Week 28, 2025
7 July to 13 July 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,129CVEs publishedin the whole week
- 82CriticalCVSS 9.0 and above
- 434HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
NetScaler · ADC
ExploitedCritical9.3 - CVE-2014-3931
fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.
Product not named
ExploitedCritical9.8 - CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and…
Product not named
ExploitedCritical9.8 - CVE-2019-9621
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via…
Product not named
ExploitedHigh7.5 - CVE-2019-5418
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause…
Rails · https://github.com/rails/rails
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2025-47812
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session…
wftpserver · Wing FTP Server
ExploitedCritical10.0 - CVE-2025-34077
WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE
Genetech Solutions · WordPress Pie Register Plugin
Critical10.0 - CVE-2025-53624
docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
webbertakken · docusaurus-plugin-content-gists
Critical10.0 - CVE-2025-3499
Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector
Radiflow · iSAP Smart Collector
Critical10.0 - CVE-2025-7503
An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The…
Shenzhen Liandian Communication Technology LTD · V380 IP Camera / AppFHE1_V1.0.6.0
Critical10.0 - CVE-2025-41672
WAGO: Vulnerability in WAGO Device Sphere
WAGO · Wago Device Sphere
Critical10.0 - CVE-2025-42967
Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
SAP_SE · SAP S/4HANA and SAP SCM (Characteristic Propagation)
Critical9.9 - CVE-2025-3498
Unauthenticated modification of Radiflow iSAP Smart Collector configuration
Radiflow · iSAP Smart Collector
Critical9.9 - CVE-2025-49533
Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)
Adobe · Adobe Experience Manager (MS)
Critical9.8 - CVE-2020-36847
Simple File List < 4.2.3 - Remote Code Execution
eemitch · Simple File List
Critical9.8