Week 16, 2025
14 April to 20 April 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,195CVEs publishedin the whole week
- 108CriticalCVSS 9.0 and above
- 477HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-31200
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1,…
Apple · iOS and iPadOS
ExploitedCritical9.8 - CVE-2025-31201
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS…
Apple · iOS and iPadOS
ExploitedCritical9.8 - CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedMedium6.5 - CVE-2021-20035
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a…
SonicWall · SMA100
ExploitedMedium6.5
Most severe new CVEsBy CVSS score
- CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
erlang · otp
ExploitedCritical10.0 - CVE-2025-32445
Users can gain privileged access to the host system and cluster with EventSource and Sensor CR
argoproj · argo-events
Critical10.0 - CVE-2025-26927
WordPress AI Hub plugin <= 1.3.7 - Arbitrary File Upload vulnerability
LiquidThemes · AI Hub
Critical10.0 - CVE-2025-22021
netfilter: socket: Lookup orig tuple for IPv6 SNAT
Linux · Linux
Critical10.0 - CVE-2025-32660
WordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerability
JoomSky · JS Job Manager
Critical10.0 - CVE-2025-32583
WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability
termel · PDF 2 Post
Critical9.9 - CVE-2025-32682
WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability
RomanCode · MapSVG
Critical9.9 - CVE-2025-1782
Unsanitized input in language form field
ifax · HylaFAX
Critical9.9 - CVE-2025-27282
WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Upload vulnerability
rockgod100 · Theme File Duplicator
Critical9.9 - CVE-2025-31340
Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program
SUNNET Technology Co., Ltd. · Wisdom Master Pro
Critical9.9