{
  "query": {
    "kev": "1",
    "page": "21"
  },
  "count": 20,
  "total": 1734,
  "page": 21,
  "limit": 20,
  "updated": {
    "cves": "2026-10-07T00:46:23.556Z",
    "kev": "2026-10-07T00:45:23.006Z",
    "epss": "2026-10-06T18:58:09.363Z",
    "breaches": "2026-10-07T00:46:23.055Z",
    "posts": "2026-10-07T00:46:23.555Z"
  },
  "links": {
    "web": "https://spydr.io/threats?kev=1&page=21",
    "next": "https://spydr.io/threats.json?kev=1&page=22"
  },
  "warnings": [],
  "results": [
    {
      "id": "CVE-2024-6047",
      "url": "https://spydr.io/cve/CVE-2024-6047",
      "published": "2024-06-17T06:15:09.237Z",
      "modified": "2026-06-17T08:17:10.453Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "cert.org.tw",
      "epss": 0.10072,
      "epss_percentile": 0.95513,
      "exploited": true,
      "kev": {
        "added": "2025-05-07",
        "due": "2025-05-28",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "GeoVision"
      ],
      "products": [
        "GeoVision GV_DSP_LPR_V2",
        "GeoVision GV_IPCAMD_GV_BX1500",
        "GeoVision GV_IPCAMD_GV_CB220",
        "GeoVision GV_IPCAMD_GV_EBL1100",
        "GeoVision GV_IPCAMD_GV_EFD1100",
        "GeoVision GV_IPCAMD_GV_FD2410",
        "GeoVision GV_IPCAMD_GV_FD3400",
        "GeoVision GV_IPCAMD_GV_FE3401",
        "GeoVision GV_IPCAMD_GV_FE420",
        "GeoVision GV-VS14_VS14",
        "GeoVision GV_VS03",
        "GeoVision GV_VS2410",
        "GeoVision GV_VS28XX",
        "GeoVision GV_VS216XX",
        "GeoVision GV VS04A",
        "GeoVision GV VS04H",
        "GeoVision GVLX 4 V2",
        "GeoVision GVLX 4 V3",
        "GeoVision GV_IPCAMD_GV_BX130",
        "GeoVision GV_GM8186_VS14"
      ],
      "cwes": [
        "CWE-78"
      ],
      "description": "Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device."
    },
    {
      "id": "CVE-2025-27363",
      "url": "https://spydr.io/cve/CVE-2025-27363",
      "published": "2025-03-11T14:15:25.427Z",
      "modified": "2026-06-17T09:03:27.973Z",
      "score": 8.1,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.27775,
      "epss_percentile": 0.98044,
      "exploited": true,
      "kev": {
        "added": "2025-05-06",
        "due": "2025-05-27",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "FreeType"
      ],
      "products": [
        "FreeType"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild."
    },
    {
      "id": "CVE-2025-3248",
      "url": "https://spydr.io/cve/CVE-2025-3248",
      "published": "2025-04-07T15:15:44.897Z",
      "modified": "2026-07-14T23:17:27.010Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99993,
      "epss_percentile": 0.99987,
      "exploited": true,
      "kev": {
        "added": "2025-05-05",
        "due": "2025-05-26",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "langflow-ai"
      ],
      "products": [
        "langflow-ai langflow"
      ],
      "cwes": [
        "CWE-306",
        "CWE-94"
      ],
      "description": "Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code."
    },
    {
      "id": "CVE-2025-34028",
      "url": "https://spydr.io/cve/CVE-2025-34028",
      "published": "2025-04-22T17:16:48.027Z",
      "modified": "2026-06-17T09:13:20.070Z",
      "score": 9.3,
      "severity": "critical",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "vulncheck.com",
      "epss": 0.97604,
      "epss_percentile": 0.99902,
      "exploited": true,
      "kev": {
        "added": "2025-05-02",
        "due": "2025-05-23",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Commvault"
      ],
      "products": [
        "Commvault Command Center Innovation Release"
      ],
      "cwes": [
        "CWE-22",
        "CWE-306"
      ],
      "description": "The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438."
    },
    {
      "id": "CVE-2024-58136",
      "url": "https://spydr.io/cve/CVE-2024-58136",
      "published": "2025-04-10T03:15:17.767Z",
      "modified": "2026-06-17T08:14:41.660Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.87757,
      "epss_percentile": 0.99759,
      "exploited": true,
      "kev": {
        "added": "2025-05-02",
        "due": "2025-05-23",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "yiiframework"
      ],
      "products": [
        "yiiframework Yii"
      ],
      "cwes": [
        "CWE-424"
      ],
      "description": "Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025."
    },
    {
      "id": "CVE-2024-38475",
      "url": "https://spydr.io/cve/CVE-2024-38475",
      "published": "2024-07-01T19:15:04.883Z",
      "modified": "2026-06-17T07:40:21.380Z",
      "score": 9.1,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "score_source": "NVD",
      "epss": 0.99957,
      "epss_percentile": 0.99975,
      "exploited": true,
      "kev": {
        "added": "2025-05-01",
        "due": "2025-05-22",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apache Software Foundation",
        "apache",
        "netapp"
      ],
      "products": [
        "Apache Software Foundation Apache HTTP Server",
        "apache http_server",
        "netapp ontap_9"
      ],
      "cwes": [
        "CWE-116"
      ],
      "description": "Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained."
    },
    {
      "id": "CVE-2023-44221",
      "url": "https://spydr.io/cve/CVE-2023-44221",
      "published": "2023-12-05T21:15:07.150Z",
      "modified": "2026-06-17T06:27:09.827Z",
      "score": 7.2,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.7625,
      "epss_percentile": 0.99525,
      "exploited": true,
      "kev": {
        "added": "2025-05-01",
        "due": "2025-05-22",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "SonicWall"
      ],
      "products": [
        "SonicWall SMA100"
      ],
      "cwes": [
        "CWE-78"
      ],
      "description": "Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability."
    },
    {
      "id": "CVE-2025-31324",
      "url": "https://spydr.io/cve/CVE-2025-31324",
      "published": "2025-04-24T17:15:35.913Z",
      "modified": "2026-08-04T05:16:34.557Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99486,
      "epss_percentile": 0.99944,
      "exploited": true,
      "kev": {
        "added": "2025-04-29",
        "due": "2025-05-20",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "SAP_SE"
      ],
      "products": [
        "SAP_SE SAP NetWeaver (Visual Composer development server)"
      ],
      "cwes": [
        "CWE-434"
      ],
      "description": "SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system."
    },
    {
      "id": "CVE-2025-3928",
      "url": "https://spydr.io/cve/CVE-2025-3928",
      "published": "2025-04-25T16:15:27.817Z",
      "modified": "2026-06-17T09:20:56.593Z",
      "score": 8.7,
      "severity": "high",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "CNA",
      "epss": 0.02299,
      "epss_percentile": 0.82734,
      "exploited": true,
      "kev": {
        "added": "2025-04-28",
        "due": "2025-05-19",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "none",
      "vendors": [
        "Commvault"
      ],
      "products": [
        "Commvault Web Server"
      ],
      "cwes": [],
      "description": "Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28."
    },
    {
      "id": "CVE-2025-1976",
      "url": "https://spydr.io/cve/CVE-2025-1976",
      "published": "2025-04-24T03:15:14.820Z",
      "modified": "2026-06-17T08:40:28.060Z",
      "score": 8.6,
      "severity": "high",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "brocade.com",
      "epss": 0.0069,
      "epss_percentile": 0.51215,
      "exploited": true,
      "kev": {
        "added": "2025-04-28",
        "due": "2025-05-19",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Brocade"
      ],
      "products": [
        "Brocade Fabric OS"
      ],
      "cwes": [
        "CWE-94",
        "CWE-78"
      ],
      "description": "Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6."
    },
    {
      "id": "CVE-2025-42599",
      "url": "https://spydr.io/cve/CVE-2025-42599",
      "published": "2025-04-18T04:15:30.557Z",
      "modified": "2026-09-24T13:10:00.320Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.03298,
      "epss_percentile": 0.88147,
      "exploited": true,
      "kev": {
        "added": "2025-04-28",
        "due": "2025-05-19",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "QUALITIA CO., LTD."
      ],
      "products": [
        "QUALITIA CO., LTD. Active! mail 6"
      ],
      "cwes": [
        "CWE-121"
      ],
      "description": "Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition."
    },
    {
      "id": "CVE-2025-31201",
      "url": "https://spydr.io/cve/CVE-2025-31201",
      "published": "2025-04-16T19:15:54.673Z",
      "modified": "2026-06-17T09:10:00.800Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "CISA ADP",
      "epss": 0.13973,
      "epss_percentile": 0.96454,
      "exploited": true,
      "kev": {
        "added": "2025-04-17",
        "due": "2025-05-08",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apple"
      ],
      "products": [
        "Apple iOS and iPadOS",
        "Apple macOS",
        "Apple tvOS",
        "Apple visionOS"
      ],
      "cwes": [
        "CWE-1220"
      ],
      "description": "This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS."
    },
    {
      "id": "CVE-2025-31200",
      "url": "https://spydr.io/cve/CVE-2025-31200",
      "published": "2025-04-16T19:15:54.540Z",
      "modified": "2026-06-17T09:10:00.550Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "CISA ADP",
      "epss": 0.18751,
      "epss_percentile": 0.97204,
      "exploited": true,
      "kev": {
        "added": "2025-04-17",
        "due": "2025-05-08",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apple"
      ],
      "products": [
        "Apple iOS and iPadOS",
        "Apple macOS",
        "Apple tvOS",
        "Apple visionOS",
        "Apple watchOS"
      ],
      "cwes": [
        "CWE-119"
      ],
      "description": "A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1."
    },
    {
      "id": "CVE-2025-24054",
      "url": "https://spydr.io/cve/CVE-2025-24054",
      "published": "2025-03-11T17:16:27.660Z",
      "modified": "2026-06-17T08:57:57.930Z",
      "score": 5.4,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "score_source": "NVD",
      "epss": 0.58909,
      "epss_percentile": 0.99089,
      "exploited": true,
      "kev": {
        "added": "2025-04-17",
        "due": "2025-05-08",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows 10 Version 1507",
        "Microsoft Windows 10 Version 1607",
        "Microsoft Windows 10 Version 1809",
        "Microsoft Windows 10 Version 21H2",
        "Microsoft Windows 10 Version 22H2",
        "Microsoft Windows 11 version 22H2",
        "Microsoft Windows 11 version 22H3",
        "Microsoft Windows 11 Version 23H2",
        "Microsoft Windows 11 Version 24H2",
        "Microsoft Windows Server 2008 R2 Service Pack 1",
        "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
        "Microsoft Windows Server 2012",
        "Microsoft Windows Server 2012 (Server Core installation)",
        "Microsoft Windows Server 2012 R2",
        "Microsoft Windows Server 2012 R2 (Server Core installation)",
        "Microsoft Windows Server 2016",
        "Microsoft Windows Server 2016 (Server Core installation)",
        "Microsoft Windows Server 2019",
        "Microsoft Windows Server 2019 (Server Core installation)",
        "Microsoft Windows Server 2022"
      ],
      "cwes": [
        "CWE-73"
      ],
      "description": "External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network."
    },
    {
      "id": "CVE-2021-20035",
      "url": "https://spydr.io/cve/CVE-2021-20035",
      "published": "2021-09-27T18:15:08.383Z",
      "modified": "2026-06-17T03:33:11.067Z",
      "score": 6.5,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "score_source": "NVD",
      "epss": 0.04181,
      "epss_percentile": 0.90638,
      "exploited": true,
      "kev": {
        "added": "2025-04-16",
        "due": "2025-05-07",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "SonicWall"
      ],
      "products": [
        "SonicWall SMA100"
      ],
      "cwes": [
        "CWE-78"
      ],
      "description": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS."
    },
    {
      "id": "CVE-2024-53197",
      "url": "https://spydr.io/cve/CVE-2024-53197",
      "published": "2024-12-27T14:15:27.383Z",
      "modified": "2026-06-17T08:08:33.967Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "CISA ADP",
      "epss": 0.04117,
      "epss_percentile": 0.90498,
      "exploited": true,
      "kev": {
        "added": "2025-04-09",
        "due": "2025-04-30",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Linux"
      ],
      "products": [
        "Linux"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration."
    },
    {
      "id": "CVE-2024-53150",
      "url": "https://spydr.io/cve/CVE-2024-53150",
      "published": "2024-12-24T12:15:23.117Z",
      "modified": "2026-06-17T08:08:25.567Z",
      "score": 7.1,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "score_source": "NVD",
      "epss": 0.01354,
      "epss_percentile": 0.70682,
      "exploited": true,
      "kev": {
        "added": "2025-04-09",
        "due": "2025-04-30",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Linux"
      ],
      "products": [
        "Linux"
      ],
      "cwes": [
        "CWE-125"
      ],
      "description": "In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check."
    },
    {
      "id": "CVE-2025-29824",
      "url": "https://spydr.io/cve/CVE-2025-29824",
      "published": "2025-04-08T18:16:08.340Z",
      "modified": "2026-06-17T09:05:43.957Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.13904,
      "epss_percentile": 0.96441,
      "exploited": true,
      "kev": {
        "added": "2025-04-08",
        "due": "2025-04-29",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows 10 Version 1507",
        "Microsoft Windows 10 Version 1607",
        "Microsoft Windows 10 Version 1809",
        "Microsoft Windows 10 Version 21H2",
        "Microsoft Windows 10 Version 22H2",
        "Microsoft Windows 11 version 22H2",
        "Microsoft Windows 11 version 22H3",
        "Microsoft Windows 11 Version 23H2",
        "Microsoft Windows 11 Version 24H2",
        "Microsoft Windows Server 2008 R2 Service Pack 1",
        "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
        "Microsoft Windows Server 2008 Service Pack 2",
        "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)",
        "Microsoft Windows Server 2012",
        "Microsoft Windows Server 2012 (Server Core installation)",
        "Microsoft Windows Server 2012 R2",
        "Microsoft Windows Server 2012 R2 (Server Core installation)",
        "Microsoft Windows Server 2016",
        "Microsoft Windows Server 2016 (Server Core installation)",
        "Microsoft Windows Server 2019"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally."
    },
    {
      "id": "CVE-2025-30406",
      "url": "https://spydr.io/cve/CVE-2025-30406",
      "published": "2025-04-03T20:15:24.987Z",
      "modified": "2026-06-17T09:08:40.100Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.94343,
      "epss_percentile": 0.9985,
      "exploited": true,
      "kev": {
        "added": "2025-04-08",
        "due": "2025-04-29",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Gladinet"
      ],
      "products": [
        "Gladinet CentreStack"
      ],
      "cwes": [
        "CWE-321",
        "CWE-798"
      ],
      "description": "Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config."
    },
    {
      "id": "CVE-2025-31161",
      "url": "https://spydr.io/cve/CVE-2025-31161",
      "published": "2025-04-03T20:15:25.373Z",
      "modified": "2026-06-17T09:09:56.440Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99966,
      "epss_percentile": 0.99977,
      "exploited": true,
      "kev": {
        "added": "2025-04-07",
        "due": "2025-04-28",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "CrushFTP"
      ],
      "products": [
        "CrushFTP"
      ],
      "cwes": [
        "CWE-305"
      ],
      "description": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account."
    }
  ],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}