Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.2 High severity | Fortinet FortiWeb OS Command Injection CVE-2025-58034 | Nov 18, 2025 | Nov 25, 2025 | Not reported |
| 9.8 Critical severity | Fortinet FortiWeb Path Traversal CVE-2025-64446 | Nov 14, 2025 | Nov 21, 2025 | Not reported |
| 9.8 Critical severity | WatchGuard Firebox Out-of-Bounds Write CVE-2025-9242 | Nov 12, 2025 | Dec 3, 2025 | Not reported |
| 7.0 High severity | Microsoft Windows Race Condition CVE-2025-62215 | Nov 12, 2025 | Dec 3, 2025 | Not reported |
| 9.1 Critical severity | Gladinet Triofox Improper Access Control CVE-2025-12480 | Nov 12, 2025 | Dec 3, 2025 | Not reported |
| 9.8 Critical severity | Samsung Mobile Devices Out-of-Bounds Write CVE-2025-21042 | Nov 10, 2025 | Dec 1, 2025 | Not reported |
| 9.0 Critical severity | CWP Control Web Panel OS Command Injection CVE-2025-48703 | Nov 4, 2025 | Nov 25, 2025 | Not reported |
| 7.5 High severity | Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties CVE-2025-11371 | Nov 4, 2025 | Nov 25, 2025 | Not reported |
| 7.8 High severity | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions CVE-2025-41244 | Oct 30, 2025 | Nov 20, 2025 | Not reported |
| 9.8 Critical severity | XWiki Platform Eval Injection CVE-2025-24893 | Oct 30, 2025 | Nov 20, 2025 | Not reported |
| 9.1 Critical severity | Dassault Systèmes DELMIA Apriso Missing Authorization CVE-2025-6205 | Oct 28, 2025 | Nov 18, 2025 | Not reported |
| 8.0 High severity | Dassault Systèmes DELMIA Apriso Code Injection CVE-2025-6204 | Oct 28, 2025 | Nov 18, 2025 | Not reported |
| 9.8 Critical severity | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data CVE-2025-59287 | Oct 24, 2025 | Nov 14, 2025 | Not reported |
| 9.1 Critical severity | Adobe Commerce and Magento Improper Input Validation CVE-2025-54236 | Oct 24, 2025 | Nov 14, 2025 | Not reported |
| 9.3 Critical severity | Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel CVE-2025-61932 | Oct 22, 2025 | Nov 12, 2025 | Not reported |
| 7.5 High severity | Oracle E-Business Suite Server-Side Request Forgery (SSRF) CVE-2025-61884 | Oct 20, 2025 | Nov 10, 2025 | Known |
| 8.8 High severity | Microsoft Windows SMB Client Improper Access Control CVE-2025-33073 | Oct 20, 2025 | Nov 10, 2025 | Not reported |
| 9.8 Critical severity | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel CVE-2025-2747 | Oct 20, 2025 | Nov 10, 2025 | Not reported |
| 9.8 Critical severity | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel CVE-2025-2746 | Oct 20, 2025 | Nov 10, 2025 | Not reported |
| 8.8 High severity | Apple Multiple Products Unspecified CVE-2022-48503 | Oct 20, 2025 | Nov 10, 2025 | Not reported |
| 10.0 Critical severity | Adobe Experience Manager Forms Code Execution CVE-2025-54253 | Oct 15, 2025 | Nov 5, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Improper Access Control CVE-2025-59230 | Oct 14, 2025 | Nov 4, 2025 | Not reported |
| 4.6 Medium severity | IGEL OS Use of a Key Past its Expiration Date CVE-2025-47827 | Oct 14, 2025 | Nov 4, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Untrusted Pointer Dereference CVE-2025-24990 | Oct 14, 2025 | Nov 4, 2025 | Not reported |
| 9.8 Critical severity | SKYSEA Client View Improper Authentication CVE-2016-7836 | Oct 14, 2025 | Nov 4, 2025 | Not reported |
| 5.0 Medium severity | Grafana Path Traversal CVE-2021-43798 | Oct 9, 2025 | Oct 30, 2025 | Not reported |
| 5.4 Medium severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting CVE-2025-27915 | Oct 7, 2025 | Oct 28, 2025 | Not reported |
| 9.8 Critical severity | Oracle E-Business Suite Unspecified CVE-2025-61882 | Oct 6, 2025 | Oct 27, 2025 | Known |
| 7.8 High severity | Microsoft Windows Privilege Escalation CVE-2021-43226 | Oct 6, 2025 | Oct 27, 2025 | Known |
| 7.8 High severity | Linux Kernel Heap Out-of-Bounds Write CVE-2021-22555 | Oct 6, 2025 | Oct 27, 2025 | Not reported |
| 8.8 High severity | Microsoft Windows Out-of-Bounds Write CVE-2013-3918 | Oct 6, 2025 | Oct 27, 2025 | Not reported |
| 8.8 High severity | Microsoft Windows Remote Code Execution CVE-2011-3402 | Oct 6, 2025 | Oct 27, 2025 | Not reported |
| 9.3 High severity | Microsoft Internet Explorer Uninitialized Memory Corruption CVE-2010-3962 | Oct 6, 2025 | Oct 27, 2025 | Not reported |
| 9.3 High severity | Mozilla Multiple Products Remote Code Execution CVE-2010-3765 | Oct 6, 2025 | Oct 27, 2025 | Not reported |
| 8.8 High severity | Smartbedded Meteobridge Command Injection CVE-2025-4008 | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| 9.8 Critical severity | Samsung Mobile Devices Out-of-Bounds Write CVE-2025-21043 | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| 9.8 Critical severity | Jenkins Remote Code Execution CVE-2017-1000353 | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| 9.8 Critical severity | Juniper ScreenOS Improper Authentication CVE-2015-7755 | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| 10.0 High severity | GNU Bash OS Command Injection CVE-2014-6278 | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| 6.1 Medium severity | Libraesva Email Security Gateway Command Injection CVE-2025-59689 | Sep 29, 2025 | Oct 20, 2025 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.