Threats & CVE Intelligence
Search the locally synchronized CISA known-exploited vulnerabilities catalog, or enter a CVE ID or keyword to search the broader NIST National Vulnerability Database. NVD searches are retrieved on demand and may be rate limited.
Last successful sync: 2026-11-07 13:55:58 UTC · Source catalog updated: 2026-11-06T19:44:45.1797Z · 1769 records in latest import.
CISA Known Exploited Vulnerabilities · 1769 matches
Linux Kernel Out-of-Bounds Access Vulnerability
Linux — Kernel
Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or ex…
CVE-2024-53150 · KEV 2025-04-09Linux Kernel Out-of-Bounds Read Vulnerability
Linux — Kernel
Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
CVE-2025-30406 · KEV 2025-04-08Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Gladinet — CentreStack
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewSt…
CVE-2025-29824 · KEV 2025-04-08Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Microsoft — Windows
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Ransomware use reportedCVE-2025-31161 · KEV 2025-04-07CrushFTP Authentication Bypass Vulnerability
CrushFTP — CrushFTP
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full…
Ransomware use reportedCVE-2025-22457 · KEV 2025-04-04Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti — Connect Secure, Policy Secure, and ZTA Gateways
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Ransomware use reportedCVE-2025-24813 · KEV 2025-04-01Apache Tomcat Path Equivalence Vulnerability
Apache — Tomcat
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
CVE-2024-20439 · KEV 2025-03-31Cisco Smart Licensing Utility Static Credential Vulnerability
Cisco — Smart Licensing Utility
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
CVE-2025-2783 · KEV 2025-03-27Google Chromium Mojo Sandbox Escape Vulnerability
Google — Chromium Mojo
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that …
CVE-2019-9875 · KEV 2025-03-26Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Sitecore — CMS and Experience Platform (XP)
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST …
CVE-2019-9874 · KEV 2025-03-26Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Sitecore — CMS and Experience Platform (XP)
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POS…
CVE-2025-30154 · KEV 2025-03-24reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
reviewdog — action-setup GitHub Action
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
CVE-2025-1316 · KEV 2025-03-19Edimax IC-7100 IP Camera OS Command Injection Vulnerability
Edimax — IC-7100 IP Camera
Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (E…
CVE-2024-48248 · KEV 2025-03-19NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
NAKIVO — Backup and Replication
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
CVE-2017-12637 · KEV 2025-03-19SAP NetWeaver Directory Traversal Vulnerability
SAP — NetWeaver
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
CVE-2025-30066 · KEV 2025-03-18tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
tj-actions — changed-files GitHub Action
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS…
CVE-2025-24472 · KEV 2025-03-18Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet — FortiOS and FortiProxy
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Ransomware use reportedCVE-2025-24201 · KEV 2025-03-13Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
Apple — Multiple Products
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that …
CVE-2025-21590 · KEV 2025-03-13Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
Juniper — Junos OS
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
CVE-2025-26633 · KEV 2025-03-11Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Microsoft — Windows
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
Ransomware use reportedCVE-2025-24993 · KEV 2025-03-11Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Microsoft — Windows
Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
CVE-2025-24991 · KEV 2025-03-11Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
Microsoft — Windows
Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
CVE-2025-24985 · KEV 2025-03-11Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
Microsoft — Windows
Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
CVE-2025-24984 · KEV 2025-03-11Microsoft Windows NTFS Information Disclosure Vulnerability
Microsoft — Windows
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully…
CVE-2025-24983 · KEV 2025-03-11Microsoft Windows Win32k Use-After-Free Vulnerability
Microsoft — Windows
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
CVE-2025-25181 · KEV 2025-03-10Advantive VeraCore SQL Injection Vulnerability
Advantive — VeraCore
Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.
CVE-2024-57968 · KEV 2025-03-10Advantive VeraCore Unrestricted File Upload Vulnerability
Advantive — VeraCore
Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.
CVE-2024-13161 · KEV 2025-03-10Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti — Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13160 · KEV 2025-03-10Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti — Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13159 · KEV 2025-03-10Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti — Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Source: CISA KEV catalog and NIST NVD. “Known” ransomware use is a CISA catalog label, not a real-time incident alert. Always review vendor advisories for patches.