Week 41, 2025
6 October to 12 October 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 861
- Critical
- 56
- High
- 234
- Added to KEV
- 9
Critical 56High 234Medium 525Low 46Not scored 0All 861 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2021-43798
Grafana path traversal
grafana · grafana
ExploitedHigh7.5 - CVE-2025-27915
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client…
Product not named
ExploitedMedium5.4 - CVE-2025-61882
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are…
Oracle Corporation · Oracle Concurrent Processing
ExploitedCritical9.8 - CVE-2010-3765
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when…
Product not named
ExploitedCritical9.8 - CVE-2013-3918
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows…
Product not named
ExploitedHigh8.8 - CVE-2011-3402
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003…
Product not named
ExploitedHigh8.8 - CVE-2021-22555
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
Linux Kernel
ExploitedHigh8.3 - CVE-2010-3962
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading…
Product not named
ExploitedHigh8.1 - CVE-2021-43226
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2025-61913
Flowise is vulnerable to arbitrary file read, arbitrary file write
FlowiseAI · Flowise
Critical10.0 - CVE-2025-10363
Unauthenticated RCE via .NET Deserialization in Topal Finance Software
Topal Solutions AG · Topal Finanzbuchhaltung
Critical10.0 - CVE-2025-44823
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a…
Nagios · Log Server
Critical9.9 - CVE-2025-60957
OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary…
Product not named
Critical9.9 - CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
Grafana · grafana-image-renderer
Critical9.9 - CVE-2025-60306
code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive…
Product not named
Critical9.9 - CVE-2025-59246
Azure Entra ID Elevation of Privilege Vulnerability
Microsoft · Microsoft Entra
Critical9.8 - CVE-2025-7526
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
wptravelengine · WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Critical9.8 - CVE-2025-6439
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion
JMA Plugins · WooCommerce Designer Pro
Critical9.8 - CVE-2025-7634
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
wptravelengine · WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Critical9.8