Week 24, 2025
9 June to 15 June 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 924CVEs publishedin the whole week
- 70CriticalCVSS 9.0 and above
- 309HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-24016
Remote code execution in Wazuh server
wazuh · wazuh
ExploitedCritical9.9 - CVE-2025-33053
Internet Shortcut Files Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh8.8 - CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
erlang · otp
ExploitedCritical10.0 - CVE-2024-42009
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a…
Product not named
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2025-29902
Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.
Telex · Remote Dispatch Console Server
Critical10.0 - CVE-2025-49013
WilderForge vulnerable to code Injection via GitHub Actions Workflows
WilderForge · WilderForge
Critical10.0 - CVE-2025-32291
WordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerability
FantasticPlugins · SUMO Affiliates Pro
Critical10.0 - CVE-2025-48123
WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability
Holest Engineering · Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
Critical10.0 - CVE-2025-30220
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
geoserver · geoserver
Critical9.9 - CVE-2025-1041
Avaya Call Management System RCE vulnerability
Avaya · Avaya Call Management System
Critical9.9 - CVE-2025-48140
WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability
metalpriceapi · MetalpriceAPI
Critical9.9 - CVE-2025-45988
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and…
Product not named
Critical9.8 - CVE-2025-45985
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and…
Product not named
Critical9.8 - CVE-2025-45987
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and…
Product not named
Critical9.8