Week 42, 2025

13 October to 19 October 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 914
Critical: 79
High: 378
Added to KEV: 5

Critical 79High 378Medium 407Low 38Not scored 12All 914 in the list

Added to KEVAttackers use these now; patch them first

CVE-2025-54253
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Adobe · Adobe Experience Manager
ExploitedCritical10.0
CVE-2016-7836
SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management…
Sky Co., LTD. · SKYSEA Client View
ExploitedCritical9.8
CVE-2025-59230
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8
CVE-2025-24990
Windows Agere Modem Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8
CVE-2025-47827
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted…
Product not named
ExploitedMedium4.6

Most severe new CVEsBy CVSS score

CVE-2025-62168
Squid vulnerable to information disclosure via authentication credential leakage in error handling
squid-cache · squid
Critical10.0
CVE-2025-11832
APIs Lack Rate Limiting
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-11925
Incorrect Content-Type Header
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-9265
API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products
Kiloview · NDI
Critical10.0
CVE-2025-55315
ASP.NET Security Feature Bypass Vulnerability
Microsoft · ASP.NET Core 2.3
Critical9.9
CVE-2025-49708
Microsoft Graphics Component Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
Critical9.9
CVE-2025-62645
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative…
Restaurant Brands International · assistant platform
Critical9.9
CVE-2025-6950
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret…
Moxa · EDR-G9010 Series
Critical9.9
CVE-2025-7328
Rockwell Automation Comms - 1783-NATR Multiple Broken Authentication Vulnerabilities
Rockwell Automation · Comms - 1783-NATR
Critical9.9
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Microsoft · Windows Server 2012
ExploitedCritical9.8

Week 42, 2025

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses