The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-59374 | UNKNOWN | — | ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Dec 17, 2025 |
| CVE-2025-40602 | UNKNOWN | — | SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. | Dec 17, 2025 |
| CVE-2025-59718 | UNKNOWN | — | Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory. | Dec 16, 2025 |
| CVE-2018-4063 | UNKNOWN | — | Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Dec 12, 2025 |
| CVE-2025-62221 | UNKNOWN | — | Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally. | Dec 9, 2025 |
| CVE-2025-6218 | UNKNOWN | — | RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user. | Dec 9, 2025 |
| CVE-2022-37055 | UNKNOWN | — | D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Dec 8, 2025 |
| CVE-2025-66644 | UNKNOWN | — | Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. | Dec 8, 2025 |
| CVE-2021-26828 | UNKNOWN | — | OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. | Dec 3, 2025 |
| CVE-2021-26829 | UNKNOWN | — | OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. | Nov 28, 2025 |
| CVE-2025-61757 | UNKNOWN | — | Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. | Nov 21, 2025 |
| CVE-2025-62215 | UNKNOWN | — | Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. | Nov 12, 2025 |
| CVE-2025-48703 | UNKNOWN | — | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. | Nov 4, 2025 |
| CVE-2025-11371 | UNKNOWN | — | Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. | Nov 4, 2025 |
| CVE-2025-24893 | UNKNOWN | — | XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch. | Oct 30, 2025 |
| CVE-2025-6204 | UNKNOWN | — | Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. | Oct 28, 2025 |
| CVE-2025-6205 | UNKNOWN | — | Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application. | Oct 28, 2025 |
| CVE-2025-54236 | UNKNOWN | — | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. | Oct 24, 2025 |
| CVE-2025-59287 | UNKNOWN | — | Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. | Oct 24, 2025 |
| CVE-2025-61932 | UNKNOWN | — | Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets. | Oct 22, 2025 |
| CVE-2025-2747 | UNKNOWN | — | Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. | Oct 20, 2025 |
| CVE-2022-48503 | UNKNOWN | — | Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Oct 20, 2025 |
| CVE-2025-33073 | UNKNOWN | — | Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. | Oct 20, 2025 |
| CVE-2025-2746 | UNKNOWN | — | Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. | Oct 20, 2025 |
| CVE-2025-54253 | UNKNOWN | — | Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. | Oct 15, 2025 |