Week 18, 2025
28 April to 4 May 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 877CVEs publishedin the whole week
- 48CriticalCVSS 9.0 and above
- 232HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-34028
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
Commvault · Command Center Innovation Release
ExploitedCritical9.3 - CVE-2024-58136
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in…
yiiframework · Yii
ExploitedCritical9.0 - CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Apache Software Foundation · Apache HTTP Server
ExploitedCritical9.1 - CVE-2023-44221
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to…
SonicWall · SMA100
ExploitedHigh7.2 - CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
SAP_SE · SAP NetWeaver (Visual Composer development server)
ExploitedCritical10.0 - CVE-2025-42599
Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and…
QUALITIA CO., LTD. · Active! mail 6
ExploitedCritical9.8 - CVE-2025-3928
Commvault Web Server unspecified vulnerability
Commvault · Web Server
ExploitedHigh8.7 - CVE-2025-1976
Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6
Brocade · Fabric OS
ExploitedHigh8.6
Most severe new CVEsBy CVSS score
- CVE-2025-32444
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
vllm-project · vllm
Critical10.0 - CVE-2025-46661
IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions,…
IPW · Metazo
Critical10.0 - CVE-2025-46337
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
ADOdb · ADOdb
Critical10.0 - CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
YesWiki · yeswiki
Critical10.0 - CVE-2025-2605
Authenticated command injection
Honeywell · MB-Secure
Critical9.9 - CVE-2015-2079
Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form…
Usermin · Usermin
Critical9.9 - CVE-2025-30390
Azure ML Compute Elevation of Privilege Vulnerability
Microsoft · Azure Machine Learning
Critical9.9 - CVE-2025-27007
WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
Brainstorm Force · OttoKit
Critical9.8 - CVE-2025-31651
Apache Tomcat: Bypass of rules in Rewrite Valve
Apache Software Foundation · Apache Tomcat
Critical9.8 - CVE-2025-44868
Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This…
Product not named
Critical9.8