Week 36, 2025
1 September to 7 September 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 992
- Critical
- 60
- High
- 336
- Added to KEV
- 7
Critical 60High 336Medium 554Low 42Not scored 0All 992 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Sitecore · Experience Manager (XM)
ExploitedCritical9.0 - CVE-2025-48543
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local…
Google · Android
ExploitedHigh8.8 - CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
Linux · Linux
ExploitedHigh7.8 - CVE-2025-9377
Authenticated RCE via Parental Control command injection
TP-Link Systems Inc. · Archer C7(EU) V2
ExploitedHigh8.6 - CVE-2023-50224
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link · TL-WR841N
ExploitedMedium6.5 - CVE-2020-24363
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset…
Product not named
ExploitedHigh8.8 - CVE-2025-55177
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…
Facebook · WhatsApp Desktop for Mac
ExploitedMedium5.4
Most severe new CVEsBy CVSS score
- CVE-2025-55190
Argo CD: Project API Token Exposes Repository Credentials
argoproj · argo-cd
Critical10.0 - CVE-2025-54914
Azure Networking Elevation of Privilege Vulnerability
Microsoft · Networking
Critical10.0 - CVE-2025-55241
Azure Entra ID Elevation of Privilege Vulnerability
Microsoft · Microsoft Entra
Critical10.0 - CVE-2025-58367
DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution
seperman · deepdiff
Critical10.0 - CVE-2025-58443
FOG's authentication bypass leads to full SQL DB dump
FOGProject · fogproject
Critical9.9 - CVE-2025-58371
Roo Code is vulnerable to command injection via GitHub actions workflow
RooCodeInc · Roo-Code
Critical9.9 - CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
Linux · Linux
ExploitedCritical9.8 - CVE-2024-28988
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
SolarWinds · Web Help Desk
Critical9.8 - CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
Sitecore · Sitecore Experience Manager (XM)
Critical9.8 - CVE-2025-6507
Deserialization of Untrusted Data in h2oai/h2o-3
h2oai · h2oai/h2o-3
Critical9.8