Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 45, 2025

3 November to 9 November 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
827
Critical
78
High
314
Added to KEV
2

Critical 78High 314Medium 406Low 26Not scored 3All 827 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2025-48703

    CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total…

    centos-webpanel · CentOS Web Panel

    ExploitedCritical9.0
  • CVE-2025-11371

    Gladinet CentreStack and TrioFox Local File Inclusion Flaw

    Gladinet · CentreStack and TrioFox

    ExploitedHigh7.5

Most severe new CVEsBy CVSS score

  • CVE-2025-10230

    Samba: command injection in wins server hook script

    samba

    Critical10.0
  • CVE-2025-63689

    Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote…

    Product not named

    Critical10.0
  • CVE-2025-61945

    Missing Authentication for Critical Function in Radiometrics VizAir

    Radiometrics · VizAir

    Critical10.0
  • CVE-2025-61956

    Missing Authentication for Critical Function in Radiometrics VizAir

    Radiometrics · VizAir

    Critical10.0
  • CVE-2025-54863

    Insufficiently Protected Credentials in Radiometrics VizAir

    Radiometrics · VizAir

    Critical10.0
  • CVE-2025-49372

    WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability

    VillaTheme · HAPPY

    Critical10.0
  • CVE-2025-60235

    WordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerability

    Plugify · Support Ticket System for WooCommerce (Premium)

    Critical10.0
  • CVE-2025-60207

    WordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload Vulnerability

    Addify · Custom User Registration Fields for WooCommerce

    Critical10.0
  • CVE-2025-53283

    WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerability

    borisolhor · Drop Uploader for CF7 - Drag&Drop File Uploader Addon

    Critical10.0
  • CVE-2025-6327

    WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability

    KingAddons.com · King Addons for Elementor

    Critical10.0

Vendors with the most CVEs

  1. Apple107
  2. MediaTek, Inc.25
  3. Google23
  4. Advantech21
  5. IBM17
  6. QNAP Systems Inc.17
  7. CanalDenuncia15
  8. Qualcomm, Inc.13
  9. Cisco11
  10. Dell9

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)130
  2. CWE-862 Missing authorization64
  3. CWE-89 SQL injection58
  4. CWE-787 Out-of-bounds write40
  5. CWE-98 PHP remote file inclusion40
  6. CWE-284 Improper access control31
  7. CWE-200 Exposure of sensitive information26
  8. CWE-434 Unrestricted file upload26
  9. CWE-22 Path traversal24
  10. CWE-352 Cross-site request forgery (CSRF)24