Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2025-1976 | Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute… | Broadcom / Brocade Fabric OS | Apr 28, 2025 | — | View → |
| CVE-2025-3928 | Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells. | Commvault / Web Server | Apr 28, 2025 | — | View → |
| CVE-2025-42599 | Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute… | Qualitia / Active! Mail | Apr 28, 2025 | — | View → |
| CVE-2025-24054 | Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform… | Microsoft / Windows | Apr 17, 2025 | — | View → |
| CVE-2025-31200 | Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when… | Apple / Multiple Products | Apr 17, 2025 | — | View → |
| CVE-2025-31201 | Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass… | Apple / Multiple Products | Apr 17, 2025 | — | View → |
| CVE-2021-20035 | SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated… | SonicWall / SMA100 Appliances | Apr 16, 2025 | — | View → |
| CVE-2024-53150 | Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain… | Linux / Kernel | Apr 9, 2025 | — | View → |
| CVE-2024-53197 | Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the… | Linux / Kernel | Apr 9, 2025 | — | View → |
| CVE-2025-29824 | Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to… | Microsoft / Windows | Apr 8, 2025 | Ransomware | View → |
| CVE-2025-30406 | Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys… | Gladinet / CentreStack | Apr 8, 2025 | — | View → |
| CVE-2025-31161 | CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to… | CrushFTP / CrushFTP | Apr 7, 2025 | Ransomware | View → |
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote… | Ivanti / Connect Secure, Policy Secure, and ZTA Gateways | Apr 4, 2025 | Ransomware | View → |
| CVE-2025-24813 | Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject… | Apache / Tomcat | Apr 1, 2025 | — | View → |
| CVE-2024-20439 | Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an… | Cisco / Smart Licensing Utility | Mar 31, 2025 | — | View → |
| CVE-2025-2783 | Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle… | Google / Chromium Mojo | Mar 27, 2025 | — | View → |
| CVE-2019-9874 | Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an… | Sitecore / CMS and Experience Platform (XP) | Mar 26, 2025 | — | View → |
| CVE-2019-9875 | Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an… | Sitecore / CMS and Experience Platform (XP) | Mar 26, 2025 | — | View → |
| CVE-2025-30154 | reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions… | reviewdog / action-setup GitHub Action | Mar 24, 2025 | — | View → |
| CVE-2017-12637 | SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in… | SAP / NetWeaver | Mar 19, 2025 | — | View → |