Week 43, 2025
20 October to 26 October 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 856
- Critical
- 76
- High
- 306
- Added to KEV
- 8
Critical 76High 306Medium 378Low 27Not scored 69All 856 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Microsoft · Windows Server 2012
ExploitedCritical9.8 - CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe · Adobe Commerce
ExploitedCritical9.1 - CVE-2025-61932
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an…
MOTEX Inc. · Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA))
ExploitedCritical9.3 - CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh8.8 - CVE-2022-48503
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6.…
Apple · macOS
ExploitedHigh8.8 - CVE-2025-61884
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14.…
Oracle Corporation · Oracle Configurator
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2016-15048
AMTT HiBOS Command Injection RCE via server_ping.php
Anmei Century (Beijing) Technology Co., Ltd. · Hotel Broadband Operation System (HiBOS)
Critical10.0 - CVE-2018-25118
GeoVision Command Injection RCE via /PictureCatch.cgi
GeoVision Inc. · GV-BX1500
Critical10.0 - CVE-2025-59503
Azure Compute Resource Provider Elevation of Privilege Vulnerability
Microsoft · Azure Compute Resource Provider
Critical10.0 - CVE-2025-48106
WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability
CMSSuperHeroes · Clanora
Critical10.0 - CVE-2025-12275
Mail Configuration File Manipulation + Command Execution
Azure Access Technology · BLU-IC2
Critical10.0 - CVE-2025-57870
BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.
Esri · ArcGIS Server
Critical10.0 - CVE-2025-60206
WordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerability
Beplusthemes · Alone
Critical10.0 - CVE-2025-58963
WordPress Medcity theme < 1.1.9 - Arbitrary File Upload vulnerability
7oroof · Medcity
Critical10.0 - CVE-2025-49060
WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability
CMSSuperHeroes · Wastia
Critical10.0 - CVE-2025-12104
Incorrect Content-Type Header
Azure Access Technology · BLU-IC2
Critical10.0
Vendors with the most CVEs
Most common weaknesses
- CWE-79 Cross-site scripting (XSS)185
- CWE-862 Missing authorization58
- CWE-284 Improper access control33
- CWE-89 SQL injection30
- CWE-121 Stack-based buffer overflow29
- CWE-502 Deserialization of untrusted data25
- CWE-400 Uncontrolled resource consumption23
- CWE-200 Exposure of sensitive information22
- CWE-285 Improper authorization18
- CWE-352 Cross-site request forgery (CSRF)17