KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

KEV / Archive / 2025

KEV additions in 2025

Every vulnerability CISA added to the Known Exploited Vulnerabilities catalog in 2025, with monthly counts, vendors and weaknesses.

Catalog
2026.09.23
Entries
245
Range
2025-01-07 to 2025-12-29

Answer CISA added 245 vulnerabilities to the KEV catalog in 2025. The busiest month was March 2025, with 32. 31 were flagged as used by ransomware (12.7%), and the most-listed vendor was Microsoft with 39.

Added
245in 2025
Ransomware: known
12.7%31 entries
Vendors
99distinct
Median days to due
21dateAdded to dueDate
Share of catalog
14.2%of 1,721

MAdditions per month

KEV additions per month in 2025Monthly additions in 2025: Jan 25 14; Feb 25 27; Mar 25 32; Apr 25 15; May 25 24; Jun 25 20; Jul 25 20; Aug 25 15; Sep 25 16; Oct 25 31; Nov 25 11; Dec 25 20.010203040Jan 25: 14 added14JanFeb 25: 27 added27FebMar 25: 32 added32MarApr 25: 15 added15AprMay 25: 24 added24MayJun 25: 20 added20JunJul 25: 20 added20JulAug 25: 15 added15AugSep 25: 16 added16SepOct 25: 31 added31OctNov 25: 11 added11NovDec 25: 20 added20Dec
Table view
KEV additions per month, 2025
MonthAdded
Jan 2514
Feb 2527
Mar 2532
Apr 2515
May 2524
Jun 2520
Jul 2520
Aug 2515
Sep 2516
Oct 2531
Nov 2511
Dec 2520

VTop vendors in 2025

Top vendors by KEV additions, 2025
VendorEntriesShare of year
Microsoft3915.9%
Apple93.7%
Cisco83.3%
Fortinet83.3%
Google72.9%
Linux72.9%
Ivanti72.9%
SonicWall52%
D-Link52%
Oracle52%

WTop weaknesses in 2025

Top CWEs by KEV additions, 2025
CWEEntriesShare of year
CWE-78 OS command injection187.3%
CWE-502 Unsafe deserialization156.1%
CWE-22 Path traversal135.3%
CWE-787 Out-of-bounds write114.5%
CWE-416 Use after free114.5%
CWE-79 Cross-site scripting (XSS)72.9%
CWE-77 Command injection72.9%
CWE-306 Missing authentication62.4%

EAll 245 entries added in 2025

KEV entries added in 2025, newest first
CVEVendorProductVulnerabilityAddedDueRansomwareCWE
CVE-2025-14847MongoDBMongoDB and MongoDB ServerMongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency VulnerabilityUnknownCWE-130
CVE-2023-52163DigieverDS-2105 ProDigiever DS-2105 Pro Missing Authorization VulnerabilityUnknownCWE-862
CVE-2025-14733WatchGuardFireboxWatchGuard Firebox Out of Bounds Write VulnerabilityKnownCWE-787
CVE-2025-59374ASUSLive UpdateASUS Live Update Embedded Malicious Code VulnerabilityUnknownCWE-506
CVE-2025-40602SonicWallSMA1000 applianceSonicWall SMA1000 Missing Authorization VulnerabilityUnknownCWE-862, CWE-250
CVE-2025-20393CiscoMultiple ProductsCisco Multiple Products Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2025-59718FortinetMultiple ProductsFortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityUnknownCWE-347
CVE-2025-43529AppleMultiple ProductsApple Multiple Products Use-After-Free WebKit VulnerabilityUnknownCWE-416
CVE-2025-14611GladinetCentreStack and TriofoxGladinet CentreStack and Triofox Hard Coded Cryptographic VulnerabilityUnknownCWE-798
CVE-2025-14174GoogleChromiumGoogle Chromium Out of Bounds Memory Access VulnerabilityUnknownnone listed
CVE-2018-4063Sierra WirelessAirLink ALEOSSierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type VulnerabilityUnknownCWE-434
CVE-2025-58360OSGeoGeoServerOSGeo GeoServer Improper Restriction of XML External Entity Reference VulnerabilityUnknownCWE-611
CVE-2025-62221MicrosoftWindowsMicrosoft Windows Use After Free VulnerabilityUnknownCWE-416
CVE-2025-6218RARLABWinRARRARLAB WinRAR Path Traversal VulnerabilityUnknownCWE-22
CVE-2025-66644Array Networks ArrayOS AGArray Networks ArrayOS AG OS Command Injection VulnerabilityUnknownCWE-78
CVE-2022-37055D-LinkRoutersD-Link Routers Buffer Overflow VulnerabilityUnknownCWE-120
CVE-2025-55182MetaReact Server ComponentsMeta React Server Components Remote Code Execution VulnerabilityKnownnone listed
CVE-2021-26828OpenPLCScadaBROpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityUnknownCWE-434
CVE-2025-48633AndroidFrameworkAndroid Framework Information Disclosure VulnerabilityUnknownnone listed
CVE-2025-48572AndroidFrameworkAndroid Framework Privilege Escalation VulnerabilityUnknownnone listed
CVE-2021-26829OpenPLCScadaBROpenPLC ScadaBR Cross-site Scripting VulnerabilityUnknownCWE-79
CVE-2025-61757OracleFusion MiddlewareOracle Fusion Middleware Missing Authentication for Critical Function VulnerabilityUnknownCWE-306
CVE-2025-13223GoogleChromium V8Google Chromium V8 Type Confusion VulnerabilityUnknownCWE-843
CVE-2025-58034FortinetFortiWebFortinet FortiWeb OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-64446FortinetFortiWebFortinet FortiWeb Path Traversal VulnerabilityUnknownCWE-23
CVE-2025-9242WatchGuardFireboxWatchGuard Firebox Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2025-62215MicrosoftWindowsMicrosoft Windows Race Condition VulnerabilityUnknownCWE-362
CVE-2025-12480GladinetTriofoxGladinet Triofox Improper Access Control VulnerabilityUnknownCWE-284
CVE-2025-21042SamsungMobile DevicesSamsung Mobile Devices Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2025-48703CWPControl Web PanelCWP Control Web Panel OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-11371GladinetCentreStack and TriofoxGladinet CentreStack and Triofox Files or Directories Accessible to External Parties VulnerabilityUnknownCWE-552
CVE-2025-41244BroadcomVMware Aria Operations and VMware ToolsBroadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityUnknownCWE-267
CVE-2025-24893XWikiPlatformXWiki Platform Eval Injection VulnerabilityUnknownCWE-95
CVE-2025-6205Dassault SystèmesDELMIA AprisoDassault Systèmes DELMIA Apriso Missing Authorization VulnerabilityUnknownCWE-862
CVE-2025-6204Dassault SystèmesDELMIA AprisoDassault Systèmes DELMIA Apriso Code Injection VulnerabilityUnknownCWE-94
CVE-2025-59287MicrosoftWindowsMicrosoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2025-54236AdobeCommerce and MagentoAdobe Commerce and Magento Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2025-61932MotexLANSCOPE Endpoint ManagerMotex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel VulnerabilityUnknownCWE-940
CVE-2025-61884OracleE-Business SuiteOracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityKnownCWE-918
CVE-2025-33073MicrosoftWindowsMicrosoft Windows SMB Client Improper Access Control VulnerabilityUnknownCWE-284
CVE-2025-2747KenticoXperience CMSKentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityUnknownCWE-288
CVE-2025-2746KenticoXperience CMSKentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityUnknownCWE-288
CVE-2022-48503AppleMultiple ProductsApple Multiple Products Unspecified VulnerabilityUnknownnone listed
CVE-2025-54253AdobeExperience Manager (AEM) FormsAdobe Experience Manager Forms Code Execution VulnerabilityUnknownnone listed
CVE-2025-59230MicrosoftWindowsMicrosoft Windows Improper Access Control VulnerabilityUnknownCWE-284
CVE-2025-47827IGELIGEL OSIGEL OS Use of a Key Past its Expiration Date VulnerabilityUnknownCWE-324
CVE-2025-24990MicrosoftWindowsMicrosoft Windows Untrusted Pointer Dereference VulnerabilityUnknownCWE-822
CVE-2016-7836SKYSEAClient ViewSKYSEA Client View Improper Authentication VulnerabilityUnknownCWE-287
CVE-2021-43798Grafana LabsGrafanaGrafana Path Traversal VulnerabilityUnknownCWE-22
CVE-2025-27915SynacorZimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityUnknownCWE-79
CVE-2025-61882OracleE-Business SuiteOracle E-Business Suite Unspecified VulnerabilityKnownnone listed
CVE-2021-43226MicrosoftWindowsMicrosoft Windows Privilege Escalation VulnerabilityKnownnone listed
CVE-2021-22555LinuxKernelLinux Kernel Heap Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2013-3918MicrosoftWindowsMicrosoft Windows Out-of-Bounds Write VulnerabilityUnknownnone listed
CVE-2011-3402MicrosoftWindowsMicrosoft Windows Remote Code Execution VulnerabilityUnknownnone listed
CVE-2010-3962MicrosoftInternet ExplorerMicrosoft Internet Explorer Uninitialized Memory Corruption VulnerabilityUnknownnone listed
CVE-2010-3765MozillaMultiple ProductsMozilla Multiple Products Remote Code Execution VulnerabilityUnknownnone listed
CVE-2025-4008SmartbeddedMeteobridgeSmartbedded Meteobridge Command Injection VulnerabilityUnknownCWE-306, CWE-77
CVE-2025-21043SamsungMobile DevicesSamsung Mobile Devices Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2017-1000353JenkinsJenkinsJenkins Remote Code Execution VulnerabilityUnknownnone listed
CVE-2015-7755JuniperScreenOSJuniper ScreenOS Improper Authentication VulnerabilityUnknownCWE-287
CVE-2014-6278GNUGNU BashGNU Bash OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-59689LibraesvaEmail Security GatewayLibraesva Email Security Gateway Command Injection VulnerabilityUnknownCWE-77
CVE-2025-32463SudoSudoSudo Inclusion of Functionality from Untrusted Control Sphere VulnerabilityUnknownCWE-829
CVE-2025-20352CiscoIOS and IOS XECisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution VulnerabilityUnknownCWE-121
CVE-2025-10035FortraGoAnywhere MFTFortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityKnownCWE-502, CWE-77
CVE-2021-21311AdminerAdminerAdminer Server-Side Request Forgery VulnerabilityUnknownCWE-918
CVE-2025-20362CiscoSecure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization VulnerabilityUnknownCWE-862
CVE-2025-20333CiscoSecure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow VulnerabilityUnknownCWE-120
CVE-2025-10585GoogleChromium V8Google Chromium V8 Type Confusion VulnerabilityUnknownCWE-843
CVE-2025-5086Dassault SystèmesDELMIA AprisoDassault Systèmes DELMIA Apriso Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2025-53690SitecoreMultiple ProductsSitecore Multiple Products Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2025-48543AndroidRuntimeAndroid Runtime Use-After-Free VulnerabilityUnknownnone listed
CVE-2025-38352LinuxKernelLinux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityUnknownCWE-367
CVE-2025-9377TP-LinkMultiple RoutersTP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityUnknownCWE-78
CVE-2023-50224TP-LinkTL-WR841NTP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityUnknownCWE-290
CVE-2025-55177Meta PlatformsWhatsAppMeta Platforms WhatsApp Incorrect Authorization VulnerabilityUnknownCWE-863
CVE-2020-24363TP-LinkTL-WA855RETP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityUnknownCWE-306
CVE-2025-57819SangomaFreePBXSangoma FreePBX Authentication Bypass VulnerabilityUnknownCWE-89, CWE-288
CVE-2025-7775CitrixNetScalerCitrix NetScaler Memory Overflow VulnerabilityUnknownCWE-119
CVE-2025-48384GitGitGit Link Following VulnerabilityUnknownCWE-59, CWE-436
CVE-2024-8069CitrixSession RecordingCitrix Session Recording Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2024-8068CitrixSession RecordingCitrix Session Recording Improper Privilege Management VulnerabilityUnknownCWE-269
CVE-2025-43300AppleiOS, iPadOS, and macOSApple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2025-54948Trend MicroApex OneTrend Micro Apex One OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-8876N-ableN-CentralN-able N-Central Command Injection VulnerabilityUnknownnone listed
CVE-2025-8875N-ableN-CentralN-able N-Central Insecure Deserialization VulnerabilityUnknownnone listed
CVE-2025-8088RARLABWinRARRARLAB WinRAR Path Traversal VulnerabilityKnownCWE-35
CVE-2013-3893MicrosoftInternet ExplorerMicrosoft Internet Explorer Resource Management Errors VulnerabilityUnknownCWE-399
CVE-2007-0671MicrosoftOfficeMicrosoft Office Excel Remote Code Execution VulnerabilityUnknownnone listed
CVE-2022-40799D-LinkDNR-322LD-Link DNR-322L Download of Code Without Integrity Check VulnerabilityUnknownCWE-494
CVE-2020-25079D-LinkDCS-2530L and DCS-2670L DevicesD-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityUnknownCWE-77
CVE-2020-25078D-LinkDCS-2530L and DCS-2670L DevicesD-Link DCS-2530L and DCS-2670L Devices Unspecified VulnerabilityUnknownnone listed
CVE-2025-20337CiscoIdentity Services EngineCisco Identity Services Engine Injection VulnerabilityUnknownCWE-74
CVE-2025-20281CiscoIdentity Services EngineCisco Identity Services Engine Injection VulnerabilityUnknownCWE-74
CVE-2023-2533PaperCutNG/MFPaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityUnknownCWE-352
CVE-2025-6558GoogleChromiumGoogle Chromium ANGLE and GPU Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2025-54309CrushFTPCrushFTP CrushFTP Unprotected Alternate Channel VulnerabilityUnknownCWE-420
CVE-2025-49706MicrosoftSharePointMicrosoft SharePoint Improper Authentication VulnerabilityKnownCWE-287
CVE-2025-49704MicrosoftSharePointMicrosoft SharePoint Code Injection VulnerabilityKnownCWE-94
CVE-2025-2776SysAidSysAid On-PremSysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityUnknownCWE-611
CVE-2025-2775SysAidSysAid On-PremSysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityUnknownCWE-611
CVE-2025-53770MicrosoftSharePointMicrosoft SharePoint Deserialization of Untrusted Data VulnerabilityKnownCWE-502
CVE-2025-25257FortinetFortiWebFortinet FortiWeb SQL Injection VulnerabilityUnknownCWE-89
CVE-2025-47812Wing FTP ServerWing FTP ServerWing FTP Server Improper Neutralization of Null Byte or NUL Character VulnerabilityUnknownCWE-158
CVE-2025-5777CitrixNetScaler ADC and GatewayCitrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityKnownCWE-125
CVE-2019-9621SynacorZimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) VulnerabilityUnknownCWE-918, CWE-807
CVE-2019-5418RailsRuby on RailsRails Ruby on Rails Path Traversal VulnerabilityUnknownCWE-22
CVE-2016-10033PHPPHPMailerPHPMailer Command Injection VulnerabilityUnknownCWE-77, CWE-88
CVE-2014-3931Looking GlassMulti-Router Looking Glass (MRLG)Multi-Router Looking Glass (MRLG) Buffer Overflow VulnerabilityUnknownCWE-119
CVE-2025-6554GoogleChromium V8Google Chromium V8 Type Confusion VulnerabilityUnknownCWE-843
CVE-2025-48928TeleMessageTM SGNLTeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityUnknownCWE-528
CVE-2025-48927TeleMessageTM SGNLTeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityUnknownCWE-1188
CVE-2025-6543CitrixNetScaler ADC and GatewayCitrix NetScaler ADC and Gateway Buffer Overflow VulnerabilityUnknownCWE-119
CVE-2024-54085AMIMegaRAC SPxAMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityUnknownCWE-290
CVE-2024-0769D-LinkDIR-859 Router D-Link DIR-859 Router Path Traversal VulnerabilityUnknownCWE-22
CVE-2019-6693FortinetFortiOSFortinet FortiOS Use of Hard-Coded Credentials VulnerabilityKnownCWE-798
CVE-2023-0386LinuxKernelLinux Kernel Improper Ownership Management VulnerabilityUnknownCWE-282
CVE-2025-43200AppleMultiple ProductsApple Multiple Products Unspecified VulnerabilityUnknownnone listed
CVE-2023-33538TP-LinkMultiple RoutersTP-Link Multiple Routers Command Injection VulnerabilityUnknownCWE-77
CVE-2025-33053MicrosoftWindows Microsoft Windows External Control of File Name or Path VulnerabilityUnknownCWE-73
CVE-2025-24016WazuhWazuh ServerWazuh Server Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2025-32433ErlangErlang/OTPErlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityUnknownCWE-306
CVE-2024-42009RoundcubeWebmailRoundCube Webmail Cross-Site Scripting VulnerabilityUnknownCWE-79
CVE-2025-5419GoogleChromium V8Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityUnknownCWE-125, CWE-787
CVE-2025-27038QualcommMultiple ChipsetsQualcomm Multiple Chipsets Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-21480QualcommMultiple ChipsetsQualcomm Multiple Chipsets Incorrect Authorization VulnerabilityUnknownCWE-863
CVE-2025-21479QualcommMultiple ChipsetsQualcomm Multiple Chipsets Incorrect Authorization VulnerabilityUnknownCWE-863
CVE-2025-3935ConnectWiseScreenConnectConnectWise ScreenConnect Improper Authentication VulnerabilityUnknownCWE-287
CVE-2025-35939Craft CMSCraft CMSCraft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityUnknownCWE-472
CVE-2024-56145Craft CMSCraft CMSCraft CMS Code Injection VulnerabilityUnknownCWE-94
CVE-2023-39780ASUSRT-AX55 RoutersASUS RT-AX55 Routers OS Command Injection VulnerabilityUnknownCWE-78
CVE-2021-32030ASUSRoutersASUS Routers Improper Authentication VulnerabilityUnknownCWE-287
CVE-2025-4632SamsungMagicINFO 9 ServerSamsung MagicINFO 9 Server Path Traversal VulnerabilityUnknownCWE-22
CVE-2025-4428IvantiEndpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityUnknownCWE-94
CVE-2025-4427IvantiEndpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass VulnerabilityUnknownCWE-288
CVE-2025-27920SrimaxOutput MessengerSrimax Output Messenger Directory Traversal VulnerabilityUnknownCWE-22
CVE-2024-27443SynacorZimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityUnknownCWE-79
CVE-2024-11182MDaemonEmail ServerMDaemon Email Server Cross-Site Scripting (XSS) VulnerabilityUnknownCWE-79
CVE-2023-38950ZKTecoBioTimeZKTeco BioTime Path Traversal VulnerabilityUnknownCWE-22
CVE-2025-42999SAPNetWeaverSAP NetWeaver Deserialization VulnerabilityKnownCWE-502
CVE-2024-12987DrayTekVigor RoutersDrayTek Vigor Routers OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-32756FortinetMultiple ProductsFortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityUnknownCWE-124
CVE-2025-32709MicrosoftWindowsMicrosoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-32706MicrosoftWindowsMicrosoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityUnknownCWE-122
CVE-2025-32701MicrosoftWindowsMicrosoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-30400MicrosoftWindowsMicrosoft Windows DWM Core Library Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-30397MicrosoftWindowsMicrosoft Windows Scripting Engine Type Confusion VulnerabilityUnknownCWE-843
CVE-2025-47729TeleMessageTM SGNLTeleMessage TM SGNL Hidden Functionality VulnerabilityUnknownCWE-912
CVE-2024-6047GeoVisionMultiple DevicesGeoVision Devices OS Command Injection VulnerabilityUnknownCWE-78
CVE-2024-11120GeoVisionMultiple DevicesGeoVision Devices OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-27363FreeTypeFreeTypeFreeType Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2025-3248LangflowLangflowLangflow Missing Authentication VulnerabilityKnownCWE-306
CVE-2025-34028CommvaultCommand CenterCommvault Command Center Path Traversal VulnerabilityUnknownCWE-22
CVE-2024-58136YiiframeworkYiiYiiframework Yii Improper Protection of Alternate Path VulnerabilityUnknownCWE-424
CVE-2024-38475ApacheHTTP ServerApache HTTP Server Improper Escaping of Output VulnerabilityUnknownCWE-116
CVE-2023-44221SonicWallSMA100 AppliancesSonicWall SMA100 Appliances OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-31324SAPNetWeaverSAP NetWeaver Unrestricted File Upload VulnerabilityKnownCWE-434
CVE-2025-42599QualitiaActive! MailQualitia Active! Mail Stack-Based Buffer Overflow VulnerabilityUnknownCWE-121
CVE-2025-3928CommvaultWeb ServerCommvault Web Server Unspecified VulnerabilityUnknownnone listed
CVE-2025-1976BroadcomBrocade Fabric OSBroadcom Brocade Fabric OS Code Injection VulnerabilityUnknownCWE-94
CVE-2025-31201AppleMultiple ProductsApple Multiple Products Arbitrary Read and Write VulnerabilityUnknownnone listed
CVE-2025-31200AppleMultiple ProductsApple Multiple Products Memory Corruption VulnerabilityUnknownnone listed
CVE-2025-24054MicrosoftWindowsMicrosoft Windows NTLM Hash Disclosure Spoofing VulnerabilityUnknownCWE-73
CVE-2021-20035SonicWallSMA100 AppliancesSonicWall SMA100 Appliances OS Command Injection VulnerabilityUnknownCWE-78
CVE-2024-53197LinuxKernelLinux Kernel Out-of-Bounds Access VulnerabilityUnknownCWE-787
CVE-2024-53150LinuxKernelLinux Kernel Out-of-Bounds Read VulnerabilityUnknownCWE-125
CVE-2025-30406GladinetCentreStackGladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityUnknownCWE-321
CVE-2025-29824MicrosoftWindowsMicrosoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityKnownCWE-416
CVE-2025-31161CrushFTPCrushFTPCrushFTP Authentication Bypass VulnerabilityKnownCWE-305
CVE-2025-22457IvantiConnect Secure, Policy Secure, and ZTA GatewaysIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityKnownCWE-121
CVE-2025-24813ApacheTomcatApache Tomcat Path Equivalence VulnerabilityUnknownCWE-44, CWE-502
CVE-2024-20439CiscoSmart Licensing UtilityCisco Smart Licensing Utility Static Credential VulnerabilityUnknownCWE-912
CVE-2025-2783GoogleChromium MojoGoogle Chromium Mojo Sandbox Escape VulnerabilityUnknownnone listed
CVE-2019-9875SitecoreCMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityUnknownCWE-502
CVE-2019-9874SitecoreCMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityUnknownCWE-502
CVE-2025-30154reviewdogaction-setup GitHub Actionreviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityUnknownCWE-506
CVE-2025-1316EdimaxIC-7100 IP CameraEdimax IC-7100 IP Camera OS Command Injection VulnerabilityUnknownCWE-78
CVE-2024-48248NAKIVOBackup and ReplicationNAKIVO Backup and Replication Absolute Path Traversal VulnerabilityUnknownCWE-36
CVE-2017-12637SAPNetWeaverSAP NetWeaver Directory Traversal VulnerabilityUnknownCWE-22
CVE-2025-30066tj-actionschanged-files GitHub Actiontj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityUnknownCWE-506
CVE-2025-24472FortinetFortiOS and FortiProxyFortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityKnownCWE-288
CVE-2025-24201AppleMultiple ProductsApple Multiple Products WebKit Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2025-21590JuniperJunos OSJuniper Junos OS Improper Isolation or Compartmentalization VulnerabilityUnknownCWE-653
CVE-2025-26633MicrosoftWindowsMicrosoft Windows Management Console (MMC) Improper Neutralization VulnerabilityKnownCWE-707
CVE-2025-24993MicrosoftWindowsMicrosoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityUnknownCWE-122
CVE-2025-24991MicrosoftWindowsMicrosoft Windows NTFS Out-Of-Bounds Read VulnerabilityUnknownCWE-125
CVE-2025-24985MicrosoftWindowsMicrosoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityUnknownCWE-190, CWE-122
CVE-2025-24984MicrosoftWindowsMicrosoft Windows NTFS Information Disclosure VulnerabilityUnknownCWE-532
CVE-2025-24983MicrosoftWindowsMicrosoft Windows Win32k Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-25181AdvantiveVeraCore Advantive VeraCore SQL Injection VulnerabilityUnknownCWE-89
CVE-2024-57968AdvantiveVeraCoreAdvantive VeraCore Unrestricted File Upload VulnerabilityUnknownCWE-434
CVE-2024-13161IvantiEndpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityUnknownCWE-36
CVE-2024-13160IvantiEndpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityUnknownCWE-36
CVE-2024-13159IvantiEndpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityUnknownCWE-36
CVE-2025-22226VMwareESXi, Workstation, and FusionVMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityUnknownCWE-125
CVE-2025-22225VMwareESXiVMware ESXi Arbitrary Write VulnerabilityKnownCWE-123
CVE-2025-22224VMwareESXi and WorkstationVMware ESXi and Workstation TOCTOU Race Condition VulnerabilityUnknownCWE-367
CVE-2024-50302LinuxKernelLinux Kernel Use of Uninitialized Resource VulnerabilityUnknownCWE-908
CVE-2024-4885ProgressWhatsUp GoldProgress WhatsUp Gold Path Traversal VulnerabilityUnknownCWE-22
CVE-2023-20118CiscoSmall Business RV Series RoutersCisco Small Business RV Series Routers Command Injection VulnerabilityUnknownCWE-77
CVE-2022-43939Hitachi VantaraPentaho Business Analytics (BA) ServerHitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityUnknownCWE-647
CVE-2022-43769Hitachi VantaraPentaho Business Analytics (BA) ServerHitachi Vantara Pentaho BA Server Special Element Injection VulnerabilityUnknownCWE-74
CVE-2018-8639MicrosoftWindowsMicrosoft Windows Win32k Improper Resource Shutdown or Release VulnerabilityKnownCWE-404
CVE-2024-49035MicrosoftPartner CenterMicrosoft Partner Center Improper Access Control VulnerabilityUnknownCWE-269
CVE-2023-34192SynacorZimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityUnknownCWE-79
CVE-2024-20953OracleAgile Product Lifecycle Management (PLM)Oracle Agile Product Lifecycle Management (PLM) Deserialization VulnerabilityUnknownCWE-502
CVE-2017-3066AdobeColdFusionAdobe ColdFusion Deserialization VulnerabilityUnknownCWE-502
CVE-2025-24989MicrosoftPower PagesMicrosoft Power Pages Improper Access Control VulnerabilityUnknownCWE-284
CVE-2025-23209Craft CMSCraft CMSCraft CMS Code Injection VulnerabilityUnknownCWE-94
CVE-2025-0111Palo Alto NetworksPAN-OSPalo Alto Networks PAN-OS File Read VulnerabilityUnknownCWE-73
CVE-2025-0108Palo Alto NetworksPAN-OSPalo Alto Networks PAN-OS Authentication Bypass VulnerabilityUnknownCWE-306
CVE-2024-53704SonicWallSonicOSSonicWall SonicOS SSLVPN Improper Authentication VulnerabilityKnownCWE-287
CVE-2024-57727SimpleHelp SimpleHelpSimpleHelp Path Traversal VulnerabilityKnownCWE-22
CVE-2025-24200AppleiOS and iPadOSApple iOS and iPadOS Incorrect Authorization VulnerabilityUnknownCWE-863
CVE-2024-41710MitelSIP PhonesMitel SIP Phones Argument Injection VulnerabilityUnknownCWE-88
CVE-2025-21418MicrosoftWindowsMicrosoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityUnknownCWE-122
CVE-2025-21391MicrosoftWindowsMicrosoft Windows Storage Link Following VulnerabilityUnknownCWE-59
CVE-2024-40891ZyxelDSL CPE DevicesZyxel DSL CPE OS Command Injection VulnerabilityUnknownCWE-78
CVE-2024-40890ZyxelDSL CPE DevicesZyxel DSL CPE OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-0994TrimbleCityworksTrimble Cityworks Deserialization VulnerabilityUnknownCWE-502
CVE-2025-04117-Zip7-Zip7-Zip Mark of the Web Bypass VulnerabilityUnknownCWE-693
CVE-2024-21413MicrosoftOffice OutlookMicrosoft Outlook Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2022-23748AudinateDante DiscoveryDante Discovery Process Control VulnerabilityUnknownCWE-114
CVE-2020-29574SophosCyberoamOSCyberoamOS (CROS) SQL Injection VulnerabilityKnownCWE-89
CVE-2020-15069SophosXG FirewallSophos XG Firewall Buffer Overflow VulnerabilityUnknownCWE-120
CVE-2024-53104LinuxKernelLinux Kernel Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2024-45195ApacheOFBizApache OFBiz Forced Browsing VulnerabilityUnknownCWE-425
CVE-2024-29059Microsoft.NET FrameworkMicrosoft .NET Framework Information Disclosure VulnerabilityUnknownCWE-209
CVE-2018-9276PaesslerPRTG Network MonitorPaessler PRTG Network Monitor OS Command Injection VulnerabilityUnknownCWE-78
CVE-2018-19410PaesslerPRTG Network MonitorPaessler PRTG Network Monitor Local File Inclusion VulnerabilityUnknownnone listed
CVE-2025-24085AppleMultiple ProductsApple Multiple Products Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-23006SonicWallSMA1000 AppliancesSonicWall SMA1000 Appliances Deserialization VulnerabilityKnownCWE-502
CVE-2020-11023JQueryJQueryJQuery Cross-Site Scripting (XSS) VulnerabilityUnknownCWE-79
CVE-2024-50603AviatrixControllersAviatrix Controllers OS Command Injection VulnerabilityUnknownCWE-78
CVE-2025-21335MicrosoftWindowsMicrosoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-21334MicrosoftWindowsMicrosoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityUnknownCWE-416
CVE-2025-21333MicrosoftWindowsMicrosoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityUnknownCWE-122
CVE-2024-55591FortinetFortiOS and FortiProxyFortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityKnownCWE-288
CVE-2024-12686BeyondTrustPrivileged Remote Access (PRA) and Remote Support (RS)BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityUnknownCWE-78
CVE-2023-48365QlikSenseQlik Sense HTTP Tunneling VulnerabilityKnownCWE-444
CVE-2025-0282IvantiConnect Secure, Policy Secure, and ZTA GatewaysIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityKnownCWE-121
CVE-2024-55550MitelMiCollabMitel MiCollab Path Traversal VulnerabilityKnownCWE-22
CVE-2024-41713MitelMiCollabMitel MiCollab Path Traversal VulnerabilityKnownCWE-22
CVE-2020-2883OracleWebLogic ServerOracle WebLogic Server Unspecified VulnerabilityUnknownnone listed

Cite this

CISA added 245 vulnerabilities to its KEV catalog in 2025. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/kev/2025/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API