Explore a curated list of the latest CVEs, with a focus on critical and high-severity vulnerabilities. Stay informed about actively exploited threats and get the insights you need to respond quickly and confidently.
| CVE ID | CVSS Score | Short Summary | Link |
|---|---|---|---|
| CVE-2025-59287 | 9.8 | CVE-2025-59287 is a critical WSUS flaw that allows remote attackers to execute code without authentication due to unsafe data handling. Active attacks began in October 2025, and Microsoft released urgent patches to fix it. | Click here |
| CVE-2025-0282 | 9.0 | CVE-2025-0282 is a critical pre‑auth bug in Ivanti Connect Secure (seen since Dec 2024) that lets attackers run commands remotely and install web shells, credential stealers, and persistent backdoors. Mitigate by installing Ivanti’s fix (22.7R2.5), run the Integrity Checker Tool, isolate suspected appliances, and factory‑reset/rebuild if infected. | Click here |
| CVE-2025-10035 | 10.0 | CVE‑2025‑10035 is a critical deserialization flaw in Fortra’s GoAnywhere MFT License Servlet (CVSS 10.0). Attackers supplying forged license responses can trigger deserialization of malicious objects, causing unauthenticated remote code execution when the Admin Console is reachable. Active exploitation and ransomware activity have been reported. Operators must patch to 7.8.4/7.6.3, remove internet exposure, and hunt for indicators. | Click here |
| CVE-2025-24085 | 7.8 | CVE-2025-24085 is a critical use‑after‑free flaw in Apple’s media processing (Core Media) that was actively exploited in the wild against older iOS releases. Successful exploitation can let a malicious app run code with elevated privileges; Apple fixed the issue in January 2025—update to iOS/iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3, or visionOS 2.3. | Click here |
| CVE‑2025‑8088 | 8.4 | CVE-2025-8088 is a Windows WinRAR bug that lets crafted RAR files drop hidden programs outside the chosen folder using NTFS alternate data streams. Update WinRAR to 7.13, avoid RARs from unknown senders, extract suspicious archives in a sandbox, and check %TEMP%, %LOCALAPPDATA%, and Startup for unexpected .exe/.dll/.lnk files. | Click here |
| CVE-2025-32433 | 10.0 | CVE-2025-32433 is a critical pre-authentication RCE in Erlang/OTP’s SSH server. By sending crafted SSH connection messages (e.g., channel_open/channel_request) before authentication, attackers can execute arbitrary commands without credentials. Public PoCs and real-world exploit activity were observed. Patch immediately to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 to prevent full system compromise. | Click here |
| CVE-2025-4598 | 4.7 | CVE-2025-4598 is a medium-severity race condition in systemd-coredump allowing a local attacker to crash a SUID process, swap in a non‑SUID binary, and read the privileged core dump—potentially exposing sensitive data like password hashes. Mitigate by setting /proc/sys/fs/suid_dumpable to 0, updating systemd, and auditing core-dump access logs. | Click here |
| CVE-2025-9556 | 9.8 | CVE-2025-9556 is a critical SSTI in Langchaingo caused by Gonja v1.5.3’s Jinja-like include/extends features. Malicious prompts can force template rendering to read arbitrary files (e.g., /etc/passwd), exposing secrets or enabling code execution. Patch Langchaingo to the RenderTemplateFS fix, disable template parsing for untrusted prompts, and block template directives until fixed. | Click here |
| CVE-2025-10585 | 9.8 | CVE-2025-10585 is a critical type-confusion zero-day in Chrome’s V8 engine, reported by Google TAG on Sept 16, 2025. It allows arbitrary code execution and possible sandbox escape when victims load malicious webpages. It is being exploited in the wild. Update Chrome right away to 140.0.7339.185/.186 (Windows/macOS) or 140.0.7339.185 (Linux). | Click here |
| CVE-2025-53786 | 8.0 | CVE-2025-53786 is a critical Microsoft Exchange flaw letting on-premises admins gain higher access in Exchange Online, putting cloud data and admin control at risk. Exploitation may leave minimal audit traces. Mitigation involves applying the April 2025 hotfix, switching to a dedicated hybrid app, cleaning service principal credentials, and monitoring hybrid configurations. | Click here |
| CVE-2025-20309 | 10.0 | CVE-2025-20309 is a critical vulnerability in Cisco Unified Communications Manager (ES releases 15.0.1.13010-1 through 15.0.1.13017-1) caused by hardcoded root SSH credentials. It allows unauthenticated remote root access, full system takeover, and arbitrary command execution. Cisco fixed it in 15SU3 (July 2025); apply the patch immediately and monitor SSH root logins. | Click here |
| CVE-2025-31324 | 10 | CVE-2025-31324 is a critical, actively exploited SAP NetWeaver Visual Composer vulnerability allowing unauthenticated unrestricted file uploads that lead to remote code execution and webshell deployment. Listed in CISA’s KEV, it risks host takeover and data theft. Apply SAP Notes 3594142/3604119, restrict or disable the metadata uploader, and hunt for JSP webshells. | Click here |
| CVE-2025-54576 | 9.1 | CVE-2025-54576 is a critical authentication bypass in oauth2-proxy (≤7.10.0) where skip_auth_routes regexes matched the full request URI including query strings. Attackers can add crafted parameters to bypass authentication. Fixed in v7.11.0 – upgrade immediately. Meanwhile, audit and tighten skip_auth_routes, anchor regex, or strip query parameters before matching. Monitor logs for suspicious requests. | Click here |
| CVE-2025-5394 | 9.8 | CVE-2025-5394 is an unauthenticated flaw in the Alone WordPress theme (≤ 7.8.3) that lets attackers upload ZIPs via an AJAX action, install webshells, and take full control of the site. Update to Alone 7.8.5+, remove unauthorized files, and monitor admin-ajax activity. | Click here |
| CVE-2025-6543 | 9.8 | CVE-2025-6543 is a critical memory overflow in Citrix NetScaler ADC/Gateway (VPN, ICA, CVPN, RDP, AAA) that lets unauthenticated attackers crash devices or run code. It’s actively exploited — patch to 14.1-47.46, 13.1-59.19, or 13.1-37.236 now, terminate sessions, monitor for abnormal activity, and upgrade unsupported 12.1/13.0 systems. | Click here |
| CVE-2025-41237 | 9.3 | CVE-2025-41237 allows a guest VM administrator to trigger an integer underflow in VMware VMCI and execute code on the host. It affects ESXi 7–8, Workstation 17, Fusion 13, and VMware Tools 11–13 — apply updates and restrict guest VM privileges immediately to prevent host compromise. | Click here |
| CVE-2025-5777 | 9.3 | CVE-2025-5777, also called CitrixBleed 2, is a critical memory overread in Citrix NetScaler ADC and Gateway that allows unauthenticated attackers to steal session tokens, hijack sessions, and bypass MFA. Affected systems include Gateway and AAA virtual servers. Immediate patching to fixed builds and terminating active sessions are essential to prevent unauthorized access and potential network compromise. | Click here |
| CVE-2025-41236 | 9.3 | CVE-2025-41236 is a serious integer overflow in VMware’s VMXNET3 adapter that lets a guest VM admin run code on the host. Affected products are ESXi, Workstation, and Fusion using VMXNET3. Apply patches immediately and restrict VM admin access to prevent host compromise. | Click here |
| CVE-2025-54309 | 9.8 | CVE-2025-54309 is a critical CrushFTP flaw (before 10.8.5 and 11.3.4_23) that lets attackers gain full admin access, steal data, and disrupt operations due to weak AS2 validation. Actively exploited, it requires urgent patching to versions 10.8.5_12 or 11.3.4_26 and careful monitoring of server logs. | Click here |
| CVE-2025-20337 | 10.0 | CVE-2025-20337 is a critical unauthenticated RCE in Cisco Identity Services Engine (ISE) and ISE‑PIC (v3.3.0, v3.4.0), allowing attackers to run code as root via crafted API requests. Actively exploited, update to 3.3 Patch 7 or 3.4 Patch 2 immediately, restrict API access, monitor logs, and investigate for compromise to prevent full takeover. | Click here |
| CVE-2025-20281 | 10.0 | CVE-2025-20281 is a critical unauthenticated API vulnerability in Cisco ISE/ISE‑PIC that lets attackers execute commands as root. It’s being actively exploited and has no workaround — upgrade to Cisco ISE 3.3 Patch 6 or 3.4 Patch 2 immediately and watch API logs for suspicious requests. | Click here |
| CVE-2025-40599 | 9.1 | CVE-2025-40599 is a critical SonicWall SMA 100 flaw: attackers with admin credentials can upload malware, take control, and erase logs. Fix by updating to firmware 10.2.2.1‑90sv+, reset passwords/OTP, enable MFA, restrict remote management, and check logs for suspicious activity. | Click here |
| CVE-2025-49706 | 6.5 | CVE-2025-49706 is a medium SharePoint flaw where attackers can access protected APIs without logging in by spoofing the Referer header. A public proof-of-concept exists and active attacks have been seen. Patch SharePoint (2016/2019/Subscription Edition) with Microsoft’s July 8, 2025 update, block ToolPane via WAF, and monitor for fake Referer requests. | Click here |
| CVE-2025-23266 | 9.0 | CVE-2025-23266 is a critical NVIDIA Container Toolkit vulnerability (≤1.17.7) and GPU Operator (≤25.3.0) OCI-hook flaw allowing containers to inject LD_PRELOAD libraries and execute code on the host, breaking isolation. Patch to Container Toolkit 1.17.8 and GPU Operator 25.3.1, disable the CUDA-compat hook if needed, and monitor for suspicious LD_PRELOAD usage. | Click here |
| CVE-2025-49704 | 8.8 | CVE-2025-49704 is a SharePoint vulnerability that lets attackers run code and install web shells, risking server takeover. Apply the July 2025 SharePoint patches, remove suspicious .aspx files, rotate machine keys, and monitor IIS/PowerShell logs for unusual activity. | Click here |
| CVE-2025-6558 | 8.8 | CVE-2025-6558 is an actively exploited Chrome/Chromium GPU bug (Chrome <138.0.7204.157, Edge <138.0.3351.95) that can escape the browser sandbox via crafted web content. Update browsers immediately, avoid untrusted sites, and watch for browser crashes or unusual GPU activity. | Click here |
| CVE-2025-1974 | 9.8 | Critical Remote Code Execution in Kubernetes Ingress-NGINX via Unsanitized Annotations: CVE-2025-1974 Decoded | Click here |
| CVE-2025-47812 | 10 | Wing FTP Server Hit by Critical RCE Vulnerability: CVE-2025-47812 Explained | Click here |
| CVE-2025-53771 | 7.1 | Critical Authentication Bypass in SharePoint via Spoofed Referer Header: A Deep Dive into CVE-2025-53771 | Click here |
| CVE‑2025‑6218 | 7.8 | High-Severity Directory Traversal in WinRAR Allows Remote Code Execution: CVE-2025-6218 Explained | Click here |
| CVE-2025-53770 | 9.8 | Widespread SharePoint Takeover via Auth Bypass and ASPX Web Shells: CVE-2025-53770 Analyzed | Click here |
| CVE-2025-22225 | 8.2 | Critical VM Escape in VMware ESXi via Arbitrary Kernel Write: CVE-2025-22225 Decoded | Click here |
| CVE-2025-25257 | 9.6 | Critical Unauthenticated SQL Injection to Root RCE in FortiWeb's Fabric Connector: CVE-2025-25257 Decoded | Click here |
| CVE-2025-27831 | 9.8 | Critical Buffer Overflow in Ghostscript DOCXWRITE/TXTWRITE via Malformed Text: CVE-2025-27831 Decoded | Click here |
| CVE-2025-22226 | 7.1 | High-Severity Information Disclosure in VMware ESXi, Workstation, and Fusion HGFS via Out-of-Bounds Read: CVE-2025-22226 Explained | Click here |
| CVE-2025-22224 | 9.3 | Critical VM Escape via TOCTOU in VMware ESXi and Workstation: CVE-2025-22224 Explained | Click here |
| CVE-2025-2783 | 8.8 | Zero-Click Chrome Sandbox Escape via Mojo Flaw: CVE-2025-2783 Breakdown | Click here |
| CVE-2025-29927 | 9.1 | Critical Authorization Bypass in Next.js Middleware via Spoofed Headers: CVE-2025-29927 Decoded | Click here |
| CVE-2025-24813 | 9.8 | CVE-2025-24813 is a critical remote code execution flaw in Apache Tomcat caused by improper handling of partial PUT requests. Exploitation lets unauthenticated attackers write malicious files and execute arbitrary code, risking full server compromise. Affected versions include Tomcat 9.x, 10.1.x, and 11.0.x. Users should urgently upgrade to the patched releases. | Click here |
| CVE-2025-21298 | 9.8 | Zero-click RCE via malicious RTF in Outlook | Click here |
A CVE (Common Vulnerabilities and Exposures) is a unique identifier given to a publicly known cybersecurity flaw. It helps researchers and security teams talk about the same issue using a standard reference.
Vulnerabilities in cybersecurity are weaknesses or flaws in software, hardware, or systems that attackers can exploit to gain unauthorized access, disrupt operations, or steal sensitive information.
Each CVE can be linked to a CVSS (Common Vulnerability Scoring System) score, which rates the severity of the vulnerability (from 0 to 10). This score is usually available in the CVE details and helps assess how dangerous the issue is.
You can find CVEs through official databases like NVD, MITRE, vendor advisories, security blogs, or tools like scanners and vulnerability management platforms.
Fixing a CVE usually involves applying a patch or update released by the software vendor. In some cases, temporary workarounds or configuration changes can reduce the risk until a full fix is available.
A CVE is not calculated; it’s a unique ID assigned to a discovered vulnerability. However, the related CVSS score is calculated based on how easy the vulnerability is to exploit, the potential impact, and whether it needs user interaction.
See Fidelis Security platforms in action. Learn how our fast scalable platforms provide full visibility, deep insights, and rapid response to help security teams worldwide protect, detect, respond, and neutralize against advanced cyber adversaries.
