Week 37, 2025
8 September to 14 September 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 837CVEs publishedin the whole week
- 74CriticalCVSS 9.0 and above
- 299HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-5086
Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedCritical9.0
Most severe new CVEsBy CVSS score
- CVE-2025-54261
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe · ColdFusion
Critical10.0 - CVE-2025-42944
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
SAP_SE · SAP Netweaver (RMI-P4)
Critical10.0 - CVE-2025-58321
DIALink - Directory Traversal Authentication Bypass Vulnerability
Delta Electronics · DIALink
Critical10.0 - CVE-2025-55727
XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro
xwikisas · xwiki-pro-macros
Critical10.0 - CVE-2025-55728
XWiki Remote Macros vulnerable to remote code execution using the panel macro
xwikisas · xwiki-pro-macros
Critical10.0 - CVE-2025-58745
WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-55730
XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro
xwikisas · xwiki-pro-macros
Critical10.0 - CVE-2025-55729
XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro
xwikisas · xwiki-pro-macros
Critical10.0 - CVE-2025-10264
Digiever｜NVR - Exposure of Sensitive Information
Digiever · DS-1200
Critical10.0 - CVE-2025-55051
CWE-1392: Use of Default Credentials
Baicells · NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
Critical10.0