Week 19, 2025
5 May to 11 May 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 923CVEs publishedin the whole week
- 80CriticalCVSS 9.0 and above
- 278HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-11120
GeoVision EOL devices - OS Command Injection
GeoVision · GV-VS12
ExploitedCritical9.8 - CVE-2024-6047
GeoVision EOL device - OS Command Injection
GeoVision · GV_DSP_LPR_V2
ExploitedCritical9.8 - CVE-2025-27363
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph…
FreeType · FreeType
ExploitedHigh8.1 - CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
langflow-ai · langflow
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2025-20188
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE…
Cisco · Cisco IOS XE Software
Critical10.0 - CVE-2025-29813
Azure DevOps Elevation of Privilege Vulnerability
Microsoft · Azure DevOps
Critical10.0 - CVE-2024-11186
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-prem
Arista Networks · CloudVision Portal
Critical10.0 - CVE-2025-0505
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state
Arista Networks · CloudVision Portal
Critical10.0 - CVE-2025-46828
Unauthenticated SQL Injection on get_socios.php endpoint
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-47419
Non-Secure Access
Crestron · Automate VX
Critical10.0 - CVE-2025-29972
Azure Storage Resource Provider Spoofing Vulnerability
Microsoft · Azure Storage Resource Provider (SRP)
Critical9.9 - CVE-2025-29827
Azure Automation Elevation of Privilege Vulnerability
Microsoft · Azure Automation
Critical9.9 - CVE-2025-3605
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
arkenon · Login, Registration and Lost Password Blocks
Critical9.8 - CVE-2025-4403
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
glenwpcoder · Drag and Drop Multiple File Upload for WooCommerce
Critical9.8