Security Digest · page 4 of 8
Known exploited vulnerabilities (page 4)
Every CVE CISA has added to its Known Exploited Vulnerabilities catalog since October 1, 2023 (748), newest first. If you run the product, these come first. Browse by vendor.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2025-11-04 | CVE-2025-11371 | Gladinet CentreStack and Triofox Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability | 2025-11-25 |
| 2025-10-30 | CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability | 2025-11-20 |
| 2025-10-30 | CVE-2025-24893 | XWiki Platform XWiki Platform Eval Injection Vulnerability | 2025-11-20 |
| 2025-10-28 | CVE-2025-6205 | Dassault Systèmes DELMIA Apriso Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability | 2025-11-18 |
| 2025-10-28 | CVE-2025-6204 | Dassault Systèmes DELMIA Apriso Dassault Systèmes DELMIA Apriso Code Injection Vulnerability | 2025-11-18 |
| 2025-10-24 | CVE-2025-59287 | Microsoft Windows Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability | 2025-11-14 |
| 2025-10-24 | CVE-2025-54236 | Adobe Commerce and Magento Adobe Commerce and Magento Improper Input Validation Vulnerability | 2025-11-14 |
| 2025-10-22 | CVE-2025-61932 | Motex LANSCOPE Endpoint Manager Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability | 2025-11-12 |
| 2025-10-20 | CVE-2025-61884 | Oracle E-Business Suite Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Ransomware | 2025-11-10 |
| 2025-10-20 | CVE-2025-33073 | Microsoft Windows Microsoft Windows SMB Client Improper Access Control Vulnerability | 2025-11-10 |
| 2025-10-20 | CVE-2025-2747 | Kentico Xperience CMS Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2025-11-10 |
| 2025-10-20 | CVE-2025-2746 | Kentico Xperience CMS Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2025-11-10 |
| 2025-10-20 | CVE-2022-48503 | Apple Multiple Products Apple Multiple Products Unspecified Vulnerability | 2025-11-10 |
| 2025-10-15 | CVE-2025-54253 | Adobe Experience Manager (AEM) Forms Adobe Experience Manager Forms Code Execution Vulnerability | 2025-11-05 |
| 2025-10-14 | CVE-2025-59230 | Microsoft Windows Microsoft Windows Improper Access Control Vulnerability | 2025-11-04 |
| 2025-10-14 | CVE-2025-47827 | IGEL IGEL OS IGEL OS Use of a Key Past its Expiration Date Vulnerability | 2025-11-04 |
| 2025-10-14 | CVE-2025-24990 | Microsoft Windows Microsoft Windows Untrusted Pointer Dereference Vulnerability | 2025-11-04 |
| 2025-10-14 | CVE-2016-7836 | SKYSEA Client View SKYSEA Client View Improper Authentication Vulnerability | 2025-11-04 |
| 2025-10-09 | CVE-2021-43798 | Grafana Labs Grafana Grafana Path Traversal Vulnerability | 2025-10-30 |
| 2025-10-07 | CVE-2025-27915 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 2025-10-28 |
| 2025-10-06 | CVE-2025-61882 | Oracle E-Business Suite Oracle E-Business Suite Unspecified Vulnerability Ransomware | 2025-10-27 |
| 2025-10-06 | CVE-2021-43226 | Microsoft Windows Microsoft Windows Privilege Escalation Vulnerability Ransomware | 2025-10-27 |
| 2025-10-06 | CVE-2021-22555 | Linux Kernel Linux Kernel Heap Out-of-Bounds Write Vulnerability | 2025-10-27 |
| 2025-10-06 | CVE-2013-3918 | Microsoft Windows Microsoft Windows Out-of-Bounds Write Vulnerability | 2025-10-27 |
| 2025-10-06 | CVE-2011-3402 | Microsoft Windows Microsoft Windows Remote Code Execution Vulnerability | 2025-10-27 |
| 2025-10-06 | CVE-2010-3962 | Microsoft Internet Explorer Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability | 2025-10-27 |
| 2025-10-06 | CVE-2010-3765 | Mozilla Multiple Products Mozilla Multiple Products Remote Code Execution Vulnerability | 2025-10-27 |
| 2025-10-02 | CVE-2025-4008 | Smartbedded Meteobridge Smartbedded Meteobridge Command Injection Vulnerability | 2025-10-23 |
| 2025-10-02 | CVE-2025-21043 | Samsung Mobile Devices Samsung Mobile Devices Out-of-Bounds Write Vulnerability | 2025-10-23 |
| 2025-10-02 | CVE-2017-1000353 | Jenkins Jenkins Jenkins Remote Code Execution Vulnerability | 2025-10-23 |
| 2025-10-02 | CVE-2015-7755 | Juniper ScreenOS Juniper ScreenOS Improper Authentication Vulnerability | 2025-10-23 |
| 2025-10-02 | CVE-2014-6278 | GNU GNU Bash GNU Bash OS Command Injection Vulnerability | 2025-10-23 |
| 2025-09-29 | CVE-2025-59689 | Libraesva Email Security Gateway Libraesva Email Security Gateway Command Injection Vulnerability | 2025-10-20 |
| 2025-09-29 | CVE-2025-32463 | Sudo Sudo Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability | 2025-10-20 |
| 2025-09-29 | CVE-2025-20352 | Cisco IOS and IOS XE Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability | 2025-10-20 |
| 2025-09-29 | CVE-2025-10035 | Fortra GoAnywhere MFT Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability Ransomware | 2025-10-20 |
| 2025-09-29 | CVE-2021-21311 | Adminer Adminer Adminer Server-Side Request Forgery Vulnerability | 2025-10-20 |
| 2025-09-25 | CVE-2025-20362 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | 2025-09-26 |
| 2025-09-25 | CVE-2025-20333 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | 2025-09-26 |
| 2025-09-23 | CVE-2025-10585 | Google Chromium V8 Google Chromium V8 Type Confusion Vulnerability | 2025-10-14 |
| 2025-09-11 | CVE-2025-5086 | Dassault Systèmes DELMIA Apriso Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability | 2025-10-02 |
| 2025-09-04 | CVE-2025-53690 | Sitecore Multiple Products Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability | 2025-09-25 |
| 2025-09-04 | CVE-2025-48543 | Android Runtime Android Runtime Use-After-Free Vulnerability | 2025-09-25 |
| 2025-09-04 | CVE-2025-38352 | Linux Kernel Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability | 2025-09-25 |
| 2025-09-03 | CVE-2025-9377 | TP-Link Multiple Routers TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability | 2025-09-24 |
| 2025-09-03 | CVE-2023-50224 | TP-Link TL-WR841N TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability | 2025-09-24 |
| 2025-09-02 | CVE-2025-55177 | Meta Platforms WhatsApp Meta Platforms WhatsApp Incorrect Authorization Vulnerability | 2025-09-23 |
| 2025-09-02 | CVE-2020-24363 | TP-Link TL-WA855RE TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability | 2025-09-23 |
| 2025-08-29 | CVE-2025-57819 | Sangoma FreePBX Sangoma FreePBX Authentication Bypass Vulnerability | 2025-09-19 |
| 2025-08-26 | CVE-2025-7775 | Citrix NetScaler Citrix NetScaler Memory Overflow Vulnerability | 2025-08-28 |
| 2025-08-25 | CVE-2025-48384 | Git Git Git Link Following Vulnerability | 2025-09-15 |
| 2025-08-25 | CVE-2024-8069 | Citrix Session Recording Citrix Session Recording Deserialization of Untrusted Data Vulnerability | 2025-09-15 |
| 2025-08-25 | CVE-2024-8068 | Citrix Session Recording Citrix Session Recording Improper Privilege Management Vulnerability | 2025-09-15 |
| 2025-08-21 | CVE-2025-43300 | Apple iOS, iPadOS, and macOS Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | 2025-09-11 |
| 2025-08-18 | CVE-2025-54948 | Trend Micro Apex One Trend Micro Apex One OS Command Injection Vulnerability | 2025-09-08 |
| 2025-08-13 | CVE-2025-8876 | N-able N-Central N-able N-Central Command Injection Vulnerability | 2025-08-20 |
| 2025-08-13 | CVE-2025-8875 | N-able N-Central N-able N-Central Insecure Deserialization Vulnerability | 2025-08-20 |
| 2025-08-12 | CVE-2025-8088 | RARLAB WinRAR RARLAB WinRAR Path Traversal Vulnerability Ransomware | 2025-09-02 |
| 2025-08-12 | CVE-2013-3893 | Microsoft Internet Explorer Microsoft Internet Explorer Resource Management Errors Vulnerability | 2025-09-02 |
| 2025-08-12 | CVE-2007-0671 | Microsoft Office Microsoft Office Excel Remote Code Execution Vulnerability | 2025-09-02 |
| 2025-08-05 | CVE-2022-40799 | D-Link DNR-322L D-Link DNR-322L Download of Code Without Integrity Check Vulnerability | 2025-08-26 |
| 2025-08-05 | CVE-2020-25079 | D-Link DCS-2530L and DCS-2670L Devices D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability | 2025-08-26 |
| 2025-08-05 | CVE-2020-25078 | D-Link DCS-2530L and DCS-2670L Devices D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability | 2025-08-26 |
| 2025-07-28 | CVE-2025-20337 | Cisco Identity Services Engine Cisco Identity Services Engine Injection Vulnerability | 2025-08-18 |
| 2025-07-28 | CVE-2025-20281 | Cisco Identity Services Engine Cisco Identity Services Engine Injection Vulnerability | 2025-08-18 |
| 2025-07-28 | CVE-2023-2533 | PaperCut NG/MF PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability | 2025-08-18 |
| 2025-07-22 | CVE-2025-6558 | Google Chromium Google Chromium ANGLE and GPU Improper Input Validation Vulnerability | 2025-08-12 |
| 2025-07-22 | CVE-2025-54309 | CrushFTP CrushFTP CrushFTP Unprotected Alternate Channel Vulnerability | 2025-08-12 |
| 2025-07-22 | CVE-2025-49706 | Microsoft SharePoint Microsoft SharePoint Improper Authentication Vulnerability Ransomware | 2025-07-23 |
| 2025-07-22 | CVE-2025-49704 | Microsoft SharePoint Microsoft SharePoint Code Injection Vulnerability Ransomware | 2025-07-23 |
| 2025-07-22 | CVE-2025-2776 | SysAid SysAid On-Prem SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability | 2025-08-12 |
| 2025-07-22 | CVE-2025-2775 | SysAid SysAid On-Prem SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability | 2025-08-12 |
| 2025-07-20 | CVE-2025-53770 | Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Ransomware | 2025-07-21 |
| 2025-07-18 | CVE-2025-25257 | Fortinet FortiWeb Fortinet FortiWeb SQL Injection Vulnerability | 2025-08-08 |
| 2025-07-14 | CVE-2025-47812 | Wing FTP Server Wing FTP Server Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability | 2025-08-04 |
| 2025-07-10 | CVE-2025-5777 | Citrix NetScaler ADC and Gateway Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability Ransomware | 2025-07-11 |
| 2025-07-07 | CVE-2019-9621 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability | 2025-07-28 |
| 2025-07-07 | CVE-2019-5418 | Rails Ruby on Rails Rails Ruby on Rails Path Traversal Vulnerability | 2025-07-28 |
| 2025-07-07 | CVE-2016-10033 | PHP PHPMailer PHPMailer Command Injection Vulnerability | 2025-07-28 |
| 2025-07-07 | CVE-2014-3931 | Looking Glass Multi-Router Looking Glass (MRLG) Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability | 2025-07-28 |
| 2025-07-02 | CVE-2025-6554 | Google Chromium V8 Google Chromium V8 Type Confusion Vulnerability | 2025-07-23 |
| 2025-07-01 | CVE-2025-48928 | TeleMessage TM SGNL TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability | 2025-07-22 |
| 2025-07-01 | CVE-2025-48927 | TeleMessage TM SGNL TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability | 2025-07-22 |
| 2025-06-30 | CVE-2025-6543 | Citrix NetScaler ADC and Gateway Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | 2025-07-21 |
| 2025-06-25 | CVE-2024-54085 | AMI MegaRAC SPx AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability | 2025-07-16 |
| 2025-06-25 | CVE-2024-0769 | D-Link DIR-859 Router D-Link DIR-859 Router Path Traversal Vulnerability | 2025-07-16 |
| 2025-06-25 | CVE-2019-6693 | Fortinet FortiOS Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability Ransomware | 2025-07-16 |
| 2025-06-17 | CVE-2023-0386 | Linux Kernel Linux Kernel Improper Ownership Management Vulnerability | 2025-07-08 |
| 2025-06-16 | CVE-2025-43200 | Apple Multiple Products Apple Multiple Products Unspecified Vulnerability | 2025-07-07 |
| 2025-06-16 | CVE-2023-33538 | TP-Link Multiple Routers TP-Link Multiple Routers Command Injection Vulnerability | 2025-07-07 |
| 2025-06-10 | CVE-2025-33053 | Microsoft Windows Microsoft Windows External Control of File Name or Path Vulnerability | 2025-07-01 |
| 2025-06-10 | CVE-2025-24016 | Wazuh Wazuh Server Wazuh Server Deserialization of Untrusted Data Vulnerability | 2025-07-01 |
| 2025-06-09 | CVE-2025-32433 | Erlang Erlang/OTP Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability | 2025-06-30 |
| 2025-06-09 | CVE-2024-42009 | Roundcube Webmail RoundCube Webmail Cross-Site Scripting Vulnerability | 2025-06-30 |
| 2025-06-05 | CVE-2025-5419 | Google Chromium V8 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2025-06-26 |
| 2025-06-03 | CVE-2025-27038 | Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2025-06-24 |
| 2025-06-03 | CVE-2025-21480 | Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 2025-06-24 |
| 2025-06-03 | CVE-2025-21479 | Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 2025-06-24 |
| 2025-06-02 | CVE-2025-3935 | ConnectWise ScreenConnect ConnectWise ScreenConnect Improper Authentication Vulnerability | 2025-06-23 |
| 2025-06-02 | CVE-2025-35939 | Craft CMS Craft CMS Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability | 2025-06-23 |