Week 25, 2025
16 June to 22 June 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,051CVEs publishedin the whole week
- 69CriticalCVSS 9.0 and above
- 338HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-0386
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS…
Kernel
ExploitedHigh7.8 - CVE-2023-33538
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component…
Product not named
ExploitedHigh8.8 - CVE-2025-43200
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS…
Apple · iOS and iPadOS
ExploitedMedium4.2
Most severe new CVEsBy CVSS score
- CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
pterodactyl · panel
Critical10.0 - CVE-2025-34030
sar2html OS Command Injection
sar2html · sar2html
Critical10.0 - CVE-2025-49071
WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability
NasaTheme · Flozen
Critical10.0 - CVE-2025-32510
WordPress Ovatheme Events Manager plugin <= 1.8.4 - Arbitrary File Upload vulnerability
ovatheme · Ovatheme Events Manager
Critical10.0 - CVE-2025-49444
WordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerability
merkulove · Reformer for Elementor
Critical10.0 - CVE-2025-49447
WordPress FW Food Menu <= 6.0.0 - Arbitrary File Upload Vulnerability
Fastw3b LLC · FW Food Menu
Critical10.0 - CVE-2025-23121
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user
Veeam · Backup and Recovery
Critical9.9 - CVE-2025-4981
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Mattermost · Mattermost
Critical9.9 - CVE-2025-46157
An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form
Product not named
Critical9.9 - CVE-2025-47559
WordPress MapSVG plugin < 8.7.4 - Arbitrary File Upload vulnerability
RomanCode · MapSVG
Critical9.9