
Critical10.0 - CVE-2025-2945
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
pgadmin.org · pgAdmin 4
Critical9.9 - CVE-2025-30911
WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability
Rometheme · RTMKit
Critical9.9 - CVE-2025-30841
WordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerability
adamskaat · Countdown & Clock
Critical9.9 - CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-56325
Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
Apache Software Foundation · Apache Pinot
Critical9.8 - CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
bentoml · BentoML
Critical9.8