CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2025-59287 KEV |
[KEV] Unsafe Deserialization in Microsoft Windows (CVE-2025-59287)
Vulnerability in Microsoft Windows (CVE-2025-59287). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-54236 KEV |
[KEV] Vulnerability in Adobe commerce (CVE-2025-54236)
vulnerability in Adobe commerce (CVE-2025-54236). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-61932 KEV |
[KEV] Vulnerability in Motex LANSCOPE Endpoint Manager (CVE-2025-61932)
Vulnerability in Motex LANSCOPE Endpoint Manager (CVE-2025-61932). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-61884 KEV |
[KEV] Path Traversal in Oracle E-Business Suite (CVE-2025-61884)
Path traversal in Oracle E-Business Suite (CVE-2025-61884). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-33073 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2025-33073)
Vulnerability in Microsoft Windows (CVE-2025-33073). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-2747 KEV |
[KEV] Vulnerability in Kentico Xperience CMS (CVE-2025-2747)
Vulnerability in Kentico Xperience CMS (CVE-2025-2747). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-2746 KEV |
[KEV] Vulnerability in Kentico Xperience CMS (CVE-2025-2746)
Vulnerability in Kentico Xperience CMS (CVE-2025-2746). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-48503 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2022-48503)
Vulnerability in Apple Multiple Products (CVE-2022-48503). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-54253 KEV |
[KEV] Vulnerability in Adobe Experience Manager (AEM) Forms (CVE-2025-54253)
Vulnerability in Adobe Experience Manager (AEM) Forms (CVE-2025-54253). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-7836 KEV |
[KEV] Authentication Bypass in SKYSEA Client View (CVE-2016-7836)
Authentication bypass in SKYSEA Client View (CVE-2016-7836). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-59230 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2025-59230)
Vulnerability in Microsoft Windows (CVE-2025-59230). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-24990 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2025-24990)
Vulnerability in Microsoft Windows (CVE-2025-24990). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-47827 KEV |
[KEV] Vulnerability in IGEL OS (CVE-2025-47827)
Vulnerability in IGEL OS (CVE-2025-47827). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-43798 KEV |
[KEV] Path Traversal in Grafana labs github.com/grafana/grafana (CVE-2021-43798)
Path traversal in Grafana labs github.com/grafana/grafana (CVE-2021-43798). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 8.0.7 or later.
|
|
| CVE-2025-27915 KEV |
[KEV] Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2025-27915)
Cross-site scripting in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2025-27915). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-61882 KEV |
[KEV] Authentication Bypass in Oracle E-Business Suite (CVE-2025-61882)
Authentication bypass in Oracle E-Business Suite (CVE-2025-61882). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-3765 KEV |
[KEV] Vulnerability in Mozilla Multiple Products (CVE-2010-3765)
Vulnerability in Mozilla Multiple Products (CVE-2010-3765). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2011-3402 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2011-3402)
Vulnerability in Microsoft Windows (CVE-2011-3402). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2013-3918 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2013-3918)
Vulnerability in Microsoft Windows (CVE-2013-3918). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-43226 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2021-43226)
Vulnerability in Microsoft Windows (CVE-2021-43226). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-3962 KEV |
[KEV] Vulnerability in Microsoft Internet Explorer (CVE-2010-3962)
Vulnerability in Microsoft Internet Explorer (CVE-2010-3962). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22555 KEV |
[KEV] Out-of-Bounds Write in Linux Kernel (CVE-2021-22555)
Out-of-bounds write in Linux Kernel (CVE-2021-22555). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-4008 KEV |
[KEV] Vulnerability in Smartbedded Meteobridge (CVE-2025-4008)
Vulnerability in Smartbedded Meteobridge (CVE-2025-4008). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-21043 KEV |
[KEV] Out-of-Bounds Write in Samsung Mobile Devices (CVE-2025-21043)
Out-of-bounds write in Samsung Mobile Devices (CVE-2025-21043). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-7755 KEV |
[KEV] Authentication Bypass in Juniper ScreenOS (CVE-2015-7755)
Authentication bypass in Juniper ScreenOS (CVE-2015-7755). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-1000353 KEV |
[KEV] Vulnerability in Jenkins (CVE-2017-1000353)
Vulnerability in Jenkins (CVE-2017-1000353). Successful exploitation can lead to full system takeover. Exploitable via SignedObject. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-6278 KEV |
[KEV] OS Command Injection in GNU Bash (CVE-2014-6278)
OS command injection in GNU Bash (CVE-2014-6278). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-21311 KEV |
[KEV] SSRF (Server-Side Request Forgery) in Adminer (CVE-2021-21311)
SSRF in Adminer (CVE-2021-21311). Risk of unauthorized operations or information disclosure. Exploitable via adminer.php. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-20352 KEV |
[KEV] Vulnerability in Cisco IOS and IOS XE (CVE-2025-20352)
Vulnerability in Cisco IOS and IOS XE (CVE-2025-20352). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-10035 KEV |
[KEV] Unsafe Deserialization in Fortra GoAnywhere MFT (CVE-2025-10035)
Vulnerability in Fortra GoAnywhere MFT (CVE-2025-10035). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-59689 KEV |
[KEV] Command Injection in Libraesva Email Security Gateway (CVE-2025-59689)
Command injection in Libraesva Email Security Gateway (CVE-2025-59689). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-32463 KEV |
[KEV] Vulnerability in Sudo (CVE-2025-32463)
Vulnerability in Sudo (CVE-2025-32463). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-20333 KEV |
[KEV] Vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense (CVE-2025-20333)
Vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense (CVE-2025-20333). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-20362 KEV |
[KEV] Vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense (CVE-2025-20362)
Vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense (CVE-2025-20362). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-10585 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2025-10585)
Vulnerability in Google Chromium V8 (CVE-2025-10585). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-5086 KEV |
[KEV] Unsafe Deserialization in Dassault Systèmes DELMIA Apriso (CVE-2025-5086)
Vulnerability in Dassault Systèmes DELMIA Apriso (CVE-2025-5086). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-53690 KEV |
[KEV] Unsafe Deserialization in Sitecore Multiple Products (CVE-2025-53690)
Vulnerability in Sitecore Multiple Products (CVE-2025-53690). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-48543 KEV |
[KEV] Vulnerability in Android Runtime (CVE-2025-48543)
Vulnerability in Android Runtime (CVE-2025-48543). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-38352 KEV |
[KEV] Vulnerability in Linux Kernel (CVE-2025-38352)
Vulnerability in Linux Kernel (CVE-2025-38352). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-9377 KEV |
[KEV] OS Command Injection in TP-Link Multiple Routers (CVE-2025-9377)
OS command injection in TP-Link Multiple Routers (CVE-2025-9377). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-50224 KEV |
[KEV] Vulnerability in Tp-link Tl Wr841N (CVE-2023-50224)
Vulnerability in Tp-link Tl Wr841N (CVE-2023-50224). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-55177 KEV |
[KEV] Authorization Flaw in Meta Platforms WhatsApp (CVE-2025-55177)
Vulnerability in Meta Platforms WhatsApp (CVE-2025-55177). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-24363 KEV |
[KEV] Vulnerability in TP-Link TL-WA855RE (CVE-2020-24363)
Vulnerability in TP-Link TL-WA855RE (CVE-2020-24363). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-57819 KEV |
[KEV] SQL Injection in Sangoma FreePBX (CVE-2025-57819)
SQL injection in Sangoma FreePBX (CVE-2025-57819). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-7775 KEV |
[KEV] Buffer Overflow in Citrix NetScaler (CVE-2025-7775)
Vulnerability in Citrix NetScaler (CVE-2025-7775). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-8069 KEV |
[KEV] Unsafe Deserialization in Citrix Session Recording (CVE-2024-8069)
Vulnerability in Citrix Session Recording (CVE-2024-8069). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-8068 KEV |
[KEV] Privilege Escalation in Citrix Session Recording (CVE-2024-8068)
Vulnerability in Citrix Session Recording (CVE-2024-8068). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-48384 KEV |
[KEV] Vulnerability in Git (CVE-2025-48384)
Vulnerability in Git (CVE-2025-48384). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-43300 KEV |
[KEV] Out-of-Bounds Write in Apple iOS, iPadOS, and macOS (CVE-2025-43300)
Out-of-bounds write in Apple iOS, iPadOS, and macOS (CVE-2025-43300). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-54948 KEV |
[KEV] OS Command Injection in Trend Micro Apex One (CVE-2025-54948)
OS command injection in Trend Micro Apex One (CVE-2025-54948). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
