Week 29, 2025
14 July to 20 July 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 779CVEs publishedin the whole week
- 89CriticalCVSS 9.0 and above
- 231HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8 - CVE-2025-25257
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through…
Fortinet · FortiWeb
ExploitedCritical9.6 - CVE-2025-47812
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session…
wftpserver · Wing FTP Server
ExploitedCritical10.0
Most severe new CVEsBy CVSS score
- CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0 - CVE-2025-34300
Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE
Sawtooth Software · Lighthouse Studio
Critical10.0 - CVE-2025-53833
LaRecipe is vulnerable to Server-Side Template Injection attacks
saleem-hadad · larecipe
Critical10.0 - CVE-2025-34112
Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE
Riverbed Technology · SteelCentral NetExpress
Critical10.0 - CVE-2025-34105
DiskBoss Enterprise Stack-Based Buffer Overflow RCE
Flexense · DiskBoss Enterprise
Critical10.0 - CVE-2025-53836
XWiki Rendering is vulnerable to RCE attacks when processing nested macros
xwiki · xwiki-rendering
Critical10.0 - CVE-2025-29009
WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload Vulnerability
Webkul · Medical Prescription Attachment Plugin for WooCommerce
Critical10.0 - CVE-2025-53823
WeGIA vulnerable to SQL Injection (Blind Time-Based) in `processa_deletar_socio.php` parameter `id_socio`
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-49746
Azure Machine Learning Elevation of Privilege Vulnerability
Microsoft · Azure Machine Learning
Critical9.9 - CVE-2025-49747
Azure Machine Learning Elevation of Privilege Vulnerability
Microsoft · Azure Machine Learning
Critical9.9