Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | Fortinet FortiWeb SQL Injection CVE-2025-25257 | Jul 18, 2025 | Aug 8, 2025 | Not reported |
| 10.0 Critical severity | Wing FTP Server Improper Neutralization of Null Byte or NUL Character CVE-2025-47812 | Jul 14, 2025 | Aug 4, 2025 | Not reported |
| 7.5 High severity | Citrix NetScaler ADC and Gateway Out-of-Bounds Read CVE-2025-5777 | Jul 10, 2025 | Jul 11, 2025 | Known |
| 7.5 High severity | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) CVE-2019-9621 | Jul 7, 2025 | Jul 28, 2025 | Not reported |
| 7.5 High severity | Rails Ruby on Rails Path Traversal CVE-2019-5418 | Jul 7, 2025 | Jul 28, 2025 | Not reported |
| 9.8 Critical severity | PHPMailer Command Injection CVE-2016-10033 | Jul 7, 2025 | Jul 28, 2025 | Not reported |
| 9.8 Critical severity | Multi-Router Looking Glass (MRLG) Buffer Overflow CVE-2014-3931 | Jul 7, 2025 | Jul 28, 2025 | Not reported |
| 8.1 High severity | Google Chromium V8 Type Confusion CVE-2025-6554 | Jul 2, 2025 | Jul 23, 2025 | Not reported |
| 4.0 Medium severity | TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere CVE-2025-48928 | Jul 1, 2025 | Jul 22, 2025 | Not reported |
| 5.3 Medium severity | TeleMessage TM SGNL Initialization of a Resource with an Insecure Default CVE-2025-48927 | Jul 1, 2025 | Jul 22, 2025 | Not reported |
| 9.8 Critical severity | Citrix NetScaler ADC and Gateway Buffer Overflow CVE-2025-6543 | Jun 30, 2025 | Jul 21, 2025 | Not reported |
| 9.8 Critical severity | AMI MegaRAC SPx Authentication Bypass by Spoofing CVE-2024-54085 | Jun 25, 2025 | Jul 16, 2025 | Not reported |
| 9.8 Critical severity | D-Link DIR-859 Router Path Traversal CVE-2024-0769 | Jun 25, 2025 | Jul 16, 2025 | Not reported |
| 6.5 Medium severity | Fortinet FortiOS Use of Hard-Coded Credentials CVE-2019-6693 | Jun 25, 2025 | Jul 16, 2025 | Known |
| 7.8 High severity | Linux Kernel Improper Ownership Management CVE-2023-0386 | Jun 17, 2025 | Jul 8, 2025 | Not reported |
| 4.2 Medium severity | Apple Multiple Products Unspecified CVE-2025-43200 | Jun 16, 2025 | Jul 7, 2025 | Not reported |
| 8.8 High severity | TP-Link Multiple Routers Command Injection CVE-2023-33538 | Jun 16, 2025 | Jul 7, 2025 | Not reported |
| 8.8 High severity | Microsoft Windows External Control of File Name or Path CVE-2025-33053 | Jun 10, 2025 | Jul 1, 2025 | Not reported |
| 9.9 Critical severity | Wazuh Server Deserialization of Untrusted Data CVE-2025-24016 | Jun 10, 2025 | Jul 1, 2025 | Not reported |
| 10.0 Critical severity | Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function CVE-2025-32433 | Jun 9, 2025 | Jun 30, 2025 | Not reported |
| 9.3 Critical severity | RoundCube Webmail Cross-Site Scripting CVE-2024-42009 | Jun 9, 2025 | Jun 30, 2025 | Not reported |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Read and Write CVE-2025-5419 | Jun 5, 2025 | Jun 26, 2025 | Not reported |
| 7.5 High severity | Qualcomm Multiple Chipsets Use-After-Free CVE-2025-27038 | Jun 3, 2025 | Jun 24, 2025 | Not reported |
| 8.6 High severity | Qualcomm Multiple Chipsets Incorrect Authorization CVE-2025-21480 | Jun 3, 2025 | Jun 24, 2025 | Not reported |
| 8.6 High severity | Qualcomm Multiple Chipsets Incorrect Authorization CVE-2025-21479 | Jun 3, 2025 | Jun 24, 2025 | Not reported |
| 7.2 High severity | ConnectWise ScreenConnect Improper Authentication CVE-2025-3935 | Jun 2, 2025 | Jun 23, 2025 | Not reported |
| 5.3 Medium severity | Craft CMS External Control of Assumed-Immutable Web Parameter CVE-2025-35939 | Jun 2, 2025 | Jun 23, 2025 | Not reported |
| 9.8 Critical severity | Craft CMS Code Injection CVE-2024-56145 | Jun 2, 2025 | Jun 23, 2025 | Not reported |
| 8.8 High severity | ASUS RT-AX55 Routers OS Command Injection CVE-2023-39780 | Jun 2, 2025 | Jun 23, 2025 | Not reported |
| 9.8 Critical severity | ASUS Routers Improper Authentication CVE-2021-32030 | Jun 2, 2025 | Jun 23, 2025 | Not reported |
| 9.8 Critical severity | Samsung MagicINFO 9 Server Path Traversal CVE-2025-4632 | May 22, 2025 | Jun 12, 2025 | Not reported |
| 8.8 High severity | Ivanti Endpoint Manager Mobile (EPMM) Code Injection CVE-2025-4428 | May 19, 2025 | Jun 9, 2025 | Not reported |
| 7.5 High severity | Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass CVE-2025-4427 | May 19, 2025 | Jun 9, 2025 | Not reported |
| 8.8 High severity | Srimax Output Messenger Directory Traversal CVE-2025-27920 | May 19, 2025 | Jun 9, 2025 | Not reported |
| 6.1 Medium severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) CVE-2024-27443 | May 19, 2025 | Jun 9, 2025 | Not reported |
| 6.1 Medium severity | MDaemon Email Server Cross-Site Scripting (XSS) CVE-2024-11182 | May 19, 2025 | Jun 9, 2025 | Not reported |
| 7.5 High severity | ZKTeco BioTime Path Traversal CVE-2023-38950 | May 19, 2025 | Jun 9, 2025 | Not reported |
| 9.1 Critical severity | SAP NetWeaver Deserialization CVE-2025-42999 | May 15, 2025 | Jun 5, 2025 | Known |
| 9.8 Critical severity | DrayTek Vigor Routers OS Command Injection CVE-2024-12987 | May 15, 2025 | Jun 5, 2025 | Not reported |
| 9.8 Critical severity | Fortinet Multiple Products Stack-Based Buffer Overflow CVE-2025-32756 | May 14, 2025 | Jun 4, 2025 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.