--- title: "Known exploited vulnerabilities (page 3)" url: https://erroneo.us/security/kev/3/ description: "All 748 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog since October 2023, newest first, with federal due dates. Page 3 of 8." type: kev section: "Security Digest" date_modified: 2026-03-27 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Known exploited vulnerabilities (page 3) - 2026-03-27 [CVE-2025-53521](https://erroneo.us/security/cve/CVE-2025-53521/index.md) F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability (due 2026-03-30; ransomware: Unknown) - 2026-03-26 [CVE-2026-33634](https://erroneo.us/security/cve/CVE-2026-33634/index.md) Aquasecurity Trivy: Aquasecurity Trivy Embedded Malicious Code Vulnerability (due 2026-04-09; ransomware: Unknown) - 2026-03-25 [CVE-2026-33017](https://erroneo.us/security/cve/CVE-2026-33017/index.md) Langflow Langflow: Langflow Code Injection Vulnerability (due 2026-04-08; ransomware: Unknown) - 2026-03-20 [CVE-2025-54068](https://erroneo.us/security/cve/CVE-2025-54068/index.md) Laravel Livewire: Laravel Livewire Code Injection Vulnerability (due 2026-04-03; ransomware: Unknown) - 2026-03-20 [CVE-2025-43520](https://erroneo.us/security/cve/CVE-2025-43520/index.md) Apple Multiple Products: Apple Multiple Products Classic Buffer Overflow Vulnerability (due 2026-04-03; ransomware: Unknown) - 2026-03-20 [CVE-2025-43510](https://erroneo.us/security/cve/CVE-2025-43510/index.md) Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability (due 2026-04-03; ransomware: Unknown) - 2026-03-20 [CVE-2025-32432](https://erroneo.us/security/cve/CVE-2025-32432/index.md) Craft CMS Craft CMS: Craft CMS Code Injection Vulnerability (due 2026-04-03; ransomware: Unknown) - 2026-03-20 [CVE-2025-31277](https://erroneo.us/security/cve/CVE-2025-31277/index.md) Apple Multiple Products: Apple Multiple Products Buffer Overflow Vulnerability (due 2026-04-03; ransomware: Unknown) - 2026-03-19 [CVE-2026-20131](https://erroneo.us/security/cve/CVE-2026-20131/index.md) Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability (due 2026-03-22; ransomware: Known) - 2026-03-18 [CVE-2026-20963](https://erroneo.us/security/cve/CVE-2026-20963/index.md) Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (due 2026-03-21; ransomware: Unknown) - 2026-03-18 [CVE-2025-66376](https://erroneo.us/security/cve/CVE-2025-66376/index.md) Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability (due 2026-04-01; ransomware: Unknown) - 2026-03-16 [CVE-2025-47813](https://erroneo.us/security/cve/CVE-2025-47813/index.md) Wing FTP Server Wing FTP Server: Wing FTP Server Information Disclosure Vulnerability (due 2026-03-30; ransomware: Unknown) - 2026-03-13 [CVE-2026-3910](https://erroneo.us/security/cve/CVE-2026-3910/index.md) Google Chromium V8: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability (due 2026-03-27; ransomware: Unknown) - 2026-03-13 [CVE-2026-3909](https://erroneo.us/security/cve/CVE-2026-3909/index.md) Google Skia: Google Skia Out-of-Bounds Write Vulnerability (due 2026-03-27; ransomware: Unknown) - 2026-03-11 [CVE-2025-68613](https://erroneo.us/security/cve/CVE-2025-68613/index.md) n8n n8n: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability (due 2026-03-25; ransomware: Unknown) - 2026-03-09 [CVE-2026-1603](https://erroneo.us/security/cve/CVE-2026-1603/index.md) Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (due 2026-03-23; ransomware: Unknown) - 2026-03-09 [CVE-2025-26399](https://erroneo.us/security/cve/CVE-2025-26399/index.md) SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (due 2026-03-12; ransomware: Known) - 2026-03-09 [CVE-2021-22054](https://erroneo.us/security/cve/CVE-2021-22054/index.md) Omnissa Workspace One UEM: Omnissa Workspace ONE Server-Side Request Forgery (due 2026-03-23; ransomware: Unknown) - 2026-03-05 [CVE-2023-43000](https://erroneo.us/security/cve/CVE-2023-43000/index.md) Apple Multiple Products: Apple Multiple products Use-After-Free Vulnerability (due 2026-03-26; ransomware: Unknown) - 2026-03-05 [CVE-2023-41974](https://erroneo.us/security/cve/CVE-2023-41974/index.md) Apple iOS and iPadOS: Apple iOS and iPadOS Use-After-Free Vulnerability (due 2026-03-26; ransomware: Unknown) - 2026-03-05 [CVE-2021-30952](https://erroneo.us/security/cve/CVE-2021-30952/index.md) Apple Multiple Products: Apple Multiple Products Integer Overflow or Wraparound Vulnerability (due 2026-03-26; ransomware: Unknown) - 2026-03-05 [CVE-2021-22681](https://erroneo.us/security/cve/CVE-2021-22681/index.md) Rockwell Multiple Products: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability (due 2026-03-26; ransomware: Unknown) - 2026-03-05 [CVE-2017-7921](https://erroneo.us/security/cve/CVE-2017-7921/index.md) Hikvision Multiple Products: Hikvision Multiple Products Improper Authentication Vulnerability (due 2026-03-26; ransomware: Unknown) - 2026-03-03 [CVE-2026-22719](https://erroneo.us/security/cve/CVE-2026-22719/index.md) Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability (due 2026-03-24; ransomware: Unknown) - 2026-03-03 [CVE-2026-21385](https://erroneo.us/security/cve/CVE-2026-21385/index.md) Qualcomm Multiple Chipsets: Qualcomm Multiple Chipsets Memory Corruption Vulnerability (due 2026-03-24; ransomware: Unknown) - 2026-02-25 [CVE-2026-20127](https://erroneo.us/security/cve/CVE-2026-20127/index.md) Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (due 2026-02-27; ransomware: Unknown) - 2026-02-25 [CVE-2022-20775](https://erroneo.us/security/cve/CVE-2022-20775/index.md) Cisco SD-WAN: Cisco SD-WAN Path Traversal Vulnerability (due 2026-02-27; ransomware: Unknown) - 2026-02-24 [CVE-2026-25108](https://erroneo.us/security/cve/CVE-2026-25108/index.md) Soliton Systems K.K FileZen: Soliton Systems K.K FileZen OS Command Injection Vulnerability (due 2026-03-17; ransomware: Unknown) - 2026-02-20 [CVE-2025-68461](https://erroneo.us/security/cve/CVE-2025-68461/index.md) Roundcube Webmail: RoundCube Webmail Cross-site Scripting Vulnerability (due 2026-03-13; ransomware: Unknown) - 2026-02-20 [CVE-2025-49113](https://erroneo.us/security/cve/CVE-2025-49113/index.md) Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability (due 2026-03-13; ransomware: Unknown) - 2026-02-18 [CVE-2026-22769](https://erroneo.us/security/cve/CVE-2026-22769/index.md) Dell RecoverPoint for Virtual Machines (RP4VMs): Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability (due 2026-02-21; ransomware: Unknown) - 2026-02-18 [CVE-2021-22175](https://erroneo.us/security/cve/CVE-2021-22175/index.md) GitLab GitLab: GitLab Server-Side Request Forgery (SSRF) Vulnerability (due 2026-03-11; ransomware: Unknown) - 2026-02-17 [CVE-2026-2441](https://erroneo.us/security/cve/CVE-2026-2441/index.md) Google Chromium: Google Chromium CSS Use-After-Free Vulnerability (due 2026-03-10; ransomware: Unknown) - 2026-02-17 [CVE-2024-7694](https://erroneo.us/security/cve/CVE-2024-7694/index.md) TeamT5 ThreatSonar Anti-Ransomware: TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability (due 2026-03-10; ransomware: Unknown) - 2026-02-17 [CVE-2020-7796](https://erroneo.us/security/cve/CVE-2020-7796/index.md) Synacor Zimbra Collaboration Suite: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability (due 2026-03-10; ransomware: Unknown) - 2026-02-17 [CVE-2008-0015](https://erroneo.us/security/cve/CVE-2008-0015/index.md) Microsoft Windows: Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability (due 2026-03-10; ransomware: Unknown) - 2026-02-13 [CVE-2026-1731](https://erroneo.us/security/cve/CVE-2026-1731/index.md) BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability (due 2026-02-16; ransomware: Known) - 2026-02-12 [CVE-2026-20700](https://erroneo.us/security/cve/CVE-2026-20700/index.md) Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability (due 2026-03-05; ransomware: Unknown) - 2026-02-12 [CVE-2025-40536](https://erroneo.us/security/cve/CVE-2025-40536/index.md) SolarWinds Web Help Desk: SolarWinds Web Help Desk Security Control Bypass Vulnerability (due 2026-02-15; ransomware: Unknown) - 2026-02-12 [CVE-2025-15556](https://erroneo.us/security/cve/CVE-2025-15556/index.md) Notepad++ Notepad++: Notepad++ Download of Code Without Integrity Check Vulnerability (due 2026-03-05; ransomware: Unknown) - 2026-02-12 [CVE-2024-43468](https://erroneo.us/security/cve/CVE-2024-43468/index.md) Microsoft Configuration Manager: Microsoft Configuration Manager SQL Injection Vulnerability (due 2026-03-05; ransomware: Unknown) - 2026-02-10 [CVE-2026-21533](https://erroneo.us/security/cve/CVE-2026-21533/index.md) Microsoft Windows: Microsoft Windows Improper Privilege Management Vulnerability (due 2026-03-03; ransomware: Unknown) - 2026-02-10 [CVE-2026-21525](https://erroneo.us/security/cve/CVE-2026-21525/index.md) Microsoft Windows: Microsoft Windows NULL Pointer Dereference Vulnerability (due 2026-03-03; ransomware: Unknown) - 2026-02-10 [CVE-2026-21519](https://erroneo.us/security/cve/CVE-2026-21519/index.md) Microsoft Windows: Microsoft Windows Type Confusion Vulnerability (due 2026-03-03; ransomware: Unknown) - 2026-02-10 [CVE-2026-21514](https://erroneo.us/security/cve/CVE-2026-21514/index.md) Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability (due 2026-03-03; ransomware: Unknown) - 2026-02-10 [CVE-2026-21513](https://erroneo.us/security/cve/CVE-2026-21513/index.md) Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability (due 2026-03-03; ransomware: Unknown) - 2026-02-10 [CVE-2026-21510](https://erroneo.us/security/cve/CVE-2026-21510/index.md) Microsoft Windows: Microsoft Windows Shell Protection Mechanism Failure Vulnerability (due 2026-03-03; ransomware: Unknown) - 2026-02-05 [CVE-2026-24423](https://erroneo.us/security/cve/CVE-2026-24423/index.md) SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability (due 2026-02-26; ransomware: Known) - 2026-02-05 [CVE-2025-11953](https://erroneo.us/security/cve/CVE-2025-11953/index.md) React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability (due 2026-02-26; ransomware: Unknown) - 2026-02-03 [CVE-2025-64328](https://erroneo.us/security/cve/CVE-2025-64328/index.md) Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability (due 2026-02-24; ransomware: Unknown) - 2026-02-03 [CVE-2025-40551](https://erroneo.us/security/cve/CVE-2025-40551/index.md) SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (due 2026-02-06; ransomware: Unknown) - 2026-02-03 [CVE-2021-39935](https://erroneo.us/security/cve/CVE-2021-39935/index.md) GitLab Community and Enterprise Editions: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability (due 2026-02-24; ransomware: Unknown) - 2026-02-03 [CVE-2019-19006](https://erroneo.us/security/cve/CVE-2019-19006/index.md) Sangoma FreePBX: Sangoma FreePBX Improper Authentication Vulnerability (due 2026-02-24; ransomware: Unknown) - 2026-01-29 [CVE-2026-1281](https://erroneo.us/security/cve/CVE-2026-1281/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (due 2026-02-01; ransomware: Unknown) - 2026-01-27 [CVE-2026-24858](https://erroneo.us/security/cve/CVE-2026-24858/index.md) Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability (due 2026-01-30; ransomware: Unknown) - 2026-01-26 [CVE-2026-24061](https://erroneo.us/security/cve/CVE-2026-24061/index.md) GNU InetUtils: GNU InetUtils Argument Injection Vulnerability (due 2026-02-16; ransomware: Unknown) - 2026-01-26 [CVE-2026-23760](https://erroneo.us/security/cve/CVE-2026-23760/index.md) SmarterTools SmarterMail: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability (due 2026-02-16; ransomware: Known) - 2026-01-26 [CVE-2026-21509](https://erroneo.us/security/cve/CVE-2026-21509/index.md) Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability (due 2026-02-16; ransomware: Unknown) - 2026-01-26 [CVE-2025-52691](https://erroneo.us/security/cve/CVE-2025-52691/index.md) SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability (due 2026-02-16; ransomware: Known) - 2026-01-26 [CVE-2018-14634](https://erroneo.us/security/cve/CVE-2018-14634/index.md) Linux Kernel: Linux Kernel Integer Overflow Vulnerability (due 2026-02-16; ransomware: Unknown) - 2026-01-23 [CVE-2024-37079](https://erroneo.us/security/cve/CVE-2024-37079/index.md) Broadcom VMware vCenter Server: Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability (due 2026-02-13; ransomware: Unknown) - 2026-01-22 [CVE-2025-68645](https://erroneo.us/security/cve/CVE-2025-68645/index.md) Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability (due 2026-02-12; ransomware: Unknown) - 2026-01-22 [CVE-2025-54313](https://erroneo.us/security/cve/CVE-2025-54313/index.md) Prettier eslint-config-prettier: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability (due 2026-02-12; ransomware: Unknown) - 2026-01-22 [CVE-2025-34026](https://erroneo.us/security/cve/CVE-2025-34026/index.md) Versa Concerto: Versa Concerto Improper Authentication Vulnerability (due 2026-02-12; ransomware: Unknown) - 2026-01-22 [CVE-2025-31125](https://erroneo.us/security/cve/CVE-2025-31125/index.md) Vite Vitejs: Vite Vitejs Improper Access Control Vulnerability (due 2026-02-12; ransomware: Unknown) - 2026-01-21 [CVE-2026-20045](https://erroneo.us/security/cve/CVE-2026-20045/index.md) Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability (due 2026-02-11; ransomware: Unknown) - 2026-01-13 [CVE-2026-20805](https://erroneo.us/security/cve/CVE-2026-20805/index.md) Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability (due 2026-02-03; ransomware: Unknown) - 2026-01-12 [CVE-2025-8110](https://erroneo.us/security/cve/CVE-2025-8110/index.md) Gogs Gogs: Gogs Path Traversal Vulnerability (due 2026-02-02; ransomware: Unknown) - 2026-01-07 [CVE-2025-37164](https://erroneo.us/security/cve/CVE-2025-37164/index.md) Hewlett Packard Enterprise (HPE) OneView: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability (due 2026-01-28; ransomware: Unknown) - 2026-01-07 [CVE-2009-0556](https://erroneo.us/security/cve/CVE-2009-0556/index.md) Microsoft Office: Microsoft Office PowerPoint Code Injection Vulnerability (due 2026-01-28; ransomware: Unknown) - 2025-12-29 [CVE-2025-14847](https://erroneo.us/security/cve/CVE-2025-14847/index.md) MongoDB MongoDB and MongoDB Server: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability (due 2026-01-19; ransomware: Unknown) - 2025-12-22 [CVE-2023-52163](https://erroneo.us/security/cve/CVE-2023-52163/index.md) Digiever DS-2105 Pro: Digiever DS-2105 Pro Missing Authorization Vulnerability (due 2026-01-12; ransomware: Unknown) - 2025-12-19 [CVE-2025-14733](https://erroneo.us/security/cve/CVE-2025-14733/index.md) WatchGuard Firebox: WatchGuard Firebox Out of Bounds Write Vulnerability (due 2025-12-26; ransomware: Known) - 2025-12-17 [CVE-2025-59374](https://erroneo.us/security/cve/CVE-2025-59374/index.md) ASUS Live Update: ASUS Live Update Embedded Malicious Code Vulnerability (due 2026-01-07; ransomware: Unknown) - 2025-12-17 [CVE-2025-40602](https://erroneo.us/security/cve/CVE-2025-40602/index.md) SonicWall SMA1000 appliance: SonicWall SMA1000 Missing Authorization Vulnerability (due 2025-12-24; ransomware: Unknown) - 2025-12-17 [CVE-2025-20393](https://erroneo.us/security/cve/CVE-2025-20393/index.md) Cisco Multiple Products: Cisco Multiple Products Improper Input Validation Vulnerability (due 2025-12-24; ransomware: Unknown) - 2025-12-16 [CVE-2025-59718](https://erroneo.us/security/cve/CVE-2025-59718/index.md) Fortinet Multiple Products: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability (due 2025-12-23; ransomware: Unknown) - 2025-12-15 [CVE-2025-43529](https://erroneo.us/security/cve/CVE-2025-43529/index.md) Apple Multiple Products: Apple Multiple Products Use-After-Free WebKit Vulnerability (due 2026-01-05; ransomware: Unknown) - 2025-12-15 [CVE-2025-14611](https://erroneo.us/security/cve/CVE-2025-14611/index.md) Gladinet CentreStack and Triofox: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability (due 2026-01-05; ransomware: Unknown) - 2025-12-12 [CVE-2025-14174](https://erroneo.us/security/cve/CVE-2025-14174/index.md) Google Chromium: Google Chromium Out of Bounds Memory Access Vulnerability (due 2026-01-02; ransomware: Unknown) - 2025-12-12 [CVE-2018-4063](https://erroneo.us/security/cve/CVE-2018-4063/index.md) Sierra Wireless AirLink ALEOS: Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (due 2026-01-02; ransomware: Unknown) - 2025-12-11 [CVE-2025-58360](https://erroneo.us/security/cve/CVE-2025-58360/index.md) OSGeo GeoServer: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (due 2026-01-01; ransomware: Unknown) - 2025-12-09 [CVE-2025-62221](https://erroneo.us/security/cve/CVE-2025-62221/index.md) Microsoft Windows: Microsoft Windows Use After Free Vulnerability (due 2025-12-30; ransomware: Unknown) - 2025-12-09 [CVE-2025-6218](https://erroneo.us/security/cve/CVE-2025-6218/index.md) RARLAB WinRAR: RARLAB WinRAR Path Traversal Vulnerability (due 2025-12-30; ransomware: Unknown) - 2025-12-08 [CVE-2025-66644](https://erroneo.us/security/cve/CVE-2025-66644/index.md) Array Networks ArrayOS AG: Array Networks ArrayOS AG OS Command Injection Vulnerability (due 2025-12-29; ransomware: Unknown) - 2025-12-08 [CVE-2022-37055](https://erroneo.us/security/cve/CVE-2022-37055/index.md) D-Link Routers: D-Link Routers Buffer Overflow Vulnerability (due 2025-12-29; ransomware: Unknown) - 2025-12-05 [CVE-2025-55182](https://erroneo.us/security/cve/CVE-2025-55182/index.md) Meta React Server Components: Meta React Server Components Remote Code Execution Vulnerability (due 2025-12-12; ransomware: Known) - 2025-12-03 [CVE-2021-26828](https://erroneo.us/security/cve/CVE-2021-26828/index.md) OpenPLC ScadaBR: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability (due 2025-12-24; ransomware: Unknown) - 2025-12-02 [CVE-2025-48633](https://erroneo.us/security/cve/CVE-2025-48633/index.md) Android Framework: Android Framework Information Disclosure Vulnerability (due 2025-12-23; ransomware: Unknown) - 2025-12-02 [CVE-2025-48572](https://erroneo.us/security/cve/CVE-2025-48572/index.md) Android Framework: Android Framework Privilege Escalation Vulnerability (due 2025-12-23; ransomware: Unknown) - 2025-11-28 [CVE-2021-26829](https://erroneo.us/security/cve/CVE-2021-26829/index.md) OpenPLC ScadaBR: OpenPLC ScadaBR Cross-site Scripting Vulnerability (due 2025-12-19; ransomware: Unknown) - 2025-11-21 [CVE-2025-61757](https://erroneo.us/security/cve/CVE-2025-61757/index.md) Oracle Fusion Middleware: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability (due 2025-12-12; ransomware: Unknown) - 2025-11-19 [CVE-2025-13223](https://erroneo.us/security/cve/CVE-2025-13223/index.md) Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability (due 2025-12-10; ransomware: Unknown) - 2025-11-18 [CVE-2025-58034](https://erroneo.us/security/cve/CVE-2025-58034/index.md) Fortinet FortiWeb: Fortinet FortiWeb OS Command Injection Vulnerability (due 2025-11-25; ransomware: Unknown) - 2025-11-14 [CVE-2025-64446](https://erroneo.us/security/cve/CVE-2025-64446/index.md) Fortinet FortiWeb: Fortinet FortiWeb Path Traversal Vulnerability (due 2025-11-21; ransomware: Unknown) - 2025-11-12 [CVE-2025-9242](https://erroneo.us/security/cve/CVE-2025-9242/index.md) WatchGuard Firebox: WatchGuard Firebox Out-of-Bounds Write Vulnerability (due 2025-12-03; ransomware: Unknown) - 2025-11-12 [CVE-2025-62215](https://erroneo.us/security/cve/CVE-2025-62215/index.md) Microsoft Windows: Microsoft Windows Race Condition Vulnerability (due 2025-12-03; ransomware: Unknown) - 2025-11-12 [CVE-2025-12480](https://erroneo.us/security/cve/CVE-2025-12480/index.md) Gladinet Triofox: Gladinet Triofox Improper Access Control Vulnerability (due 2025-12-03; ransomware: Unknown) - 2025-11-10 [CVE-2025-21042](https://erroneo.us/security/cve/CVE-2025-21042/index.md) Samsung Mobile Devices: Samsung Mobile Devices Out-of-Bounds Write Vulnerability (due 2025-12-01; ransomware: Unknown) - 2025-11-04 [CVE-2025-48703](https://erroneo.us/security/cve/CVE-2025-48703/index.md) CWP Control Web Panel: CWP Control Web Panel OS Command Injection Vulnerability (due 2025-11-25; ransomware: Unknown) Pages: https://erroneo.us/security/kev/index.md · https://erroneo.us/security/kev/2/index.md · https://erroneo.us/security/kev/3/index.md · https://erroneo.us/security/kev/4/index.md · https://erroneo.us/security/kev/5/index.md · https://erroneo.us/security/kev/6/index.md · https://erroneo.us/security/kev/7/index.md · https://erroneo.us/security/kev/8/index.md --- Source page: https://erroneo.us/security/kev/3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt