Week 27, 2025
30 June to 6 July 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 630CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 230HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-6554
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium…
Google · Chrome
ExploitedHigh8.1 - CVE-2025-48927
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…
TeleMessage · service
ExploitedMedium5.3 - CVE-2025-48928
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password…
TeleMessage · service
ExploitedMedium4.0 - CVE-2025-6543
Memory overflow vulnerability leading to unintended control flow and Denial of Service
NetScaler · ADC
ExploitedCritical9.2
Most severe new CVEsBy CVSS score
- CVE-2025-34067
Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson
Hikvision · Integrated Security Management Platform
Critical10.0 - CVE-2025-41656
Pilz: Missing Authentication in Node-RED integration
Pilz · IndustrialPI 4 with Firmware Bullseye
Critical10.0 - CVE-2025-34073
stamparm/maltrail <=0.54 Remote Command Execution
Stamparm · Maltrail
Critical10.0 - CVE-2025-34054
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
AVTECH · IP camera, DVR, and NVR Devices
Critical10.0 - CVE-2025-20309
Cisco Unified Communications Manager Static SSH Credentials Vulnerability
Cisco · Cisco Unified Communications Manager
Critical10.0 - CVE-2025-34060
Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery
Monero Project · Forum
Critical10.0 - CVE-2025-34070
GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces
GFI Software · Kerio Control
Critical10.0 - CVE-2025-34063
OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key
One Identity · OneLogin Active Directory Connector (ADC)
Critical10.0 - CVE-2025-49302
WordPress Easy Stripe plugin <= 1.1 - Remote Code Execution (RCE) Vulnerability
Scott Paterson · Easy Stripe
Critical10.0 - CVE-2025-30933
WordPress LogisticsHub theme <= 1.1.6 - Arbitrary File Upload Vulnerability
LiquidThemes · LogisticsHub
Critical10.0