Weekly digest
Week 44, 2025 (27 Oct – 2 Nov)
A busier-than-usual week with 533 new CVEs (recent average about 393). Of those, 21 critical and 162 high. 11 arrived with exploitation evidence or public exploit code already attached. No new KEV entries. nagios was the most-affected vendor with 33.
New this week, ranked by depth score
The 12 that matter most of the 533 published.
CVE-2025-11201High· 8.10dayPoCMLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
CVE-2025-11200High· 8.10dayMLflow Weak Password Requirements Authentication Bypass Vulnerability
MLflow Weak Password Requirements Authentication Bypass Vulnerability
CVE-2025-8489Critical· 9.8PoCThe King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting…
CVE-2025-9871High· 7.80dayRazer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability
Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the abil…
CVE-2025-9870High· 7.80dayRazer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability
Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtai…
CVE-2025-9869High· 7.80dayRazer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability
Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the abilit…
CVE-2025-11465High· 7.80dayAshlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required…
CVE-2025-11464High· 7.80dayAshlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction…
CVE-2025-11463High· 7.80dayAshlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requir…
CVE-2025-55752High· 7.5PoCRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that…
CVE-2025-62368Critical· 9.0PoCTaiga is an open source project management platform
Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.
CVE-2025-10897High· 8.6PoCThe WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28
The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can exp…
Most-affected vendors
By CVEs published in the period.