{ "query": { "kev": "1", "page": "22" }, "count": 20, "total": 1734, "page": 22, "limit": 20, "updated": { "cves": "2026-10-07T00:46:23.556Z", "kev": "2026-10-07T01:46:10.380Z", "epss": "2026-10-07T00:58:23.423Z", "breaches": "2026-10-07T00:46:23.055Z", "posts": "2026-10-07T01:47:10.349Z" }, "links": { "web": "https://spydr.io/threats?kev=1&page=22", "next": "https://spydr.io/threats.json?kev=1&page=23" }, "warnings": [], "results": [ { "id": "CVE-2025-22457", "url": "https://spydr.io/cve/CVE-2025-22457", "published": "2025-04-03T16:15:35.370Z", "modified": "2026-08-04T05:16:33.707Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99981, "epss_percentile": 0.99981, "exploited": true, "kev": { "added": "2025-04-04", "due": "2025-04-11", "action": "Apply mitigations as set forth in the CISA instructions linked below.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Ivanti" ], "products": [ "Ivanti Connect Secure", "Ivanti Policy Secure", "Ivanti Neurons for ZTA gateways" ], "cwes": [ "CWE-121", "CWE-787" ], "description": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution." }, { "id": "CVE-2025-24813", "url": "https://spydr.io/cve/CVE-2025-24813", "published": "2025-03-10T17:15:35.067Z", "modified": "2026-06-17T08:59:39.593Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99927, "epss_percentile": 0.99969, "exploited": true, "kev": { "added": "2025-04-01", "due": "2025-04-22", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Apache Software Foundation" ], "products": [ "Apache Software Foundation Apache Tomcat" ], "cwes": [ "CWE-44", "CWE-502", "CWE-706" ], "description": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue." }, { "id": "CVE-2024-20439", "url": "https://spydr.io/cve/CVE-2024-20439", "published": "2024-09-04T17:15:13.210Z", "modified": "2026-06-17T07:07:06.230Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.9709, "epss_percentile": 0.99893, "exploited": true, "kev": { "added": "2025-03-31", "due": "2025-04-21", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Cisco" ], "products": [ "Cisco Smart License Utility" ], "cwes": [ "CWE-912", "CWE-798" ], "description": "A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API." }, { "id": "CVE-2025-2783", "url": "https://spydr.io/cve/CVE-2025-2783", "published": "2025-03-26T16:15:23.693Z", "modified": "2026-06-17T09:07:37.023Z", "score": 8.3, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "score_source": "CISA ADP", "epss": 0.09238, "epss_percentile": 0.95225, "exploited": true, "kev": { "added": "2025-03-27", "due": "2025-04-17", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [], "description": "Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)" }, { "id": "CVE-2019-9875", "url": "https://spydr.io/cve/CVE-2019-9875", "published": "2019-05-31T21:29:06.187Z", "modified": "2026-06-17T02:44:46.273Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.13795, "epss_percentile": 0.96421, "exploited": true, "kev": { "added": "2025-03-26", "due": "2025-04-16", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "sitecore" ], "products": [ "sitecore cms" ], "cwes": [ "CWE-502" ], "description": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter." }, { "id": "CVE-2019-9874", "url": "https://spydr.io/cve/CVE-2019-9874", "published": "2019-05-31T21:29:06.123Z", "modified": "2026-06-17T02:44:46.077Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.83736, "epss_percentile": 0.99684, "exploited": true, "kev": { "added": "2025-03-26", "due": "2025-04-16", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "sitecore" ], "products": [ "sitecore cms", "sitecore experience platform" ], "cwes": [ "CWE-502" ], "description": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN." }, { "id": "CVE-2025-30154", "url": "https://spydr.io/cve/CVE-2025-30154", "published": "2025-03-19T16:15:33.780Z", "modified": "2026-06-17T09:08:15.700Z", "score": 8.6, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.02437, "epss_percentile": 0.83754, "exploited": true, "kev": { "added": "2025-03-24", "due": "2025-04-14", "action": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "reviewdog" ], "products": [ "reviewdog" ], "cwes": [ "CWE-506" ], "description": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos." }, { "id": "CVE-2025-1316", "url": "https://spydr.io/cve/CVE-2025-1316", "published": "2025-03-05T00:15:35.057Z", "modified": "2026-06-17T08:38:54.570Z", "score": 9.3, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "hq.dhs.gov", "epss": 0.74482, "epss_percentile": 0.99484, "exploited": true, "kev": { "added": "2025-03-19", "due": "2025-04-09", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Edimax" ], "products": [ "Edimax IC-7100 IP Camera" ], "cwes": [ "CWE-78" ], "description": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device" }, { "id": "CVE-2024-48248", "url": "https://spydr.io/cve/CVE-2024-48248", "published": "2025-03-04T08:15:33.550Z", "modified": "2026-09-24T13:10:00.320Z", "score": 8.6, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.94356, "epss_percentile": 0.99851, "exploited": true, "kev": { "added": "2025-03-19", "due": "2025-04-09", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "NAKIVO" ], "products": [ "NAKIVO Backup & Replication Director" ], "cwes": [ "CWE-36" ], "description": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials)." }, { "id": "CVE-2017-12637", "url": "https://spydr.io/cve/CVE-2017-12637", "published": "2017-08-07T20:29:01.120Z", "modified": "2026-06-17T01:03:42.877Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.95111, "epss_percentile": 0.99864, "exploited": true, "kev": { "added": "2025-03-19", "due": "2025-04-09", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "sap" ], "products": [ "sap netweaver application server java" ], "cwes": [ "CWE-22" ], "description": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657." }, { "id": "CVE-2025-30066", "url": "https://spydr.io/cve/CVE-2025-30066", "published": "2025-03-15T06:15:12.193Z", "modified": "2026-09-24T13:10:00.320Z", "score": 8.6, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.72092, "epss_percentile": 0.99419, "exploited": true, "kev": { "added": "2025-03-18", "due": "2025-04-08", "action": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "tj-actions" ], "products": [ "tj-actions changed-files" ], "cwes": [ "CWE-506" ], "description": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)" }, { "id": "CVE-2025-24472", "url": "https://spydr.io/cve/CVE-2025-24472", "published": "2025-02-11T17:15:34.867Z", "modified": "2026-08-05T05:16:43.473Z", "score": 8.1, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "fortinet.com", "epss": 0.07235, "epss_percentile": 0.94164, "exploited": true, "kev": { "added": "2025-03-18", "due": "2025-04-08", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Fortinet" ], "products": [ "Fortinet FortiOS", "Fortinet FortiProxy" ], "cwes": [ "CWE-288" ], "description": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests." }, { "id": "CVE-2025-21590", "url": "https://spydr.io/cve/CVE-2025-21590", "published": "2025-03-12T14:15:15.447Z", "modified": "2026-10-01T18:23:34.867Z", "score": 6.7, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "juniper.net", "epss": 0.01749, "epss_percentile": 0.771, "exploited": true, "kev": { "added": "2025-03-13", "due": "2025-04-03", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Juniper Networks" ], "products": [ "Juniper Networks Junos OS" ], "cwes": [ "CWE-653" ], "description": "An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2." }, { "id": "CVE-2025-24201", "url": "https://spydr.io/cve/CVE-2025-24201", "published": "2025-03-11T18:15:30.190Z", "modified": "2026-06-17T08:58:17.950Z", "score": 10, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.03847, "epss_percentile": 0.89841, "exploited": true, "kev": { "added": "2025-03-13", "due": "2025-04-03", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Apple" ], "products": [ "Apple Safari", "Apple iOS and iPadOS", "Apple iPadOS", "Apple macOS", "Apple visionOS", "Apple watchOS" ], "cwes": [ "CWE-787" ], "description": "An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.)." }, { "id": "CVE-2025-26633", "url": "https://spydr.io/cve/CVE-2025-26633", "published": "2025-03-11T17:16:43.390Z", "modified": "2026-09-24T13:10:00.320Z", "score": 7, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.30391, "epss_percentile": 0.9819, "exploited": true, "kev": { "added": "2025-03-11", "due": "2025-04-01", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 22H2", "Microsoft Windows 11 version 22H2", "Microsoft Windows 11 version 22H3", "Microsoft Windows 11 Version 23H2", "Microsoft Windows 11 Version 24H2", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019" ], "cwes": [ "CWE-707" ], "description": "Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally." }, { "id": "CVE-2025-24993", "url": "https://spydr.io/cve/CVE-2025-24993", "published": "2025-03-11T17:16:35.797Z", "modified": "2026-09-24T13:10:00.320Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.02216, "epss_percentile": 0.8207, "exploited": true, "kev": { "added": "2025-03-11", "due": "2025-04-01", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 22H2", "Microsoft Windows 11 version 22H2", "Microsoft Windows 11 version 22H3", "Microsoft Windows 11 Version 23H2", "Microsoft Windows 11 Version 24H2", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019" ], "cwes": [ "CWE-122" ], "description": "Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally." }, { "id": "CVE-2025-24991", "url": "https://spydr.io/cve/CVE-2025-24991", "published": "2025-03-11T17:16:35.297Z", "modified": "2026-06-17T08:59:56.790Z", "score": 5.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "score_source": "microsoft.com", "epss": 0.02018, "epss_percentile": 0.80285, "exploited": true, "kev": { "added": "2025-03-11", "due": "2025-04-01", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 22H2", "Microsoft Windows 11 version 22H2", "Microsoft Windows 11 version 22H3", "Microsoft Windows 11 Version 23H2", "Microsoft Windows 11 Version 24H2", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019" ], "cwes": [ "CWE-125" ], "description": "Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally." }, { "id": "CVE-2025-24985", "url": "https://spydr.io/cve/CVE-2025-24985", "published": "2025-03-11T17:16:34.303Z", "modified": "2026-06-17T08:59:55.760Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.03922, "epss_percentile": 0.90045, "exploited": true, "kev": { "added": "2025-03-11", "due": "2025-04-01", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 22H2", "Microsoft Windows 11 version 22H2", "Microsoft Windows 11 version 22H3", "Microsoft Windows 11 Version 23H2", "Microsoft Windows 11 Version 24H2", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019" ], "cwes": [ "CWE-122", "CWE-190" ], "description": "Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally." }, { "id": "CVE-2025-24984", "url": "https://spydr.io/cve/CVE-2025-24984", "published": "2025-03-11T17:16:34.090Z", "modified": "2026-06-17T08:59:55.583Z", "score": 4.6, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "microsoft.com", "epss": 0.01994, "epss_percentile": 0.80014, "exploited": true, "kev": { "added": "2025-03-11", "due": "2025-04-01", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 22H2", "Microsoft Windows 11 version 22H2", "Microsoft Windows 11 version 22H3", "Microsoft Windows 11 Version 23H2", "Microsoft Windows 11 Version 24H2", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server 2022", "Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)", "Microsoft Windows Server 2025" ], "cwes": [ "CWE-532" ], "description": "Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack." }, { "id": "CVE-2025-24983", "url": "https://spydr.io/cve/CVE-2025-24983", "published": "2025-03-11T17:16:33.890Z", "modified": "2026-06-17T08:59:55.440Z", "score": 7, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.01375, "epss_percentile": 0.71125, "exploited": true, "kev": { "added": "2025-03-11", "due": "2025-04-01", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)" ], "cwes": [ "CWE-416" ], "description": "Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }