The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
1 May 2025 Apache HTTP Server Input validation flaw
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma 500v firmware 10.2.1.14-75sv, sonicwall sma 410 firmware 10.2.1.14-75sv, sonicwall sma 400 firmware 10.2.1.14-75sv, sonicwall sma 210 firmware 10.2.1.14-75sv, sonicwall sma 200 firmware 10.2.1.14-75sv and 1 older
- CISA due date
- 22 May 2025
- Weakness
- CWE-116
1 May 2025 SonicWall SMA100 Appliances Command injection
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 22 May 2025
- Weakness
- CWE-78
29 Apr 2025 SAP NetWeaver Malicious file upload
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 20 May 2025
- Weakness
- CWE-434
28 Apr 2025 Qualitia Active! Mail Memory corruption
Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- qualitia active! mail 6.60.05008562
- CISA due date
- 19 May 2025
- Weakness
- CWE-121
28 Apr 2025 Commvault Web Server Remote code execution
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- commvault 11.36.46, commvault 11.32.89, commvault 11.28.141, commvault 11.20.217
- CISA due date
- 19 May 2025
- Weakness
- CWE-94
28 Apr 2025 Broadcom Brocade Fabric OS Remote code execution
Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- broadcom fabric operating system 9.1.1d7
- CISA due date
- 19 May 2025
- Weakness
- CWE-94
17 Apr 2025 Apple Multiple Products Access control flaw
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple tvos 18.4.1, apple ipados 18.4.1, apple iphone os 18.4.1, apple macos 15.4.1, apple visionos 2.4.1
- CISA due date
- 8 May 2025
- Weakness
- CWE-1220
17 Apr 2025 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple tvos 18.4.1, apple ipados 18.4.1, apple iphone os 18.4.1, apple macos 15.4.1, apple watchos 11.5 and 1 older
- CISA due date
- 8 May 2025
- Weakness
- CWE-119
17 Apr 2025 Microsoft Windows Path traversal
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 8 May 2025
- Weakness
- CWE-73
On Hacker News
CVE-2025-24054, NTLM Exploit in the Wild16 Apr 2025 SonicWall SMA100 Appliances Command injection
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma 410 firmware 10.2.1.1-19sv, sonicwall sma 410 firmware 10.2.0.8-37sv, sonicwall sma 410 firmware 9.0.0.11-31sv, sonicwall sma 400 firmware 10.2.1.1-19sv, sonicwall sma 400 firmware 10.2.0.8-37sv and 7 older
- CISA due date
- 7 May 2025
- Weakness
- CWE-78
9 Apr 2025 Linux Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.12.2, linux kernel 6.11.11, linux kernel 6.6.64, linux kernel 6.1.120, linux kernel 5.15.174 and 3 older
- CISA due date
- 30 Apr 2025
- Weakness
- CWE-787
9 Apr 2025 Linux Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.12.2, linux kernel 6.11.11, linux kernel 6.6.64, linux kernel 6.1.120, linux kernel 5.15.174 and 2 older
- CISA due date
- 30 Apr 2025
- Weakness
- CWE-125
8 Apr 2025 Gladinet CentreStack Authentication bypass
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gladinet centrestack 16.4.10315.56368
- CISA due date
- 29 Apr 2025
- Weakness
- CWE-321
8 Apr 2025 Microsoft Windows Memory corruption
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1551, microsoft windows server 2022 10.0.20348.3453, microsoft windows server 2019 10.0.17763.7136, microsoft windows server 2016 10.0.14393.7969, microsoft windows 11 24h2 10.0.26100.3775 and 7 older
- CISA due date
- 29 Apr 2025
- Weakness
- CWE-416
7 Apr 2025 CrushFTP Authentication bypass
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- crushftp 11.3.1, crushftp 10.8.4
- CISA due date
- 28 Apr 2025
- Weakness
- CWE-305
4 Apr 2025 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Memory corruption
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
- What to do
- Apply mitigations as set forth in the CISA instructions linked below.
- Fixed in (NVD)
- ivanti zero trust access gateway 22.8, ivanti connect secure 22.7, ivanti policy secure 22.7
- CISA due date
- 11 Apr 2025
- Weakness
- CWE-121
1 Apr 2025 Apache Tomcat Remote code execution
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apache tomcat 11.0.3, apache tomcat 10.1.35, apache tomcat 9.0.99
- CISA due date
- 22 Apr 2025
- Weakness
- CWE-44, CWE-502
31 Mar 2025 Cisco Smart Licensing Utility Authentication bypass
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco smart license utility 2.3.0
- CISA due date
- 21 Apr 2025
- Weakness
- CWE-912
27 Mar 2025 Google Chromium Mojo Security flaw
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 134.0.6998.177
- CISA due date
- 17 Apr 2025
26 Mar 2025 Sitecore CMS and Experience Platform (XP) Remote code execution
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Apr 2025
- Weakness
- CWE-502
26 Mar 2025 Sitecore CMS and Experience Platform (XP) Remote code execution
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Apr 2025
- Weakness
- CWE-502
24 Mar 2025 reviewdog action-setup GitHub Action Security flaw
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- reviewdog action-shellcheck 1.29.2, reviewdog action-ast-grep 1.26.2, reviewdog action-staticcheck 1.26.2, reviewdog action-typos 1.17.2, reviewdog action-composite-template 0.20.2
- CISA due date
- 14 Apr 2025
- Weakness
- CWE-506
19 Mar 2025 Edimax IC-7100 IP Camera Command injection
Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 9 Apr 2025
- Weakness
- CWE-78
19 Mar 2025 NAKIVO Backup and Replication Path traversal
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- nakivo backup & replication director 11.0.0.88174
- CISA due date
- 9 Apr 2025
- Weakness
- CWE-36
19 Mar 2025 SAP NetWeaver Path traversal
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 9 Apr 2025
- Weakness
- CWE-22
18 Mar 2025 tj-actions changed-files GitHub Action Security flaw
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 8 Apr 2025
- Weakness
- CWE-506
18 Mar 2025 Fortinet FortiOS and FortiProxy Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortiproxy 7.2.13, fortinet fortiproxy 7.0.20, fortinet fortios 7.0.17
- CISA due date
- 8 Apr 2025
- Weakness
- CWE-288
13 Mar 2025 Apple Multiple Products Memory corruption
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple ipados 18.3.2, apple iphone os 18.3.2, apple safari 18.3.1, apple ipados 17.7.6, apple ipados 16.7.11 and 6 older
- CISA due date
- 3 Apr 2025
- Weakness
- CWE-787
13 Mar 2025 Juniper Junos OS Security flaw
An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- juniper junos 21.2
- CISA due date
- 3 Apr 2025
- Weakness
- CWE-653
11 Mar 2025 Microsoft Windows Security flaw
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-707
11 Mar 2025 Microsoft Windows Memory corruption
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-122
11 Mar 2025 Microsoft Windows Memory corruption
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-125
11 Mar 2025 Microsoft Windows Memory corruption
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-190, CWE-122
11 Mar 2025 Microsoft Windows Information disclosure
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-532
11 Mar 2025 Microsoft Windows Memory corruption
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2016 10.0.14393.7876, microsoft windows 10 1607 10.0.14393.7876, microsoft windows 10 1507 10.0.10240.20947
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-416
10 Mar 2025 Advantive VeraCore SQL injection
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- advantive veracore 2025.1.1.3
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-89
10 Mar 2025 Advantive VeraCore Malicious file upload
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- advantive veracore 2024.4.2.1
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-434
10 Mar 2025 Ivanti Endpoint Manager (EPM) Path traversal
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-36
10 Mar 2025 Ivanti Endpoint Manager (EPM) Path traversal
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-36
10 Mar 2025 Ivanti Endpoint Manager (EPM) Path traversal
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-36
4 Mar 2025 VMware ESXi, Workstation, and Fusion Memory corruption
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware workstation 17.6.3, vmware fusion 13.6.3
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-125
4 Mar 2025 VMware ESXi Memory corruption
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-123
4 Mar 2025 VMware ESXi and Workstation Race condition
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware workstation 17.6.3
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-367
4 Mar 2025 Linux Kernel Security flaw
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.11.8, linux kernel 6.6.61, linux kernel 6.1.117, linux kernel 5.15.172, linux kernel 5.10.230 and 3 older
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-908
3 Mar 2025 Progress WhatsUp Gold Path traversal
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- progress whatsup gold 23.1.3
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-22
3 Mar 2025 Cisco Small Business RV Series Routers Command injection
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not and will not release software updates that address this vulnerability. However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section. {{value}} ["%7b%7bvalue%7d%7d"])}]]
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-77
3 Mar 2025 Hitachi Vantara Pentaho Business Analytics (BA) Server Security flaw
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- hitachi vantara pentaho business analytics server 9.3.0.2
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-647
3 Mar 2025 Hitachi Vantara Pentaho Business Analytics (BA) Server Remote code execution
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- hitachi vantara pentaho business analytics server 9.3.0.2
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-74
3 Mar 2025 Microsoft Windows Denial of service
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-404
25 Feb 2025 Microsoft Partner Center Privilege escalation
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 18 Mar 2025
- Weakness
- CWE-269
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.