The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-62215 | UNKNOWN | — | Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. | Nov 12, 2025 |
| CVE-2025-12480 | UNKNOWN | — | Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. | Nov 12, 2025 |
| CVE-2025-21042 | UNKNOWN | — | Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code. | Nov 10, 2025 |
| CVE-2025-11371 | UNKNOWN | — | Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. | Nov 4, 2025 |
| CVE-2025-48703 | UNKNOWN | — | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. | Nov 4, 2025 |
| CVE-2025-24893 | UNKNOWN | — | XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch. | Oct 30, 2025 |
| CVE-2025-41244 | UNKNOWN | — | Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. | Oct 30, 2025 |
| CVE-2025-6205 | UNKNOWN | — | Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application. | Oct 28, 2025 |
| CVE-2025-6204 | UNKNOWN | — | Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. | Oct 28, 2025 |
| CVE-2025-59287 | UNKNOWN | — | Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. | Oct 24, 2025 |
| CVE-2025-54236 | UNKNOWN | — | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. | Oct 24, 2025 |
| CVE-2025-61932 | UNKNOWN | — | Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets. | Oct 22, 2025 |
| CVE-2025-2747 | UNKNOWN | — | Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. | Oct 20, 2025 |
| CVE-2025-2746 | UNKNOWN | — | Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. | Oct 20, 2025 |
| CVE-2025-33073 | UNKNOWN | — | Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. | Oct 20, 2025 |
| CVE-2022-48503 | UNKNOWN | — | Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Oct 20, 2025 |
| CVE-2025-54253 | UNKNOWN | — | Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. | Oct 15, 2025 |
| CVE-2016-7836 | UNKNOWN | — | SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. | Oct 14, 2025 |
| CVE-2025-59230 | UNKNOWN | — | Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally. | Oct 14, 2025 |
| CVE-2025-24990 | UNKNOWN | — | Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges. | Oct 14, 2025 |
| CVE-2025-47827 | UNKNOWN | — | IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. | Oct 14, 2025 |
| CVE-2021-43798 | UNKNOWN | — | Grafana contains a path traversal vulnerability that could allow access to local files. | Oct 9, 2025 |
| CVE-2025-27915 | UNKNOWN | — | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. | Oct 7, 2025 |
| CVE-2010-3765 | UNKNOWN | — | Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption. | Oct 6, 2025 |
| CVE-2011-3402 | UNKNOWN | — | Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. | Oct 6, 2025 |