Week 17, 2025

Most severe new CVEsBy CVSS score

• CVE-2025-32432

  Craft CMS Allows Remote Code Execution

  craftcms · cms

  ExploitedCritical10.0
• CVE-2025-31324

  Missing Authorization check in SAP NetWeaver (Visual Composer development server)

  SAP_SE · SAP NetWeaver (Visual Composer development server)

  ExploitedCritical10.0
• CVE-2025-46616

  Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4,…

  Quantum · StorNext

  Critical9.9
• CVE-2025-46264

  WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability

  blubrry · PowerPress Podcasting

  Critical9.9
• CVE-2025-29659

  Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.

  Product not named

  Critical9.8
• CVE-2025-2907

  Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

  Unknown · Order Delivery Date

  Critical9.8
• CVE-2025-28036

  TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the…

  Product not named

  Critical9.8
• CVE-2025-28035

  TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the…

  Product not named

  Critical9.8
• CVE-2025-28034

  TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU…

  Product not named

  Critical9.8
• CVE-2025-29660

  A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input…

  Product not named

  Critical9.8