Week 44, 2025
27 October to 2 November 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 967CVEs publishedin the whole week
- 71CriticalCVSS 9.0 and above
- 315HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
xwiki · xwiki-platform
ExploitedCritical9.8 - CVE-2025-41244
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
VMware · VCF operations
ExploitedHigh7.8 - CVE-2025-6205
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedCritical9.1 - CVE-2025-6204
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedHigh8.0
Most severe new CVEsBy CVSS score
- CVE-2025-64095
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
dnnsoftware · Dnn.Platform
Critical10.0 - CVE-2025-52665
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a…
Ubiquiti Inc · UniFi Access Application
Critical10.0 - CVE-2025-48983
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an…
Veeam · Backup and Replication
Critical10.0 - CVE-2025-12422
Vulnerable Upgrade Feature (Arbitrary File Write)
Azure Access Technology · BLU-IC2
Critical10.0 - CVE-2025-12599
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)
Azure Access Technology · BLU-IC2
Critical10.0 - CVE-2025-12600
Web UI Malfunction
Azure Access Technology · BLU-IC2
Critical10.0 - CVE-2025-12516
Lack of Graceful Error Handling - HTTP 5xx Error
Azure Access Technology · BLU-IC2
Critical10.0 - CVE-2025-12515
Systemic Internal Server Errors - HTTP 500 Response
Azure Access Technology · BLU-IC2
Critical10.0 - CVE-2025-29270
Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin…
Product not named
Critical10.0 - CVE-2025-12477
Server Version Disclosure
Azure Access Technology · BLU-IC2
Critical10.0