Week 15, 2025
7 April to 13 April 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 975CVEs publishedin the whole week
- 67CriticalCVSS 9.0 and above
- 430HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-53197
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Linux · Linux
ExploitedHigh7.8 - CVE-2024-53150
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
Linux · Linux
ExploitedHigh7.1 - CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded…
Gladinet · CentreStack
ExploitedCritical9.0 - CVE-2025-29824
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
CrushFTP · CrushFTP
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
haxtheweb · issues
Critical10.0 - CVE-2024-41794
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the…
Siemens · SENTRON 7KT PAC1260 Data Manager
Critical10.0 - CVE-2025-32461
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2,…
Tiki · Tiki
Critical9.9 - CVE-2025-27429
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
SAP_SE · SAP S/4HANA (Private Cloud)
Critical9.9 - CVE-2025-31330
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
SAP_SE · SAP Landscape Transformation (Analysis Platform)
Critical9.9 - CVE-2025-32579
WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability
SoftClever Limited · Sync Posts
Critical9.9 - CVE-2025-32140
WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability
Nirmal Kumar Ram · WP Remote Thumbnail
Critical9.9 - CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
langflow-ai · langflow
ExploitedCritical9.8 - CVE-2025-32375
Insecure Deserialization leads to RCE in BentoML's runner server
bentoml · BentoML
Critical9.8 - CVE-2025-3363
HGiga iSherlock - OS Command Injection
HGiga · iSherlock 4.5
Critical9.8