Week 38, 2025

Most severe new CVEsBy CVSS score

• CVE-2025-10035

  Deserialization Vulnerability in GoAnywhere MFT's License Servlet

  Fortra · GoAnywhere MFT

  ExploitedCritical10.0
• CVE-2025-41243

  Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

  Spring · Cloud Gateway

  Critical10.0
• CVE-2025-52053

  TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This…

  Product not named

  Critical9.8
• CVE-2025-59304

  A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP…

  Product not named

  Critical9.8
• CVE-2025-59361

  OS command injection in Chaos Mesh via the cleanIptables mutation

  github.com/chaos-mesh/chaos-mesh

  Critical9.8
• CVE-2025-59359

  OS command injection in Chaos Mesh via the cleanTcs mutation

  github.com/chaos-mesh/chaos-mesh

  Critical9.8
• CVE-2025-59360

  OS command injection in Chaos Mesh via the killProcesses mutation

  github.com/chaos-mesh/chaos-mesh

  Critical9.8
• CVE-2025-57174

  An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The…

  Product not named

  Critical9.8
• CVE-2025-59340

  jinjava Sandbox Bypass via JavaType-Based Deserialization

  HubSpot · jinjava

  Critical9.8
• CVE-2025-31255

  An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS…

  Apple · iOS and iPadOS

  Critical9.8