{
  "query": {
    "kev": "1",
    "page": "15"
  },
  "count": 20,
  "total": 1734,
  "page": 15,
  "limit": 20,
  "updated": {
    "cves": "2026-10-06T10:45:36.976Z",
    "kev": "2026-10-06T11:44:39.558Z",
    "epss": "2026-10-06T06:57:27.860Z",
    "breaches": "2026-10-06T06:45:27.314Z",
    "posts": "2026-10-06T11:45:39.554Z"
  },
  "links": {
    "web": "https://spydr.io/threats?kev=1&page=15",
    "next": "https://spydr.io/threats.json?kev=1&page=16"
  },
  "warnings": [],
  "results": [
    {
      "id": "CVE-2025-48703",
      "url": "https://spydr.io/cve/CVE-2025-48703",
      "published": "2025-09-19T18:15:36.620Z",
      "modified": "2026-06-17T09:30:12.133Z",
      "score": 9,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "score_source": "mitre.org",
      "epss": 0.99655,
      "epss_percentile": 0.99949,
      "exploited": true,
      "kev": {
        "added": "2025-11-04",
        "due": "2025-11-25",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "centos-webpanel"
      ],
      "products": [
        "centos-webpanel CentOS Web Panel"
      ],
      "cwes": [
        "CWE-78"
      ],
      "description": "CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known."
    },
    {
      "id": "CVE-2025-41244",
      "url": "https://spydr.io/cve/CVE-2025-41244",
      "published": "2025-09-29T17:15:30.843Z",
      "modified": "2026-06-17T09:22:39.880Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "vmware.com",
      "epss": 0.08438,
      "epss_percentile": 0.9485,
      "exploited": true,
      "kev": {
        "added": "2025-10-30",
        "due": "2025-11-20",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "VMware"
      ],
      "products": [
        "VMware VCF operations",
        "VMware tools",
        "VMware Aria Operations",
        "VMware Cloud Foundation",
        "VMware Telco Cloud Platform",
        "VMware Telco Cloud Infrastructure"
      ],
      "cwes": [
        "CWE-267"
      ],
      "description": "VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM."
    },
    {
      "id": "CVE-2025-24893",
      "url": "https://spydr.io/cve/CVE-2025-24893",
      "published": "2025-02-20T20:15:46.697Z",
      "modified": "2026-06-17T08:59:47.940Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99864,
      "epss_percentile": 0.99962,
      "exploited": true,
      "kev": {
        "added": "2025-10-30",
        "due": "2025-11-20",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "xwiki"
      ],
      "products": [
        "xwiki-platform"
      ],
      "cwes": [
        "CWE-95",
        "CWE-94"
      ],
      "description": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed."
    },
    {
      "id": "CVE-2025-6205",
      "url": "https://spydr.io/cve/CVE-2025-6205",
      "published": "2025-08-04T10:15:28.057Z",
      "modified": "2026-06-17T10:01:22.973Z",
      "score": 9.1,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "score_source": "3ds.com",
      "epss": 0.73752,
      "epss_percentile": 0.99465,
      "exploited": true,
      "kev": {
        "added": "2025-10-28",
        "due": "2025-11-18",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Dassault Systèmes"
      ],
      "products": [
        "Dassault Systèmes DELMIA Apriso"
      ],
      "cwes": [
        "CWE-862"
      ],
      "description": "A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application."
    },
    {
      "id": "CVE-2025-6204",
      "url": "https://spydr.io/cve/CVE-2025-6204",
      "published": "2025-08-04T10:15:27.800Z",
      "modified": "2026-06-17T10:01:22.863Z",
      "score": 8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "score_source": "3ds.com",
      "epss": 0.79342,
      "epss_percentile": 0.99593,
      "exploited": true,
      "kev": {
        "added": "2025-10-28",
        "due": "2025-11-18",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Dassault Systèmes"
      ],
      "products": [
        "Dassault Systèmes DELMIA Apriso"
      ],
      "cwes": [
        "CWE-94"
      ],
      "description": "An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code."
    },
    {
      "id": "CVE-2025-59287",
      "url": "https://spydr.io/cve/CVE-2025-59287",
      "published": "2025-10-14T17:16:11.670Z",
      "modified": "2026-06-17T09:45:52.480Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.9998,
      "epss_percentile": 0.99981,
      "exploited": true,
      "kev": {
        "added": "2025-10-24",
        "due": "2025-11-14",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows Server 2012",
        "Microsoft Windows Server 2012 (Server Core installation)",
        "Microsoft Windows Server 2012 R2",
        "Microsoft Windows Server 2012 R2 (Server Core installation)",
        "Microsoft Windows Server 2016",
        "Microsoft Windows Server 2016 (Server Core installation)",
        "Microsoft Windows Server 2019",
        "Microsoft Windows Server 2019 (Server Core installation)",
        "Microsoft Windows Server 2022",
        "Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)",
        "Microsoft Windows Server 2025",
        "Microsoft Windows Server 2025 (Server Core installation)"
      ],
      "cwes": [
        "CWE-502"
      ],
      "description": "Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network."
    },
    {
      "id": "CVE-2025-54236",
      "url": "https://spydr.io/cve/CVE-2025-54236",
      "published": "2025-09-09T14:15:46.563Z",
      "modified": "2026-06-17T09:39:41.293Z",
      "score": 9.1,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "score_source": "adobe.com",
      "epss": 0.94532,
      "epss_percentile": 0.99853,
      "exploited": true,
      "kev": {
        "added": "2025-10-24",
        "due": "2025-11-14",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Adobe"
      ],
      "products": [
        "Adobe Commerce"
      ],
      "cwes": [
        "CWE-20"
      ],
      "description": "Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction."
    },
    {
      "id": "CVE-2025-61932",
      "url": "https://spydr.io/cve/CVE-2025-61932",
      "published": "2025-10-20T08:15:33.303Z",
      "modified": "2026-06-17T09:51:06.030Z",
      "score": 9.3,
      "severity": "critical",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "jpcert.or.jp",
      "epss": 0.02768,
      "epss_percentile": 0.85837,
      "exploited": true,
      "kev": {
        "added": "2025-10-22",
        "due": "2025-11-12",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "MOTEX Inc."
      ],
      "products": [
        "MOTEX Inc. Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA))"
      ],
      "cwes": [
        "CWE-940"
      ],
      "description": "Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets."
    },
    {
      "id": "CVE-2025-61884",
      "url": "https://spydr.io/cve/CVE-2025-61884",
      "published": "2025-10-12T03:15:34.720Z",
      "modified": "2026-08-04T05:16:36.407Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "score_source": "oracle.com",
      "epss": 0.95891,
      "epss_percentile": 0.99873,
      "exploited": true,
      "kev": {
        "added": "2025-10-20",
        "due": "2025-11-10",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Oracle Corporation"
      ],
      "products": [
        "Oracle Corporation Oracle Configurator"
      ],
      "cwes": [
        "CWE-22",
        "CWE-93",
        "CWE-287",
        "CWE-444",
        "CWE-501",
        "CWE-918"
      ],
      "description": "Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."
    },
    {
      "id": "CVE-2025-33073",
      "url": "https://spydr.io/cve/CVE-2025-33073",
      "published": "2025-06-10T17:23:02.967Z",
      "modified": "2026-06-17T09:13:04.220Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.82699,
      "epss_percentile": 0.9966,
      "exploited": true,
      "kev": {
        "added": "2025-10-20",
        "due": "2025-11-10",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows 10 Version 1507",
        "Microsoft Windows 10 Version 1607",
        "Microsoft Windows 10 Version 1809",
        "Microsoft Windows 10 Version 21H2",
        "Microsoft Windows 10 Version 22H2",
        "Microsoft Windows 11 version 22H2",
        "Microsoft Windows 11 version 22H3",
        "Microsoft Windows 11 Version 23H2",
        "Microsoft Windows 11 Version 24H2",
        "Microsoft Windows Server 2008 R2 Service Pack 1",
        "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
        "Microsoft Windows Server 2008 Service Pack 2",
        "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)",
        "Microsoft Windows Server 2012",
        "Microsoft Windows Server 2012 (Server Core installation)",
        "Microsoft Windows Server 2012 R2",
        "Microsoft Windows Server 2012 R2 (Server Core installation)",
        "Microsoft Windows Server 2016",
        "Microsoft Windows Server 2016 (Server Core installation)",
        "Microsoft Windows Server 2019"
      ],
      "cwes": [
        "CWE-284"
      ],
      "description": "Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network."
    },
    {
      "id": "CVE-2025-2747",
      "url": "https://spydr.io/cve/CVE-2025-2747",
      "published": "2025-03-24T19:15:51.967Z",
      "modified": "2026-06-17T09:07:33.210Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "vulncheck.com",
      "epss": 0.97166,
      "epss_percentile": 0.99894,
      "exploited": true,
      "kev": {
        "added": "2025-10-20",
        "due": "2025-11-10",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Kentico"
      ],
      "products": [
        "Kentico Xperience"
      ],
      "cwes": [
        "CWE-288"
      ],
      "description": "An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178."
    },
    {
      "id": "CVE-2025-2746",
      "url": "https://spydr.io/cve/CVE-2025-2746",
      "published": "2025-03-24T19:15:51.460Z",
      "modified": "2026-06-17T09:07:33.103Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "vulncheck.com",
      "epss": 0.7304,
      "epss_percentile": 0.99444,
      "exploited": true,
      "kev": {
        "added": "2025-10-20",
        "due": "2025-11-10",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Kentico"
      ],
      "products": [
        "Kentico Xperience"
      ],
      "cwes": [
        "CWE-288"
      ],
      "description": "An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172."
    },
    {
      "id": "CVE-2022-48503",
      "url": "https://spydr.io/cve/CVE-2022-48503",
      "published": "2023-08-14T23:15:10.490Z",
      "modified": "2026-06-17T05:15:33.720Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.03213,
      "epss_percentile": 0.8777,
      "exploited": true,
      "kev": {
        "added": "2025-10-20",
        "due": "2025-11-10",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apple"
      ],
      "products": [
        "Apple macOS",
        "Apple tvOS",
        "Apple Safari",
        "Apple watchOS",
        "Apple iOS and iPadOS"
      ],
      "cwes": [
        "CWE-129"
      ],
      "description": "The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution."
    },
    {
      "id": "CVE-2025-54253",
      "url": "https://spydr.io/cve/CVE-2025-54253",
      "published": "2025-08-05T17:15:29.283Z",
      "modified": "2026-06-17T09:39:43.257Z",
      "score": 10,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "score_source": "adobe.com",
      "epss": 0.88262,
      "epss_percentile": 0.99767,
      "exploited": true,
      "kev": {
        "added": "2025-10-15",
        "due": "2025-11-05",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Adobe"
      ],
      "products": [
        "Adobe Experience Manager"
      ],
      "cwes": [
        "CWE-863"
      ],
      "description": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed."
    },
    {
      "id": "CVE-2025-59230",
      "url": "https://spydr.io/cve/CVE-2025-59230",
      "published": "2025-10-14T17:16:04.173Z",
      "modified": "2026-06-17T09:45:46.253Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.02657,
      "epss_percentile": 0.85176,
      "exploited": true,
      "kev": {
        "added": "2025-10-14",
        "due": "2025-11-04",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows 10 Version 1507",
        "Microsoft Windows 10 Version 1607",
        "Microsoft Windows 10 Version 1809",
        "Microsoft Windows 10 Version 21H2",
        "Microsoft Windows 10 Version 22H2",
        "Microsoft Windows 11 version 22H2",
        "Microsoft Windows 11 version 22H3",
        "Microsoft Windows 11 Version 23H2",
        "Microsoft Windows 11 Version 24H2",
        "Microsoft Windows 11 Version 25H2",
        "Microsoft Windows Server 2008 R2 Service Pack 1",
        "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
        "Microsoft Windows Server 2008 Service Pack 2",
        "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)",
        "Microsoft Windows Server 2012",
        "Microsoft Windows Server 2012 (Server Core installation)",
        "Microsoft Windows Server 2012 R2",
        "Microsoft Windows Server 2012 R2 (Server Core installation)",
        "Microsoft Windows Server 2016",
        "Microsoft Windows Server 2016 (Server Core installation)"
      ],
      "cwes": [
        "CWE-284"
      ],
      "description": "Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally."
    },
    {
      "id": "CVE-2025-24990",
      "url": "https://spydr.io/cve/CVE-2025-24990",
      "published": "2025-10-14T17:15:39.193Z",
      "modified": "2026-06-17T08:59:56.590Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.06369,
      "epss_percentile": 0.93457,
      "exploited": true,
      "kev": {
        "added": "2025-10-14",
        "due": "2025-11-04",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows 10 Version 1507",
        "Microsoft Windows 10 Version 1607",
        "Microsoft Windows 10 Version 1809",
        "Microsoft Windows 10 Version 21H2",
        "Microsoft Windows 10 Version 22H2",
        "Microsoft Windows 11 version 22H2",
        "Microsoft Windows 11 Version 23H2",
        "Microsoft Windows 11 Version 24H2",
        "Microsoft Windows 11 Version 25H2",
        "Microsoft Windows Server 2008 R2 Service Pack 1",
        "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
        "Microsoft Windows Server 2008 Service Pack 2",
        "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)",
        "Microsoft Windows Server 2012",
        "Microsoft Windows Server 2012 (Server Core installation)",
        "Microsoft Windows Server 2012 R2",
        "Microsoft Windows Server 2012 R2 (Server Core installation)",
        "Microsoft Windows Server 2016",
        "Microsoft Windows Server 2016 (Server Core installation)",
        "Microsoft Windows Server 2019"
      ],
      "cwes": [
        "CWE-822"
      ],
      "description": "Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware."
    },
    {
      "id": "CVE-2025-47827",
      "url": "https://spydr.io/cve/CVE-2025-47827",
      "published": "2025-06-05T14:15:32.263Z",
      "modified": "2026-06-17T09:28:44.910Z",
      "score": 4.6,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "score_source": "CISA ADP",
      "epss": 0.04927,
      "epss_percentile": 0.91876,
      "exploited": true,
      "kev": {
        "added": "2025-10-14",
        "due": "2025-11-04",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "igel",
        "microsoft"
      ],
      "products": [
        "igel os",
        "microsoft windows 10 1507",
        "microsoft windows 10 1607",
        "microsoft windows 10 1809",
        "microsoft windows 10 21h2",
        "microsoft windows 10 22h2",
        "microsoft windows 11 22h2",
        "microsoft windows 11 23h2",
        "microsoft windows 11 24h2",
        "microsoft windows 11 25h2",
        "microsoft windows server 2012",
        "microsoft windows server 2016",
        "microsoft windows server 2019",
        "microsoft windows server 2022",
        "microsoft windows server 2022 23h2",
        "microsoft windows server 2025"
      ],
      "cwes": [
        "CWE-347"
      ],
      "description": "In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image."
    },
    {
      "id": "CVE-2016-7836",
      "url": "https://spydr.io/cve/CVE-2016-7836",
      "published": "2017-06-09T16:29:01.267Z",
      "modified": "2026-06-17T00:53:34.867Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.1923,
      "epss_percentile": 0.97262,
      "exploited": true,
      "kev": {
        "added": "2025-10-14",
        "due": "2025-11-04",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Sky Co., LTD."
      ],
      "products": [
        "Sky Co., LTD. SKYSEA Client View"
      ],
      "cwes": [
        "CWE-287"
      ],
      "description": "SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program."
    },
    {
      "id": "CVE-2021-43798",
      "url": "https://spydr.io/cve/CVE-2021-43798",
      "published": "2021-12-07T19:15:07.633Z",
      "modified": "2026-06-17T04:11:27.540Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "score_source": "github.com",
      "epss": 0.88503,
      "epss_percentile": 0.9977,
      "exploited": true,
      "kev": {
        "added": "2025-10-09",
        "due": "2025-10-30",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "grafana"
      ],
      "products": [
        "grafana"
      ],
      "cwes": [
        "CWE-22"
      ],
      "description": "Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline."
    },
    {
      "id": "CVE-2025-27915",
      "url": "https://spydr.io/cve/CVE-2025-27915",
      "published": "2025-03-12T15:15:39.900Z",
      "modified": "2026-06-17T09:04:22.957Z",
      "score": 5.4,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "score_source": "CISA ADP",
      "epss": 0.04064,
      "epss_percentile": 0.90366,
      "exploited": true,
      "kev": {
        "added": "2025-10-07",
        "due": "2025-10-28",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "synacor"
      ],
      "products": [
        "synacor zimbra collaboration suite"
      ],
      "cwes": [
        "CWE-79"
      ],
      "description": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration."
    }
  ],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}