Week 23, 2025
2 June to 8 June 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 854CVEs publishedin the whole week
- 46CriticalCVSS 9.0 and above
- 225HighCVSS 7.0 to 8.9
- 9Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-5419
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2025-21479
Incorrect Authorization in Graphics
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.6 - CVE-2025-21480
Incorrect Authorization in Graphics Windows
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.6 - CVE-2025-27038
Use After Free in Graphics
Qualcomm, Inc. · Snapdragon
ExploitedHigh7.5 - CVE-2021-32030
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when…
Product not named
ExploitedCritical9.8 - CVE-2024-56145
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
craftcms · cms
ExploitedCritical9.3 - CVE-2023-39780
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE:…
ASUS · RT-AX55
ExploitedHigh8.8 - CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
ConnectWise · ScreenConnect
ExploitedHigh8.1 - CVE-2025-35939
Craft CMS stores user-provided content in session files
Craft · CMS
ExploitedMedium6.9
Most severe new CVEsBy CVSS score
- CVE-2025-45854
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.
JEHc · JEHC-BPM
Critical10.0 - CVE-2025-3322
Improper Neutralization of Special Elements in OnlineSuite
B. Braun Melsungen AG · OnlineSuite
Critical10.0 - CVE-2025-5597
WF Steuerungstechnik GmbH - airleader MASTER - Authentication Bypass
WF Steuerungstechnik GmbH · airleader MASTER
Critical10.0 - CVE-2025-49113
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not…
Roundcube · Webmail
ExploitedCritical9.9 - CVE-2025-20286
ISE on AWS Static Credential
Cisco · Cisco Identity Services Engine Software
Critical9.9 - CVE-2025-48780
Soar Cloud HRD Human Resource Management System - Deserialization of Untrusted Data
Soar Cloud System CO., LTD. · HRD Human Resource Management System
Critical9.9 - CVE-2025-48782
Soar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type
Soar Cloud System CO., LTD. · HRD Human Resource Management System
Critical9.9 - CVE-2025-44148
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component
Product not named
Critical9.8 - CVE-2025-41646
RevPi Webstatus application is vulnerable to an authentication bypass
Kunbus · Revolution Pi webstatus
Critical9.8 - CVE-2025-32105
A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution.
Product not named
Critical9.8