Week 44, 2025

27 October to 2 November 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 967
Critical: 71
High: 315
Added to KEV: 4

Critical 71High 315Medium 518Low 21Not scored 42All 967 in the list

Added to KEVAttackers use these now; patch them first

CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
xwiki · xwiki-platform
ExploitedCritical9.8
CVE-2025-41244
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
VMware · VCF operations
ExploitedHigh7.8
CVE-2025-6205
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedCritical9.1
CVE-2025-6204
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedHigh8.0

Most severe new CVEsBy CVSS score

CVE-2025-64095
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
dnnsoftware · Dnn.Platform
Critical10.0
CVE-2025-52665
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a…
Ubiquiti Inc · UniFi Access Application
Critical10.0
CVE-2025-48983
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an…
Veeam · Backup and Replication
Critical10.0
CVE-2025-12422
Vulnerable Upgrade Feature (Arbitrary File Write)
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-12599
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-12600
Web UI Malfunction
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-12516
Lack of Graceful Error Handling - HTTP 5xx Error
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-12515
Systemic Internal Server Errors - HTTP 500 Response
Azure Access Technology · BLU-IC2
Critical10.0
CVE-2025-29270
Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin…
Product not named
Critical10.0
CVE-2025-12477
Server Version Disclosure
Azure Access Technology · BLU-IC2
Critical10.0

Week 44, 2025

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses