Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Sudo Inclusion of Functionality from Untrusted Control Sphere CVE-2025-32463 | Sep 29, 2025 | Oct 20, 2025 | Not reported |
| 7.7 High severity | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution CVE-2025-20352 | Sep 29, 2025 | Oct 20, 2025 | Not reported |
| 9.8 Critical severity | Fortra GoAnywhere MFT Deserialization of Untrusted Data CVE-2025-10035 | Sep 29, 2025 | Oct 20, 2025 | Known |
| 7.2 High severity | Adminer Server-Side Request Forgery CVE-2021-21311 | Sep 29, 2025 | Oct 20, 2025 | Not reported |
| 8.6 High severity | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization CVE-2025-20362 | Sep 25, 2025 | Sep 26, 2025 | Not reported |
| 9.9 Critical severity | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow CVE-2025-20333 | Sep 25, 2025 | Sep 26, 2025 | Not reported |
| 9.8 Critical severity | Google Chromium V8 Type Confusion CVE-2025-10585 | Sep 23, 2025 | Oct 14, 2025 | Not reported |
| 9.0 Critical severity | Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data CVE-2025-5086 | Sep 11, 2025 | Oct 2, 2025 | Not reported |
| 9.0 Critical severity | Sitecore Multiple Products Deserialization of Untrusted Data CVE-2025-53690 | Sep 4, 2025 | Sep 25, 2025 | Not reported |
| 8.8 High severity | Android Runtime Use-After-Free CVE-2025-48543 | Sep 4, 2025 | Sep 25, 2025 | Not reported |
| 7.8 High severity | Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition CVE-2025-38352 | Sep 4, 2025 | Sep 25, 2025 | Not reported |
| 7.2 High severity | TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection CVE-2025-9377 | Sep 3, 2025 | Sep 24, 2025 | Not reported |
| 6.5 Medium severity | TP-Link TL-WR841N Authentication Bypass by Spoofing CVE-2023-50224 | Sep 3, 2025 | Sep 24, 2025 | Not reported |
| 5.4 Medium severity | Meta Platforms WhatsApp Incorrect Authorization CVE-2025-55177 | Sep 2, 2025 | Sep 23, 2025 | Not reported |
| 8.8 High severity | TP-link TL-WA855RE Missing Authentication for Critical Function CVE-2020-24363 | Sep 2, 2025 | Sep 23, 2025 | Not reported |
| 9.8 Critical severity | Sangoma FreePBX Authentication Bypass CVE-2025-57819 | Aug 29, 2025 | Sep 19, 2025 | Not reported |
| 9.8 Critical severity | Citrix NetScaler Memory Overflow CVE-2025-7775 | Aug 26, 2025 | Aug 28, 2025 | Not reported |
| 8.0 High severity | Git Link Following CVE-2025-48384 | Aug 25, 2025 | Sep 15, 2025 | Not reported |
| 8.0 High severity | Citrix Session Recording Deserialization of Untrusted Data CVE-2024-8069 | Aug 25, 2025 | Sep 15, 2025 | Not reported |
| 8.0 High severity | Citrix Session Recording Improper Privilege Management CVE-2024-8068 | Aug 25, 2025 | Sep 15, 2025 | Not reported |
| 10.0 Critical severity | Apple iOS, iPadOS, and macOS Out-of-Bounds Write CVE-2025-43300 | Aug 21, 2025 | Sep 11, 2025 | Not reported |
| 9.8 Critical severity | Trend Micro Apex One OS Command Injection CVE-2025-54948 | Aug 18, 2025 | Sep 8, 2025 | Not reported |
| 8.8 High severity | N-able N-Central Command Injection CVE-2025-8876 | Aug 13, 2025 | Aug 20, 2025 | Not reported |
| 7.8 High severity | N-able N-Central Insecure Deserialization CVE-2025-8875 | Aug 13, 2025 | Aug 20, 2025 | Not reported |
| 8.8 High severity | RARLAB WinRAR Path Traversal CVE-2025-8088 | Aug 12, 2025 | Sep 2, 2025 | Known |
| 9.3 High severity | Microsoft Internet Explorer Resource Management Errors CVE-2013-3893 | Aug 12, 2025 | Sep 2, 2025 | Not reported |
| 9.3 High severity | Microsoft Office Excel Remote Code Execution CVE-2007-0671 | Aug 12, 2025 | Sep 2, 2025 | Not reported |
| 8.8 High severity | D-Link DNR-322L Download of Code Without Integrity Check CVE-2022-40799 | Aug 5, 2025 | Aug 26, 2025 | Not reported |
| 8.8 High severity | D-Link DCS-2530L and DCS-2670L Command Injection CVE-2020-25079 | Aug 5, 2025 | Aug 26, 2025 | Not reported |
| 7.5 High severity | D-Link DCS-2530L and DCS-2670L Devices Unspecified CVE-2020-25078 | Aug 5, 2025 | Aug 26, 2025 | Not reported |
| 10.0 Critical severity | Cisco Identity Services Engine Injection CVE-2025-20337 | Jul 28, 2025 | Aug 18, 2025 | Not reported |
| 10.0 Critical severity | Cisco Identity Services Engine Injection CVE-2025-20281 | Jul 28, 2025 | Aug 18, 2025 | Not reported |
| 8.8 High severity | PaperCut NG/MF Cross-Site Request Forgery (CSRF) CVE-2023-2533 | Jul 28, 2025 | Aug 18, 2025 | Not reported |
| 8.8 High severity | Google Chromium ANGLE and GPU Improper Input Validation CVE-2025-6558 | Jul 22, 2025 | Aug 12, 2025 | Not reported |
| 9.8 Critical severity | CrushFTP Unprotected Alternate Channel CVE-2025-54309 | Jul 22, 2025 | Aug 12, 2025 | Not reported |
| 6.5 Medium severity | Microsoft SharePoint Improper Authentication CVE-2025-49706 | Jul 22, 2025 | Jul 23, 2025 | Known |
| 8.8 High severity | Microsoft SharePoint Code Injection CVE-2025-49704 | Jul 22, 2025 | Jul 23, 2025 | Known |
| 9.8 Critical severity | SysAid On-Prem Improper Restriction of XML External Entity Reference CVE-2025-2776 | Jul 22, 2025 | Aug 12, 2025 | Not reported |
| 7.5 High severity | SysAid On-Prem Improper Restriction of XML External Entity Reference CVE-2025-2775 | Jul 22, 2025 | Aug 12, 2025 | Not reported |
| 9.8 Critical severity | Microsoft SharePoint Deserialization of Untrusted Data CVE-2025-53770 | Jul 20, 2025 | Jul 21, 2025 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.