Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 4.4 Medium severity | Juniper Junos OS Improper Isolation or Compartmentalization CVE-2025-21590 | Mar 13, 2025 | Apr 3, 2025 | Not reported |
| 7.0 High severity | Microsoft Windows Management Console (MMC) Improper Neutralization CVE-2025-26633 | Mar 11, 2025 | Apr 1, 2025 | Known |
| 7.8 High severity | Microsoft Windows NTFS Heap-Based Buffer Overflow CVE-2025-24993 | Mar 11, 2025 | Apr 1, 2025 | Not reported |
| 5.5 Medium severity | Microsoft Windows NTFS Out-Of-Bounds Read CVE-2025-24991 | Mar 11, 2025 | Apr 1, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Fast FAT File System Driver Integer Overflow CVE-2025-24985 | Mar 11, 2025 | Apr 1, 2025 | Not reported |
| 4.6 Medium severity | Microsoft Windows NTFS Information Disclosure CVE-2025-24984 | Mar 11, 2025 | Apr 1, 2025 | Not reported |
| 7.0 High severity | Microsoft Windows Win32k Use-After-Free CVE-2025-24983 | Mar 11, 2025 | Apr 1, 2025 | Not reported |
| 7.5 High severity | Advantive VeraCore SQL Injection CVE-2025-25181 | Mar 10, 2025 | Mar 31, 2025 | Not reported |
| 8.8 High severity | Advantive VeraCore Unrestricted File Upload CVE-2024-57968 | Mar 10, 2025 | Mar 31, 2025 | Not reported |
| 7.5 High severity | Ivanti Endpoint Manager (EPM) Absolute Path Traversal CVE-2024-13161 | Mar 10, 2025 | Mar 31, 2025 | Not reported |
| 7.5 High severity | Ivanti Endpoint Manager (EPM) Absolute Path Traversal CVE-2024-13160 | Mar 10, 2025 | Mar 31, 2025 | Not reported |
| 7.5 High severity | Ivanti Endpoint Manager (EPM) Absolute Path Traversal CVE-2024-13159 | Mar 10, 2025 | Mar 31, 2025 | Not reported |
| 6.0 Medium severity | VMware ESXi, Workstation, and Fusion Information Disclosure CVE-2025-22226 | Mar 4, 2025 | Mar 25, 2025 | Not reported |
| 8.2 High severity | VMware ESXi Arbitrary Write CVE-2025-22225 | Mar 4, 2025 | Mar 25, 2025 | Known |
| 8.2 High severity | VMware ESXi and Workstation TOCTOU Race Condition CVE-2025-22224 | Mar 4, 2025 | Mar 25, 2025 | Not reported |
| 5.5 Medium severity | Linux Kernel Use of Uninitialized Resource CVE-2024-50302 | Mar 4, 2025 | Mar 25, 2025 | Not reported |
| 9.8 Critical severity | Progress WhatsUp Gold Path Traversal CVE-2024-4885 | Mar 3, 2025 | Mar 24, 2025 | Not reported |
| 7.2 High severity | Cisco Small Business RV Series Routers Command Injection CVE-2023-20118 | Mar 3, 2025 | Mar 24, 2025 | Not reported |
| 9.8 Critical severity | Hitachi Vantara Pentaho BA Server Authorization Bypass CVE-2022-43939 | Mar 3, 2025 | Mar 24, 2025 | Not reported |
| 7.2 High severity | Hitachi Vantara Pentaho BA Server Special Element Injection CVE-2022-43769 | Mar 3, 2025 | Mar 24, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Win32k Improper Resource Shutdown or Release CVE-2018-8639 | Mar 3, 2025 | Mar 24, 2025 | Known |
| 9.8 Critical severity | Microsoft Partner Center Improper Access Control CVE-2024-49035 | Feb 25, 2025 | Mar 18, 2025 | Not reported |
| 9.0 Critical severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) CVE-2023-34192 | Feb 25, 2025 | Mar 18, 2025 | Not reported |
| 8.8 High severity | Oracle Agile Product Lifecycle Management (PLM) Deserialization CVE-2024-20953 | Feb 24, 2025 | Mar 17, 2025 | Not reported |
| 9.8 Critical severity | Adobe ColdFusion Deserialization CVE-2017-3066 | Feb 24, 2025 | Mar 17, 2025 | Not reported |
| 9.8 Critical severity | Microsoft Power Pages Improper Access Control CVE-2025-24989 | Feb 21, 2025 | Mar 14, 2025 | Not reported |
| 8.1 High severity | Craft CMS Code Injection CVE-2025-23209 | Feb 20, 2025 | Mar 13, 2025 | Not reported |
| 6.5 Medium severity | Palo Alto Networks PAN-OS File Read CVE-2025-0111 | Feb 20, 2025 | Mar 13, 2025 | Not reported |
| 9.1 Critical severity | Palo Alto Networks PAN-OS Authentication Bypass CVE-2025-0108 | Feb 18, 2025 | Mar 11, 2025 | Not reported |
| 9.8 Critical severity | SonicWall SonicOS SSLVPN Improper Authentication CVE-2024-53704 | Feb 18, 2025 | Mar 11, 2025 | Known |
| 7.5 High severity | SimpleHelp Path Traversal CVE-2024-57727 | Feb 13, 2025 | Mar 6, 2025 | Known |
| 6.1 Medium severity | Apple iOS and iPadOS Incorrect Authorization CVE-2025-24200 | Feb 12, 2025 | Mar 5, 2025 | Not reported |
| 7.2 High severity | Mitel SIP Phones Argument Injection CVE-2024-41710 | Feb 12, 2025 | Mar 5, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow CVE-2025-21418 | Feb 11, 2025 | Mar 4, 2025 | Not reported |
| 7.1 High severity | Microsoft Windows Storage Link Following CVE-2025-21391 | Feb 11, 2025 | Mar 4, 2025 | Not reported |
| 8.8 High severity | Zyxel DSL CPE OS Command Injection CVE-2024-40891 | Feb 11, 2025 | Mar 4, 2025 | Not reported |
| 8.8 High severity | Zyxel DSL CPE OS Command Injection CVE-2024-40890 | Feb 11, 2025 | Mar 4, 2025 | Not reported |
| 8.8 High severity | Trimble Cityworks Deserialization CVE-2025-0994 | Feb 7, 2025 | Feb 28, 2025 | Not reported |
| 7.0 High severity | 7-Zip Mark of the Web Bypass CVE-2025-0411 | Feb 6, 2025 | Feb 27, 2025 | Not reported |
| 9.8 Critical severity | Microsoft Outlook Improper Input Validation CVE-2024-21413 | Feb 6, 2025 | Feb 27, 2025 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.