Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 37, 2025

8 September to 14 September 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
837
Critical
74
High
299
Added to KEV
1

Critical 74High 299Medium 434Low 30Not scored 0All 837 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2025-5086

    Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

    Dassault Systèmes · DELMIA Apriso

    ExploitedCritical9.0

Most severe new CVEsBy CVSS score

  • CVE-2025-54261

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    Adobe · ColdFusion

    Critical10.0
  • CVE-2025-42944

    Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

    SAP_SE · SAP Netweaver (RMI-P4)

    Critical10.0
  • CVE-2025-58321

    DIALink - Directory Traversal Authentication Bypass Vulnerability

    Delta Electronics · DIALink

    Critical10.0
  • CVE-2025-55727

    XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro

    xwikisas · xwiki-pro-macros

    Critical10.0
  • CVE-2025-55728

    XWiki Remote Macros vulnerable to remote code execution using the panel macro

    xwikisas · xwiki-pro-macros

    Critical10.0
  • CVE-2025-58745

    WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)

    LabRedesCefetRJ · WeGIA

    Critical10.0
  • CVE-2025-55730

    XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro

    xwikisas · xwiki-pro-macros

    Critical10.0
  • CVE-2025-55729

    XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro

    xwikisas · xwiki-pro-macros

    Critical10.0
  • CVE-2025-10264

    Digiever｜NVR - Exposure of Sensitive Information

    Digiever · DS-1200

    Critical10.0
  • CVE-2025-55051

    CWE-1392: Use of Default Credentials

    Baicells · NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846

    Critical10.0

Vendors with the most CVEs

  1. Microsoft86
  2. Linux61
  3. Adobe22
  4. SAP_SE20
  5. SourceCodester18
  6. Liferay17
  7. PHPGurukul14
  8. Ivanti13
  9. IBM9
  10. Rockwell Automation9

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)118
  2. CWE-89 SQL injection73
  3. CWE-74 Injection54
  4. CWE-94 Code injection43
  5. CWE-862 Missing authorization41
  6. CWE-416 Use after free32
  7. CWE-352 Cross-site request forgery (CSRF)25
  8. CWE-125 Out-of-bounds read23
  9. CWE-918 Server-side request forgery (SSRF)22
  10. CWE-121 Stack-based buffer overflow21