Week 39, 2025
22 September to 28 September 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,061
- Critical
- 46
- High
- 257
- Added to KEV
- 3
Critical 46High 257Medium 726Low 32Not scored 0All 1,061 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-20333
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD)…
Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
ExploitedCritical9.9 - CVE-2025-20362
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases…
Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
ExploitedMedium6.5 - CVE-2025-10585
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2025-59528
Flowise has Remote Code Execution vulnerability
FlowiseAI · Flowise
Critical10.0 - CVE-2025-9962
Unauthenticated Buffer Overflow
Novakon · P series (P07, P10, P12, P15)
Critical10.0 - CVE-2025-9588
OS Command Injection in Iron Mountain's enVision
Iron Mountain Archiving Services Inc. · enVision
Critical10.0 - CVE-2025-9846
Unrestricted File Upload in TaletSys Inka.Net
TalentSys Consulting Information Technology Industry Inc. · Inka.Net
Critical10.0 - CVE-2025-58384
In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc…
Product not named
Critical10.0 - CVE-2025-60219
WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability
HaruTheme · WooCommerce Designer Pro
Critical10.0 - CVE-2025-20333
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD)…
Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
ExploitedCritical9.9 - CVE-2025-59823
Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning
gardener · gardener-extension-provider-aws
Critical9.9 - CVE-2025-55187
In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.
Product not named
Critical9.9 - CVE-2025-59832
Horrila Stored XSS Vulnerability via Ticket Comment section
horilla-opensource · horilla
Critical9.9