Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2025-48572 | Android Framework contains an unspecified vulnerability that allows for privilege escalation. | Android / Framework | Dec 2, 2025 | — | View → |
| CVE-2025-48633 | Android Framework contains an unspecified vulnerability that allows for information disclosure. | Android / Framework | Dec 2, 2025 | — | View → |
| CVE-2021-26829 | OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. | OpenPLC / ScadaBR | Nov 28, 2025 | — | View → |
| CVE-2025-61757 | Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers… | Oracle / Fusion Middleware | Nov 21, 2025 | — | View → |
| CVE-2025-13223 | Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. | Google / Chromium V8 | Nov 19, 2025 | — | View → |
| CVE-2025-58034 | Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on… | Fortinet / FortiWeb | Nov 18, 2025 | — | View → |
| CVE-2025-64446 | Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative… | Fortinet / FortiWeb | Nov 14, 2025 | — | View → |
| CVE-2025-12480 | Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. | Gladinet / Triofox | Nov 12, 2025 | — | View → |
| CVE-2025-62215 | Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate… | Microsoft / Windows | Nov 12, 2025 | — | View → |
| CVE-2025-9242 | WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker… | WatchGuard / Firebox | Nov 12, 2025 | — | View → |
| CVE-2025-21042 | Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote… | Samsung / Mobile Devices | Nov 10, 2025 | — | View → |
| CVE-2025-11371 | Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended… | Gladinet / CentreStack and Triofox | Nov 4, 2025 | — | View → |
| CVE-2025-48703 | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code… | CWP / Control Web Panel | Nov 4, 2025 | — | View → |
| CVE-2025-24893 | XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a… | XWiki / Platform | Oct 30, 2025 | — | View → |
| CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor… | Broadcom / VMware Aria Operations and VMware Tools | Oct 30, 2025 | — | View → |
| CVE-2025-6204 | Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. | Dassault Systèmes / DELMIA Apriso | Oct 28, 2025 | — | View → |
| CVE-2025-6205 | Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to… | Dassault Systèmes / DELMIA Apriso | Oct 28, 2025 | — | View → |
| CVE-2025-54236 | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over… | Adobe / Commerce and Magento | Oct 24, 2025 | — | View → |
| CVE-2025-59287 | Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code… | Microsoft / Windows | Oct 24, 2025 | — | View → |
| CVE-2025-61932 | Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker… | Motex / LANSCOPE Endpoint Manager | Oct 22, 2025 | — | View → |