Week 35, 2025
25 August to 31 August 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 820
- Critical
- 109
- High
- 230
- Added to KEV
- 5
Critical 109High 230Medium 458Low 23Not scored 0All 820 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
FreePBX · endpoint
ExploitedCritical10.0 - CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
NetScaler · ADC
ExploitedCritical9.2 - CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
git · git
ExploitedHigh8.1 - CVE-2024-8069
Limited remote code execution with privilege of a NetworkService Account access
Citrix Session Recording · Citrix Session Recording
ExploitedMedium5.1 - CVE-2024-8068
Privilege escalation to NetworkService Account access
Citrix · Citrix Session Recording
ExploitedMedium5.1
Most severe new CVEsBy CVSS score
- CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
FreePBX · endpoint
ExploitedCritical10.0 - CVE-2024-13985
Dahua EIMS capture_handle.action RCE
Zhejiang Dahua Technology Co., Ltd. · EIMS
Critical10.0 - CVE-2018-25115
D-Link DIR-110/412/600/615/645/815 RCE via service.cgi
D-Link · DIR-110
Critical10.0 - CVE-2009-20011
ContentKeeper Web Appliance < 125.10 RCE via mimencode
ContentKeeper Technologies · ContentKeeper Web Appliance
Critical10.0 - CVE-2010-10016
BS.Player 2.57 Buffer Overflow via M3U Playlist Import
BS.Player · BS.Player Free and Pro Editions
Critical10.0 - CVE-2024-13980
H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
H3C Group · Intelligent Management Center (iMC)
Critical10.0 - CVE-2024-13981
LiveBos UploadFile.do Arbitrary File Upload
Fujian Apex Software Co. Ltd. · LiveBOS
Critical10.0 - CVE-2023-7309
Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload
Zhejiang Dahua Technology Co., Ltd. · Smart Park Integrated Management Platform
Critical10.0 - CVE-2025-34160
AnyShare ServiceAgent API Unauthenticated RCE
Shanghai Aishu Information Technology Co., Ltd. · AnyShare
Critical10.0 - CVE-2024-13984
Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload
Qi'anxin · TianQing Management Center
Critical10.0