The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
10 Jul 2025 Citrix NetScaler ADC and Gateway Memory corruption
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-43.56, citrix netscaler gateway 14.1-43.56, citrix netscaler application delivery controller 13.1-58.32, citrix netscaler gateway 13.1-58.32, citrix netscaler application delivery controller 13.1-37.235 and 1 older
- CISA due date
- 11 Jul 2025
- Weakness
- CWE-125
7 Jul 2025 Synacor Zimbra Collaboration Suite (ZCS) Server-side request forgery
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 8.8.9, synacor zimbra collaboration suite 8.7.11, synacor zimbra collaboration suite 8.6.0
- CISA due date
- 28 Jul 2025
- Weakness
- CWE-918, CWE-807
7 Jul 2025 Rails Ruby on Rails Path traversal
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- rubyonrails rails 5.2.2.1, rubyonrails rails 5.1.6.2, rubyonrails rails 5.0.7.2, rubyonrails rails 4.2.11.1
- CISA due date
- 28 Jul 2025
- Weakness
- CWE-22
7 Jul 2025 PHPMailer Command injection
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- phpmailer project phpmailer 5.2.18
- CISA due date
- 28 Jul 2025
- Weakness
- CWE-77, CWE-88
7 Jul 2025 Looking Glass Multi-Router Looking Glass (MRLG) Memory corruption
fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 Jul 2025
- Weakness
- CWE-119
2 Jul 2025 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 138.0.7204.96, google chrome 138.0.7204.92
- CISA due date
- 23 Jul 2025
- Weakness
- CWE-843
1 Jul 2025 TeleMessage TM SGNL Access control flaw
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 22 Jul 2025
- Weakness
- CWE-528
1 Jul 2025 TeleMessage TM SGNL Security flaw
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 22 Jul 2025
- Weakness
- CWE-1188
30 Jun 2025 Citrix NetScaler ADC and Gateway Memory corruption
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-47.46, citrix netscaler gateway 14.1-47.46, citrix netscaler application delivery controller 13.1-59.19, citrix netscaler gateway 13.1-59.19, citrix netscaler application delivery controller 13.1-37.236
- CISA due date
- 21 Jul 2025
- Weakness
- CWE-119
25 Jun 2025 AMI MegaRAC SPx Authentication bypass
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ami megarac sp-x 13.5, ami megarac sp-x 12.7
- CISA due date
- 16 Jul 2025
- Weakness
- CWE-290
On Hacker News
Open Source Tools to Detect CVE-2024-5408525 Jun 2025 D-Link DIR-859 Router Path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Jul 2025
- Weakness
- CWE-22
25 Jun 2025 Fortinet FortiOS Authentication bypass
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Jul 2025
- Weakness
- CWE-798
17 Jun 2025 Linux Kernel Security flaw
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.1.9, linux kernel 5.15.91
- CISA due date
- 8 Jul 2025
- Weakness
- CWE-282
16 Jun 2025 Apple Multiple Products Security flaw
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple ipados 18.3.1, apple ipados 17.7.5, apple ipados 16.7.11, apple ipados 15.8.4, apple iphone os 15.8.4 and 5 older
- CISA due date
- 7 Jul 2025
16 Jun 2025 TP-Link Multiple Routers Command injection
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 7 Jul 2025
- Weakness
- CWE-77
10 Jun 2025 Microsoft Windows Path traversal
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1665, microsoft windows server 2022 10.0.20348.3745, microsoft windows server 2019 10.0.17763.7434, microsoft windows server 2016 10.0.14393.8148, microsoft windows 11 24h2 10.0.26100.4270 and 7 older
- CISA due date
- 1 Jul 2025
- Weakness
- CWE-73
10 Jun 2025 Wazuh Server Remote code execution
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wazuh 4.9.1
- CISA due date
- 1 Jul 2025
- Weakness
- CWE-502
9 Jun 2025 Erlang/OTP Authentication bypass
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- erlang/otp 27.3.3, erlang/otp 26.2.5.11, erlang/otp 25.3.2.20, cisco confd basic 8.4.4.1, cisco confd basic 8.3.8.1 and 7 older
- CISA due date
- 30 Jun 2025
- Weakness
- CWE-306
9 Jun 2025 Roundcube Webmail Cross-site scripting
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- roundcube webmail 1.6.8, roundcube webmail 1.5.8
- CISA due date
- 30 Jun 2025
- Weakness
- CWE-79
5 Jun 2025 Google Chromium V8 Memory corruption
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 137.0.7151.68, microsoft edge chromium 137.0.3296.62
- CISA due date
- 26 Jun 2025
- Weakness
- CWE-125, CWE-787
3 Jun 2025 Qualcomm Multiple Chipsets Memory corruption
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Jun 2025
- Weakness
- CWE-416
3 Jun 2025 Qualcomm Multiple Chipsets Access control flaw
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Jun 2025
- Weakness
- CWE-863
3 Jun 2025 Qualcomm Multiple Chipsets Access control flaw
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Jun 2025
- Weakness
- CWE-863
2 Jun 2025 ConnectWise ScreenConnect Remote code execution
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- connectwise screenconnect 25.2.4
- CISA due date
- 23 Jun 2025
- Weakness
- CWE-287
2 Jun 2025 Craft CMS Security flaw
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- craftcms craft cms 5.7.5, craftcms craft cms 4.15.3
- CISA due date
- 23 Jun 2025
- Weakness
- CWE-472
2 Jun 2025 Craft CMS Remote code execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- craftcms craft cms 5.5.2, craftcms craft cms 4.13.2, craftcms craft cms 3.9.14
- CISA due date
- 23 Jun 2025
- Weakness
- CWE-94
2 Jun 2025 ASUS RT-AX55 Routers Command injection
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Jun 2025
- Weakness
- CWE-78
2 Jun 2025 ASUS Routers Authentication bypass
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- asus gt-ac2900 firmware 3.0.0.4.386.42643, asus lyra mini firmware 3.0.0.4.384.46630
- CISA due date
- 23 Jun 2025
- Weakness
- CWE-287
22 May 2025 Samsung MagicINFO 9 Server Path traversal
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- samsung magicinfo 9 server 21.1052.0
- CISA due date
- 12 Jun 2025
- Weakness
- CWE-22
19 May 2025 Ivanti Endpoint Manager Mobile (EPMM) Remote code execution
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager mobile 12.4.0.2, ivanti endpoint manager mobile 12.3.0.2, ivanti endpoint manager mobile 11.12.0.5
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-94
19 May 2025 Ivanti Endpoint Manager Mobile (EPMM) Authentication bypass
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager mobile 12.4.0.2, ivanti endpoint manager mobile 12.3.0.2, ivanti endpoint manager mobile 11.12.0.5
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-288
19 May 2025 Srimax Output Messenger Path traversal
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- srimax output messenger 2.0.63
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-22
19 May 2025 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- zimbra collaboration 10.0.7
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-79
19 May 2025 MDaemon Email Server Cross-site scripting
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- mdaemon 24.5.1
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-79
19 May 2025 ZKTeco BioTime Path traversal
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- zkteco biotime 9.0.1
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-22
15 May 2025 SAP NetWeaver Remote code execution
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Jun 2025
- Weakness
- CWE-502
15 May 2025 DrayTek Vigor Routers Command injection
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Jun 2025
- Weakness
- CWE-78
14 May 2025 Fortinet Multiple Products Memory corruption
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortimail 7.6.3, fortinet fortindr 7.4.8, fortinet fortimail 7.4.5, fortinet fortimail 7.2.8, fortinet fortindr 7.2.5 and 7 older
- CISA due date
- 4 Jun 2025
- Weakness
- CWE-124
13 May 2025 Microsoft Windows Memory corruption
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-416
13 May 2025 Microsoft Windows Input validation flaw
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-122
13 May 2025 Microsoft Windows Memory corruption
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-416
13 May 2025 Microsoft Windows Memory corruption
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.3981, microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows 11 24h2 10.0.26100.3981 and 5 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-416
13 May 2025 Microsoft Windows Memory corruption
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-843
12 May 2025 TeleMessage TM SGNL Security flaw
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 2 Jun 2025
- Weakness
- CWE-912
7 May 2025 GeoVision Multiple Devices Command injection
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 May 2025
- Weakness
- CWE-78
7 May 2025 GeoVision Multiple Devices Command injection
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 May 2025
- Weakness
- CWE-78
6 May 2025 FreeType Memory corruption
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 May 2025
- Weakness
- CWE-787
5 May 2025 Langflow Remote code execution
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- langflow 1.3.0
- CISA due date
- 26 May 2025
- Weakness
- CWE-306
2 May 2025 Commvault Command Center Authentication bypass
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- commvault 11.38.20
- CISA due date
- 23 May 2025
- Weakness
- CWE-22
2 May 2025 Yiiframework Yii Security flaw
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- yiiframework yii 2.0.52
- CISA due date
- 23 May 2025
- Weakness
- CWE-424
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.