Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2009-0556 | Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a… | Microsoft / Office | Jan 7, 2026 | — | View → |
| CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform… | Hewlett Packard Enterprise (HPE) / OneView | Jan 7, 2026 | — | View → |
| CVE-2025-14847 | MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This… | MongoDB / MongoDB and MongoDB Server | Dec 29, 2025 | — | View → |
| CVE-2023-52163 | Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi. | Digiever / DS-2105 Pro | Dec 22, 2025 | — | View → |
| CVE-2025-14733 | WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a… | WatchGuard / Firebox | Dec 19, 2025 | Ransomware | View → |
| CVE-2025-20393 | Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability… | Cisco / Multiple Products | Dec 17, 2025 | — | View → |
| CVE-2025-40602 | SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console… | SonicWall / SMA1000 appliance | Dec 17, 2025 | — | View → |
| CVE-2025-59374 | ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced… | ASUS / Live Update | Dec 17, 2025 | — | View → |
| CVE-2025-59718 | Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability… | Fortinet / Multiple Products | Dec 16, 2025 | — | View → |
| CVE-2025-14611 | Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme.… | Gladinet / CentreStack and Triofox | Dec 15, 2025 | — | View → |
| CVE-2025-43529 | Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web… | Apple / Multiple Products | Dec 15, 2025 | — | View → |
| CVE-2018-4063 | Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request… | Sierra Wireless / AirLink ALEOS | Dec 12, 2025 | — | View → |
| CVE-2025-14174 | Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds… | Google / Chromium | Dec 12, 2025 | — | View → |
| CVE-2025-58360 | OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts… | OSGeo / GeoServer | Dec 11, 2025 | — | View → |
| CVE-2025-6218 | RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user. | RARLAB / WinRAR | Dec 9, 2025 | — | View → |
| CVE-2025-62221 | Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate… | Microsoft / Windows | Dec 9, 2025 | — | View → |
| CVE-2022-37055 | D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The… | D-Link / Routers | Dec 8, 2025 | — | View → |
| CVE-2025-66644 | Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. | Array Networks / ArrayOS AG | Dec 8, 2025 | — | View → |
| CVE-2025-55182 | Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by… | Meta / React Server Components | Dec 5, 2025 | Ransomware | View → |
| CVE-2021-26828 | OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload… | OpenPLC / ScadaBR | Dec 3, 2025 | — | View → |