Week 22, 2025

Most severe new CVEsBy CVSS score

• CVE-2025-48827

  vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or…

  vBulletin · vBulletin

  Critical10.0
• CVE-2025-32440

  NetAlertX Vulnerable to Authentication Bypass

  jokob-sk · NetAlertX

  Critical10.0
• CVE-2025-48748

  Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.

  Product not named

  Critical10.0
• CVE-2025-35003

  Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.

  Apache Software Foundation · Apache NuttX RTOS

  Critical9.8
• CVE-2025-3357

  IBM Tivoli Monitoring code execution

  IBM · Tivoli Monitoring

  Critical9.8
• CVE-2025-4631

  Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint

  unitybusinesstechnology · The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis

  Critical9.8
• CVE-2025-45343

  An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the…

  Product not named

  Critical9.8
• CVE-2020-36846

  IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library

  TIMLEGGE · IO::Compress::Brotli

  Critical9.8
• CVE-2025-41651

  Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches

  Weidmueller · IE-SW-VL05M-5TX

  Critical9.8
• CVE-2025-4607

  PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function

  empoweringprowebsite · PSW Front-end Login & Registration

  Critical9.8