Week 34, 2025

18 August to 24 August 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 867
Critical: 118
High: 329
Added to KEV: 2

Critical 118High 329Medium 400Low 19Not scored 1All 867 in the list

Added to KEVAttackers use these now; patch them first

CVE-2025-43300
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12,…
Apple · iOS and iPadOS
ExploitedCritical10.0
CVE-2025-54948
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute…
Trend Micro, Inc. · Trend Micro Apex One
ExploitedCritical9.4

Most severe new CVEsBy CVSS score

CVE-2025-43300
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12,…
Apple · iOS and iPadOS
ExploitedCritical10.0
CVE-2025-48148
WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability
StoreKeeper B.V. · StoreKeeper for WooCommerce
Critical10.0
CVE-2022-31491
Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run…
Product not named
Critical10.0
CVE-2025-50567
Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval)…
Product not named
Critical10.0
CVE-2025-49408
WordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure Vulnerability
WPDeveloper · Templately
Critical10.0
CVE-2025-49410
WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Imran Emu · TC Testimonials
Critical10.0
CVE-2025-53577
WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerability
thehp · Global DNS
Critical10.0
CVE-2025-48169
WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability
Jordy Meow · Code Engine
Critical9.9
CVE-2025-54049
WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability
miniOrange · Custom API for WP
Critical9.9
CVE-2025-53251
WordPress Pin WP theme < 7.2 - Arbitrary File Upload Vulnerability
An-Themes · Pin WP
Critical9.9

Week 34, 2025

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses