Week in review: Microsoft patches 5 actively exploited 0-days, recently fixed Chrome vulnerability exploited
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2025-32756 | Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone | 9.8 | 31% | KEV | KEV |
CVE-2025-4428+1 related CVE | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API | 8.8 group max | 88% | KEV | KEV |
| CVE-2025-4664 | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page | 4.3 | 6% |
From the original article
5 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Patch Tuesday: Microsoft fixes 5 actively exploited zero-days On May 2025 Patch Tuesday, Microsoft has released security fixes for 70+ vulnerabilities, among them five actively exploited zero-days and two publicly disclosed (but not exploited) vulnerabilities.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.