Security Digest · page 5 of 8
Known exploited vulnerabilities (page 5)
Every CVE CISA has added to its Known Exploited Vulnerabilities catalog since October 1, 2023 (748), newest first. If you run the product, these come first. Browse by vendor.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2025-06-02 | CVE-2024-56145 | Craft CMS Craft CMS Craft CMS Code Injection Vulnerability | 2025-06-23 |
| 2025-06-02 | CVE-2023-39780 | ASUS RT-AX55 Routers ASUS RT-AX55 Routers OS Command Injection Vulnerability | 2025-06-23 |
| 2025-06-02 | CVE-2021-32030 | ASUS Routers ASUS Routers Improper Authentication Vulnerability | 2025-06-23 |
| 2025-05-22 | CVE-2025-4632 | Samsung MagicINFO 9 Server Samsung MagicINFO 9 Server Path Traversal Vulnerability | 2025-06-12 |
| 2025-05-19 | CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2025-06-09 |
| 2025-05-19 | CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability | 2025-06-09 |
| 2025-05-19 | CVE-2025-27920 | Srimax Output Messenger Srimax Output Messenger Directory Traversal Vulnerability | 2025-06-09 |
| 2025-05-19 | CVE-2024-27443 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2025-06-09 |
| 2025-05-19 | CVE-2024-11182 | MDaemon Email Server MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability | 2025-06-09 |
| 2025-05-19 | CVE-2023-38950 | ZKTeco BioTime ZKTeco BioTime Path Traversal Vulnerability | 2025-06-09 |
| 2025-05-15 | CVE-2025-42999 | SAP NetWeaver SAP NetWeaver Deserialization Vulnerability Ransomware | 2025-06-05 |
| 2025-05-15 | CVE-2024-12987 | DrayTek Vigor Routers DrayTek Vigor Routers OS Command Injection Vulnerability | 2025-06-05 |
| 2025-05-14 | CVE-2025-32756 | Fortinet Multiple Products Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability | 2025-06-04 |
| 2025-05-13 | CVE-2025-32709 | Microsoft Windows Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-32706 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-32701 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-30400 | Microsoft Windows Microsoft Windows DWM Core Library Use-After-Free Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-30397 | Microsoft Windows Microsoft Windows Scripting Engine Type Confusion Vulnerability | 2025-06-03 |
| 2025-05-12 | CVE-2025-47729 | TeleMessage TM SGNL TeleMessage TM SGNL Hidden Functionality Vulnerability | 2025-06-02 |
| 2025-05-07 | CVE-2024-6047 | GeoVision Multiple Devices GeoVision Devices OS Command Injection Vulnerability | 2025-05-28 |
| 2025-05-07 | CVE-2024-11120 | GeoVision Multiple Devices GeoVision Devices OS Command Injection Vulnerability | 2025-05-28 |
| 2025-05-06 | CVE-2025-27363 | FreeType FreeType FreeType Out-of-Bounds Write Vulnerability | 2025-05-27 |
| 2025-05-05 | CVE-2025-3248 | Langflow Langflow Langflow Missing Authentication Vulnerability Ransomware | 2025-05-26 |
| 2025-05-02 | CVE-2025-34028 | Commvault Command Center Commvault Command Center Path Traversal Vulnerability | 2025-05-23 |
| 2025-05-02 | CVE-2024-58136 | Yiiframework Yii Yiiframework Yii Improper Protection of Alternate Path Vulnerability | 2025-05-23 |
| 2025-05-01 | CVE-2024-38475 | Apache HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability | 2025-05-22 |
| 2025-05-01 | CVE-2023-44221 | SonicWall SMA100 Appliances SonicWall SMA100 Appliances OS Command Injection Vulnerability | 2025-05-22 |
| 2025-04-29 | CVE-2025-31324 | SAP NetWeaver SAP NetWeaver Unrestricted File Upload Vulnerability Ransomware | 2025-05-20 |
| 2025-04-28 | CVE-2025-42599 | Qualitia Active! Mail Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability | 2025-05-19 |
| 2025-04-28 | CVE-2025-3928 | Commvault Web Server Commvault Web Server Unspecified Vulnerability | 2025-05-19 |
| 2025-04-28 | CVE-2025-1976 | Broadcom Brocade Fabric OS Broadcom Brocade Fabric OS Code Injection Vulnerability | 2025-05-19 |
| 2025-04-17 | CVE-2025-31201 | Apple Multiple Products Apple Multiple Products Arbitrary Read and Write Vulnerability | 2025-05-08 |
| 2025-04-17 | CVE-2025-31200 | Apple Multiple Products Apple Multiple Products Memory Corruption Vulnerability | 2025-05-08 |
| 2025-04-17 | CVE-2025-24054 | Microsoft Windows Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | 2025-05-08 |
| 2025-04-16 | CVE-2021-20035 | SonicWall SMA100 Appliances SonicWall SMA100 Appliances OS Command Injection Vulnerability | 2025-05-07 |
| 2025-04-09 | CVE-2024-53197 | Linux Kernel Linux Kernel Out-of-Bounds Access Vulnerability | 2025-04-30 |
| 2025-04-09 | CVE-2024-53150 | Linux Kernel Linux Kernel Out-of-Bounds Read Vulnerability | 2025-04-30 |
| 2025-04-08 | CVE-2025-30406 | Gladinet CentreStack Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability | 2025-04-29 |
| 2025-04-08 | CVE-2025-29824 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability Ransomware | 2025-04-29 |
| 2025-04-07 | CVE-2025-31161 | CrushFTP CrushFTP CrushFTP Authentication Bypass Vulnerability Ransomware | 2025-04-28 |
| 2025-04-04 | CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware | 2025-04-11 |
| 2025-04-01 | CVE-2025-24813 | Apache Tomcat Apache Tomcat Path Equivalence Vulnerability | 2025-04-22 |
| 2025-03-31 | CVE-2024-20439 | Cisco Smart Licensing Utility Cisco Smart Licensing Utility Static Credential Vulnerability | 2025-04-21 |
| 2025-03-27 | CVE-2025-2783 | Google Chromium Mojo Google Chromium Mojo Sandbox Escape Vulnerability | 2025-04-17 |
| 2025-03-26 | CVE-2019-9875 | Sitecore CMS and Experience Platform (XP) Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 2025-04-16 |
| 2025-03-26 | CVE-2019-9874 | Sitecore CMS and Experience Platform (XP) Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 2025-04-16 |
| 2025-03-24 | CVE-2025-30154 | reviewdog action-setup GitHub Action reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability | 2025-04-14 |
| 2025-03-19 | CVE-2025-1316 | Edimax IC-7100 IP Camera Edimax IC-7100 IP Camera OS Command Injection Vulnerability | 2025-04-09 |
| 2025-03-19 | CVE-2024-48248 | NAKIVO Backup and Replication NAKIVO Backup and Replication Absolute Path Traversal Vulnerability | 2025-04-09 |
| 2025-03-19 | CVE-2017-12637 | SAP NetWeaver SAP NetWeaver Directory Traversal Vulnerability | 2025-04-09 |
| 2025-03-18 | CVE-2025-30066 | tj-actions changed-files GitHub Action tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability | 2025-04-08 |
| 2025-03-18 | CVE-2025-24472 | Fortinet FortiOS and FortiProxy Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware | 2025-04-08 |
| 2025-03-13 | CVE-2025-24201 | Apple Multiple Products Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability | 2025-04-03 |
| 2025-03-13 | CVE-2025-21590 | Juniper Junos OS Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability | 2025-04-03 |
| 2025-03-11 | CVE-2025-26633 | Microsoft Windows Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability Ransomware | 2025-04-01 |
| 2025-03-11 | CVE-2025-24993 | Microsoft Windows Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24991 | Microsoft Windows Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24985 | Microsoft Windows Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24984 | Microsoft Windows Microsoft Windows NTFS Information Disclosure Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24983 | Microsoft Windows Microsoft Windows Win32k Use-After-Free Vulnerability | 2025-04-01 |
| 2025-03-10 | CVE-2025-25181 | Advantive VeraCore Advantive VeraCore SQL Injection Vulnerability | 2025-03-31 |
| 2025-03-10 | CVE-2024-57968 | Advantive VeraCore Advantive VeraCore Unrestricted File Upload Vulnerability | 2025-03-31 |
| 2025-03-10 | CVE-2024-13161 | Ivanti Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 2025-03-31 |
| 2025-03-10 | CVE-2024-13160 | Ivanti Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 2025-03-31 |
| 2025-03-10 | CVE-2024-13159 | Ivanti Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 2025-03-31 |
| 2025-03-04 | CVE-2025-22226 | VMware ESXi, Workstation, and Fusion VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 2025-03-25 |
| 2025-03-04 | CVE-2025-22225 | VMware ESXi VMware ESXi Arbitrary Write Vulnerability Ransomware | 2025-03-25 |
| 2025-03-04 | CVE-2025-22224 | VMware ESXi and Workstation VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 2025-03-25 |
| 2025-03-04 | CVE-2024-50302 | Linux Kernel Linux Kernel Use of Uninitialized Resource Vulnerability | 2025-03-25 |
| 2025-03-03 | CVE-2024-4885 | Progress WhatsUp Gold Progress WhatsUp Gold Path Traversal Vulnerability | 2025-03-24 |
| 2025-03-03 | CVE-2023-20118 | Cisco Small Business RV Series Routers Cisco Small Business RV Series Routers Command Injection Vulnerability | 2025-03-24 |
| 2025-03-03 | CVE-2022-43939 | Hitachi Vantara Pentaho Business Analytics (BA) Server Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability | 2025-03-24 |
| 2025-03-03 | CVE-2022-43769 | Hitachi Vantara Pentaho Business Analytics (BA) Server Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability | 2025-03-24 |
| 2025-03-03 | CVE-2018-8639 | Microsoft Windows Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability Ransomware | 2025-03-24 |
| 2025-02-25 | CVE-2024-49035 | Microsoft Partner Center Microsoft Partner Center Improper Access Control Vulnerability | 2025-03-18 |
| 2025-02-25 | CVE-2023-34192 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2025-03-18 |
| 2025-02-24 | CVE-2024-20953 | Oracle Agile Product Lifecycle Management (PLM) Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | 2025-03-17 |
| 2025-02-24 | CVE-2017-3066 | Adobe ColdFusion Adobe ColdFusion Deserialization Vulnerability | 2025-03-17 |
| 2025-02-21 | CVE-2025-24989 | Microsoft Power Pages Microsoft Power Pages Improper Access Control Vulnerability | 2025-03-14 |
| 2025-02-20 | CVE-2025-23209 | Craft CMS Craft CMS Craft CMS Code Injection Vulnerability | 2025-03-13 |
| 2025-02-20 | CVE-2025-0111 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS File Read Vulnerability | 2025-03-13 |
| 2025-02-18 | CVE-2025-0108 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 2025-03-11 |
| 2025-02-18 | CVE-2024-53704 | SonicWall SonicOS SonicWall SonicOS SSLVPN Improper Authentication Vulnerability Ransomware | 2025-03-11 |
| 2025-02-13 | CVE-2024-57727 | SimpleHelp SimpleHelp SimpleHelp Path Traversal Vulnerability Ransomware | 2025-03-06 |
| 2025-02-12 | CVE-2025-24200 | Apple iOS and iPadOS Apple iOS and iPadOS Incorrect Authorization Vulnerability | 2025-03-05 |
| 2025-02-12 | CVE-2024-41710 | Mitel SIP Phones Mitel SIP Phones Argument Injection Vulnerability | 2025-03-05 |
| 2025-02-11 | CVE-2025-21418 | Microsoft Windows Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability | 2025-03-04 |
| 2025-02-11 | CVE-2025-21391 | Microsoft Windows Microsoft Windows Storage Link Following Vulnerability | 2025-03-04 |
| 2025-02-11 | CVE-2024-40891 | Zyxel DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability | 2025-03-04 |
| 2025-02-11 | CVE-2024-40890 | Zyxel DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability | 2025-03-04 |
| 2025-02-07 | CVE-2025-0994 | Trimble Cityworks Trimble Cityworks Deserialization Vulnerability | 2025-02-28 |
| 2025-02-06 | CVE-2025-0411 | 7-Zip 7-Zip 7-Zip Mark of the Web Bypass Vulnerability | 2025-02-27 |
| 2025-02-06 | CVE-2024-21413 | Microsoft Office Outlook Microsoft Outlook Improper Input Validation Vulnerability | 2025-02-27 |
| 2025-02-06 | CVE-2022-23748 | Audinate Dante Discovery Dante Discovery Process Control Vulnerability | 2025-02-27 |
| 2025-02-06 | CVE-2020-29574 | Sophos CyberoamOS CyberoamOS (CROS) SQL Injection Vulnerability Ransomware | 2025-02-27 |
| 2025-02-06 | CVE-2020-15069 | Sophos XG Firewall Sophos XG Firewall Buffer Overflow Vulnerability | 2025-02-27 |
| 2025-02-05 | CVE-2024-53104 | Linux Kernel Linux Kernel Out-of-Bounds Write Vulnerability | 2025-02-26 |
| 2025-02-04 | CVE-2024-45195 | Apache OFBiz Apache OFBiz Forced Browsing Vulnerability | 2025-02-25 |
| 2025-02-04 | CVE-2024-29059 | Microsoft .NET Framework Microsoft .NET Framework Information Disclosure Vulnerability | 2025-02-25 |
| 2025-02-04 | CVE-2018-9276 | Paessler PRTG Network Monitor Paessler PRTG Network Monitor OS Command Injection Vulnerability | 2025-02-25 |