Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free CVE-2025-32709 | May 13, 2025 | Jun 3, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow CVE-2025-32706 | May 13, 2025 | Jun 3, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free CVE-2025-32701 | May 13, 2025 | Jun 3, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows DWM Core Library Use-After-Free CVE-2025-30400 | May 13, 2025 | Jun 3, 2025 | Not reported |
| 7.5 High severity | Microsoft Windows Scripting Engine Type Confusion CVE-2025-30397 | May 13, 2025 | Jun 3, 2025 | Not reported |
| 4.9 Medium severity | TeleMessage TM SGNL Hidden Functionality CVE-2025-47729 | May 12, 2025 | Jun 2, 2025 | Not reported |
| 9.8 Critical severity | GeoVision Devices OS Command Injection CVE-2024-6047 | May 7, 2025 | May 28, 2025 | Not reported |
| 9.8 Critical severity | GeoVision Devices OS Command Injection CVE-2024-11120 | May 7, 2025 | May 28, 2025 | Not reported |
| 8.1 High severity | FreeType Out-of-Bounds Write CVE-2025-27363 | May 6, 2025 | May 27, 2025 | Not reported |
| 9.8 Critical severity | Langflow Missing Authentication CVE-2025-3248 | May 5, 2025 | May 26, 2025 | Known |
| 10.0 Critical severity | Commvault Command Center Path Traversal CVE-2025-34028 | May 2, 2025 | May 23, 2025 | Not reported |
| 9.8 Critical severity | Yiiframework Yii Improper Protection of Alternate Path CVE-2024-58136 | May 2, 2025 | May 23, 2025 | Not reported |
| 9.1 Critical severity | Apache HTTP Server Improper Escaping of Output CVE-2024-38475 | May 1, 2025 | May 22, 2025 | Not reported |
| 7.2 High severity | SonicWall SMA100 Appliances OS Command Injection CVE-2023-44221 | May 1, 2025 | May 22, 2025 | Not reported |
| 9.8 Critical severity | SAP NetWeaver Unrestricted File Upload CVE-2025-31324 | Apr 29, 2025 | May 20, 2025 | Known |
| 9.8 Critical severity | Qualitia Active! Mail Stack-Based Buffer Overflow CVE-2025-42599 | Apr 28, 2025 | May 19, 2025 | Not reported |
| 8.8 High severity | Commvault Web Server Unspecified CVE-2025-3928 | Apr 28, 2025 | May 19, 2025 | Not reported |
| 6.7 Medium severity | Broadcom Brocade Fabric OS Code Injection CVE-2025-1976 | Apr 28, 2025 | May 19, 2025 | Not reported |
| 9.8 Critical severity | Apple Multiple Products Arbitrary Read and Write CVE-2025-31201 | Apr 17, 2025 | May 8, 2025 | Not reported |
| 9.8 Critical severity | Apple Multiple Products Memory Corruption CVE-2025-31200 | Apr 17, 2025 | May 8, 2025 | Not reported |
| 5.4 Medium severity | Microsoft Windows NTLM Hash Disclosure Spoofing CVE-2025-24054 | Apr 17, 2025 | May 8, 2025 | Not reported |
| 6.5 Medium severity | SonicWall SMA100 Appliances OS Command Injection CVE-2021-20035 | Apr 16, 2025 | May 7, 2025 | Not reported |
| 7.8 High severity | Linux Kernel Out-of-Bounds Access CVE-2024-53197 | Apr 9, 2025 | Apr 30, 2025 | Not reported |
| 7.1 High severity | Linux Kernel Out-of-Bounds Read CVE-2024-53150 | Apr 9, 2025 | Apr 30, 2025 | Not reported |
| 9.8 Critical severity | Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key CVE-2025-30406 | Apr 8, 2025 | Apr 29, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free CVE-2025-29824 | Apr 8, 2025 | Apr 29, 2025 | Known |
| 9.8 Critical severity | CrushFTP Authentication Bypass CVE-2025-31161 | Apr 7, 2025 | Apr 28, 2025 | Known |
| 9.8 Critical severity | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow CVE-2025-22457 | Apr 4, 2025 | Apr 11, 2025 | Known |
| 9.8 Critical severity | Apache Tomcat Path Equivalence CVE-2025-24813 | Apr 1, 2025 | Apr 22, 2025 | Not reported |
| 9.8 Critical severity | Cisco Smart Licensing Utility Static Credential CVE-2024-20439 | Mar 31, 2025 | Apr 21, 2025 | Not reported |
| 8.3 High severity | Google Chromium Mojo Sandbox Escape CVE-2025-2783 | Mar 27, 2025 | Apr 17, 2025 | Not reported |
| 8.8 High severity | Sitecore CMS and Experience Platform (XP) Deserialization CVE-2019-9875 | Mar 26, 2025 | Apr 16, 2025 | Not reported |
| 9.8 Critical severity | Sitecore CMS and Experience Platform (XP) Deserialization CVE-2019-9874 | Mar 26, 2025 | Apr 16, 2025 | Not reported |
| 8.6 High severity | reviewdog/action-setup GitHub Action Embedded Malicious Code CVE-2025-30154 | Mar 24, 2025 | Apr 14, 2025 | Not reported |
| 9.8 Critical severity | Edimax IC-7100 IP Camera OS Command Injection CVE-2025-1316 | Mar 19, 2025 | Apr 9, 2025 | Not reported |
| 8.6 High severity | NAKIVO Backup and Replication Absolute Path Traversal CVE-2024-48248 | Mar 19, 2025 | Apr 9, 2025 | Not reported |
| 7.5 High severity | SAP NetWeaver Directory Traversal CVE-2017-12637 | Mar 19, 2025 | Apr 9, 2025 | Not reported |
| 8.6 High severity | tj-actions/changed-files GitHub Action Embedded Malicious Code CVE-2025-30066 | Mar 18, 2025 | Apr 8, 2025 | Not reported |
| 8.1 High severity | Fortinet FortiOS and FortiProxy Authentication Bypass CVE-2025-24472 | Mar 18, 2025 | Apr 8, 2025 | Known |
| 10.0 Critical severity | Apple Multiple Products WebKit Out-of-Bounds Write CVE-2025-24201 | Mar 13, 2025 | Apr 3, 2025 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.