Vulnerabilities CISA has confirmed as actively exploited. Prioritize these for remediation.
Vulnerabilities newly added to CISA KEV in the last 7 days.
| CVE ID | Title | Severity | Added |
|---|---|---|---|
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | CRITICAL | 2026. 07. 16. | |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests | CRITICAL |
| CVE ID | Title | Severity | References | Ransom | |||||
|---|---|---|---|---|---|---|---|---|---|
| SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. | CRITICAL | 10.0v3.1 |
| 2026. 07. 16. |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | CRITICAL | 2026. 07. 16. |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C | CRITICAL | 2026. 07. 15. |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX instal | HIGH | 2026. 07. 15. |
99.4% |
KEV KISA |
| 2025. 04. 24. |
| 2025. 04. 29. |
| ⚠️ |
| CVE-2025-3928 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28. | HIGH | 8.7v4.0 | 100 | 2.0% | KEV | 2025. 04. 25. | 2025. 04. 28. | — |
| CVE-2025-1976 | Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6. | HIGH | 8.6v4.0 | 100 | 0.8% | KEV | 2025. 04. 24. | 2025. 04. 28. | — |
| CVE-2025-42599 | Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition. | CRITICAL | 9.8v3.1 | 100 | 3.2% | KEV | 2025. 04. 18. | 2025. 04. 28. | — |
| CVE-2025-31201 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS. | CRITICAL | 9.8v3.1 | 100 | 14.7% | KEV | 2025. 04. 16. | 2025. 04. 17. | — |
| CVE-2025-31200 | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1. | CRITICAL | 9.8v3.1 | 100 | 19.7% | KEV | 2025. 04. 16. | 2025. 04. 17. | — |
| CVE-2025-24054 | — | — | — | 82.50 | 59.0% | KEV KISA | — | 2025. 04. 17. | — |
| CVE-2021-20035 | — | — | — | 82.50 | 3.9% | KEV | — | 2025. 04. 16. | — |
| CVE-2024-53197 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. | HIGH | 7.8v3.1 | 100 | 3.6% | KEV KISA | 2024. 12. 27. | 2025. 04. 09. | — |
| CVE-2024-53150 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descripto | HIGH | 7.1v3.1 | 100 | 1.4% | KEV KISA | 2024. 12. 24. | 2025. 04. 09. | — |
| CVE-2025-29824 | — | — | — | 87.50 | 13.5% | KEV KISA | — | 2025. 04. 08. | ⚠️ |
| CVE-2025-30406 | — | — | — | 82.50 | 93.8% | KEV | — | 2025. 04. 08. | — |
| CVE-2025-31161 | — | — | — | 87.50 | 99.9% | KEV | — | 2025. 04. 07. | ⚠️ |
| CVE-2025-22457 | — | — | — | 87.50 | 100.0% | KEV KISA | — | 2025. 04. 04. | ⚠️ |
| CVE-2025-24813 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | CRITICAL | 9.8v3.1 | 100 | 99.9% | KEV KISA | 2025. 03. 10. | 2025. 04. 01. | — |
| CVE-2024-20439 | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights ove | CRITICAL | 9.8v3.1 | 100 | 92.1% | KEV KISA | 2024. 09. 04. | 2025. 03. 31. | — |
| CVE-2025-2783 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) | HIGH | 8.3v3.1 | 100 | 8.4% | KEV KISA | 2025. 03. 26. | 2025. 03. 27. | — |
| CVE-2019-9875 | Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter. | HIGH | 8.8v3.1 | 100 | 14.2% | KEV | 2019. 05. 31. | 2025. 03. 26. | — |
| CVE-2019-9874 | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. | CRITICAL | 9.8v3.1 | 100 | 83.9% | KEV | 2019. 05. 31. | 2025. 03. 26. | — |
| CVE-2025-30154 | reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, | HIGH | 8.6v3.1 | 100 | 2.3% | KEV KISA | 2025. 03. 19. | 2025. 03. 24. | — |