Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to… | Ivanti / Endpoint Manager Mobile (EPMM) | May 19, 2025 | — | View → |
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker… | Ivanti / Endpoint Manager Mobile (EPMM) | May 19, 2025 | — | View → |
| CVE-2024-12987 | DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file… | DrayTek / Vigor Routers | May 15, 2025 | — | View → |
| CVE-2025-42999 | SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise… | SAP / NetWeaver | May 15, 2025 | Ransomware | View → |
| CVE-2025-32756 | Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote… | Fortinet / Multiple Products | May 14, 2025 | — | View → |
| CVE-2025-30397 | Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a… | Microsoft / Windows | May 13, 2025 | — | View → |
| CVE-2025-30400 | Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. | Microsoft / Windows | May 13, 2025 | — | View → |
| CVE-2025-32701 | Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to… | Microsoft / Windows | May 13, 2025 | — | View → |
| CVE-2025-32706 | Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized… | Microsoft / Windows | May 13, 2025 | — | View → |
| CVE-2025-32709 | Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to… | Microsoft / Windows | May 13, 2025 | — | View → |
| CVE-2025-47729 | TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from… | TeleMessage / TM SGNL | May 12, 2025 | — | View → |
| CVE-2024-11120 | Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and… | GeoVision / Multiple Devices | May 7, 2025 | — | View → |
| CVE-2024-6047 | Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and… | GeoVision / Multiple Devices | May 7, 2025 | — | View → |
| CVE-2025-27363 | FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and… | FreeType / FreeType | May 6, 2025 | — | View → |
| CVE-2025-3248 | Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated… | Langflow / Langflow | May 5, 2025 | Ransomware | View → |
| CVE-2024-58136 | Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code.… | Yiiframework / Yii | May 2, 2025 | — | View → |
| CVE-2025-34028 | Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. | Commvault / Command Center | May 2, 2025 | — | View → |
| CVE-2023-44221 | SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote,… | SonicWall / SMA100 Appliances | May 1, 2025 | — | View → |
| CVE-2024-38475 | Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem… | Apache / HTTP Server | May 1, 2025 | — | View → |
| CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to… | SAP / NetWeaver | Apr 29, 2025 | Ransomware | View → |