Week 26, 2025
23 June to 29 June 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 746CVEs publishedin the whole week
- 95CriticalCVSS 9.0 and above
- 234HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-54085
Redfish Authentication Bypass
AMI · MegaRAC-SPx
ExploitedCritical10.0 - CVE-2019-6693
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to…
Fortinet · FortiGate
ExploitedMedium6.5 - CVE-2024-0769
D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal
D-Link · DIR-859
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0 - CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and…
Product not named
ExploitedCritical10.0 - CVE-2025-34037
Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
Linksys · E4200
Critical10.0 - CVE-2025-20282
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
Critical10.0 - CVE-2025-34036
Shenzhen TVT CCTV-DVR Command Injection
Shenzhen TVT · CCTV-DVR
Critical10.0 - CVE-2025-34035
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
EnGenius · EnShare IoT Gigabit Cloud Service
Critical10.0 - CVE-2025-34040
Seeyon Zhiyuan OA System Path Traversal File Upload
Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) · Zhiyuan OA Web Application System
Critical10.0 - CVE-2025-34043
Vacron NVR Remote Command Execution
Vacron · Network Video Recorder (NVR)
Critical10.0 - CVE-2025-34041
Sangfor Endpoint Detection and Response OS Command Injection
Sangfor Technologies Co., Ltd. · Endpoint Detection and Response Platform
Critical10.0 - CVE-2025-52562
Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution
ConvoyPanel · panel
Critical10.0