October 2025 CVE Landscape
- CVEs
- CVE-2025-59287CVE-2025-61882CVE-2025-41244CVE-2025-24893CVE-2025-6204CVE-2025-6205CVE-2025-54236CVE-2025-61932CVE-2022-48503CVE-2025-2746CVE-2025-2747CVE-2025-33073CVE-2025-61884CVE-2025-54253CVE-2025-47827CVE-2025-24990CVE-2025-59230CVE-2016-7836CVE-2021-43798CVE-2025-27915CVE-2021-22555CVE-2010-3962CVE-2021-43226CVE-2013-3918CVE-2011-3402CVE-2010-3765CVE-2014-6278CVE-2017-1000353CVE-2015-7755CVE-2025-21043CVE-2025-4008CVE-2025-11371
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-3765 | Memory Corruption RCE in Mozilla Firefox, SeaMonkey, and Thunderbird | — | 83% | KEV | — KEV |
| CVE-2010-3962 | Uninitialized Memory Corruption RCE in Microsoft Internet Explorer | — | 97% | KEV | — KEV |
| CVE-2011-3402 | Remote Code Execution in Microsoft Windows Kernel TrueType Font Parser (win32k.sys) | — | 78% | KEV | — KEV |
| CVE-2013-3918 | Out-of-Bounds Write RCE in Microsoft Windows InformationCardSigninHelper ActiveX | — | 74% | KEV | — KEV |
| CVE-2014-6278 | Remote OS Command Injection in GNU Bash via Crafted Environment (Shellshock-family) | — | 100% | KEV | — KEV |
| CVE-2015-7755 | Authentication Bypass in Juniper ScreenOS Grants Remote Admin Access | — | 61% | KEV | — KEV |
| CVE-2016-7836 | Unauthenticated RCE in SKYSEA Client View Management Console | 9.8 | 19% | KEVPoC | KEV |
| CVE-2017-1000353 | Unauthenticated Deserialization RCE in Jenkins CLI (≤2.56 / ≤2.46.1 LTS) | 9.8 | 100% | KEVPoC | KEV |
| CVE-2021-22555 | Linux Kernel Netfilter Heap OOB Write Enables Privilege Escalation (CVE-2021-22555) | 7.8 | 79% | KEVPoC ×5 | KEV |
| CVE-2021-43226 | Local Privilege Escalation in Microsoft Windows CLFS Driver (CVE-2021-43226) | 7.8 | 3% | KEVRansomware | KEV |
| CVE-2021-43798 | Unauthenticated Path Traversal File Read in Grafana 8.x | 7.5 | 89% | KEVPoC | KEV |
| CVE-2022-48503 | Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari | 8.8 | 3% | KEV | KEV |
| CVE-2025-11371 | Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox | 7.5 | 92% | KEVPoC | KEV |
| CVE-2025-21043 | Out-of-Bounds Write RCE in Samsung Mobile Image Codec (libimagecodec.quram.so) | 9.8 | 2% | KEV | KEV |
| CVE-2025-24893 | Unauthenticated RCE via Eval Injection in XWiki Platform SolrSearch | 9.8 | 100% | KEVPoC | KEV |
CVE-2025-59287+2 related CVEs | Deserialization RCE in Microsoft WSUS (Windows Server) | 9.8 group max | 100% | KEVPoC | KEV |
CVE-2025-2747+1 related CVE | Authentication Bypass in Kentico Xperience CMS Staging Sync Server | 9.8 | 97% | KEVPoC | KEV |
| CVE-2025-27915 | Stored XSS in Zimbra Collaboration Suite Classic Web Client via Malicious ICS Files | 5.4 | 4% | KEVPoC | KEV |
| CVE-2025-33073 | Improper Access Control Privilege Escalation in Microsoft Windows SMB Client | 8.8 | 83% | KEV | KEV |
| CVE-2025-4008 | Unauthenticated Command Injection RCE in Smartbedded Meteobridge | 8.7 | 93% | KEVPoC | KEV |
| CVE-2025-41244 | Local Privilege Escalation in VMware Aria Operations and VMware Tools | 7.8 | 9% | KEVPoC | KEV |
| CVE-2025-47827 | Secure Boot Bypass via Expired Key in IGEL OS Before 11 (CVE-2025-47827) | 4.6 | 5% | KEVPoC | KEV |
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2025-54253 | Pre-Auth RCE in Adobe Experience Manager Forms via Struts DevMode Misconfiguration | 10.0 | 89% | KEVPoC | KEV |
| CVE-2025-61882 | Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processing | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2025-61884 | Unauthenticated SSRF in Oracle E-Business Suite Configurator | 7.5 | 96% | KEVRansomwarePoC | KEV |
| CVE-2025-61932 | Unauthenticated RCE via spoofed packets in Motex LANSCOPE Endpoint Manager agents | 9.3 | 3% | KEV | KEV |
CVE-2025-6205+1 related CVE | Missing Authorization in Dassault Systèmes DELMIA Apriso Grants Privileged Access | 9.1 group max | 74% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.194.11.200 | nd-stage payloads from C2 servers ( 162[.]55[.]17[.]215 and 104[.]194[.]11[.]200 ) Installed SAGEWAVE servlet filter for persistent ba |
| ipv4 | 162.55.17.215 | DVEIN.JAVA to fetch second-stage payloads from C2 servers ( 162[.]55[.]17[.]215 and 104[.]194[.]11[.]200 ) Installed SAGEWAVE servlet |
| ipv4 | 185.181.60.11 | r/UiServlet Block known malicious IPs: 200.107.207[.]26 and 185.181.60[.]11 Monitor for indicators of GOLDVEIN, SAGEGIFT, SAGELEAF, a |
| ipv4 | 200.107.207.26 | /OA_HTML/configurator/UiServlet Block known malicious IPs: 200.107.207[.]26 and 185.181.60[.]11 Monitor for indicators of GOLDVEIN, S |
From the original article
7 min read at recordedfuture.com
October 2025 saw a significant escalation in vulnerability activity, with Recorded Future's Insikt Group® identifying 32 high-impact vulnerabilities , double the 16 identified in September's CVE report . Twenty-six of these vulnerabilities scored as Very Critical.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.