Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being exploited, newest additions first — with the remediation deadline federal agencies must meet.
| Score | CVE | Affected | EPSS | Added to KEV |
|---|---|---|---|---|
| 9.0 critical | CVE-2025-48703 KEV | centos-webpanel CentOS Web Panel CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. | >99% | 4 Nov 2025 |
| 7.8 high | CVE-2025-41244 KEV | VMware VCF operations VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. | 8.4% | 30 Oct 2025 |
| 9.8 critical | CVE-2025-24893 KEV | xwiki-platform XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed. | >99% | 30 Oct 2025 |
| 9.1 critical | CVE-2025-6205 KEV | Dassault Systèmes DELMIA Apriso A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application. | 74% | 28 Oct 2025 |
| 8.0 high | CVE-2025-6204 KEV | Dassault Systèmes DELMIA Apriso An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code. | 79% | 28 Oct 2025 |
| 9.8 critical | CVE-2025-59287 KEV | Microsoft Windows Server 2012 Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. | >99% | 24 Oct 2025 |
| 9.1 critical | CVE-2025-54236 KEV | Adobe Commerce Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction. | 95% | 24 Oct 2025 |
| 9.3 critical | CVE-2025-61932 KEV | MOTEX Inc. Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. | 2.8% | 22 Oct 2025 |
| 7.5 high | CVE-2025-61884 KEV | Oracle Corporation Oracle Configurator Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | 96% | 20 Oct 2025 |
| 8.8 high | CVE-2025-33073 KEV | Microsoft Windows 10 Version 1507 Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. | 83% | 20 Oct 2025 |
| 9.8 critical | CVE-2025-2747 KEV | Kentico Xperience An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178. | 97% | 20 Oct 2025 |
| 9.8 critical | CVE-2025-2746 KEV | Kentico Xperience An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172. | 73% | 20 Oct 2025 |
| 8.8 high | CVE-2022-48503 KEV | Apple macOS The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution. | 3.2% | 20 Oct 2025 |
| 10.0 critical | CVE-2025-54253 KEV | Adobe Experience Manager Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed. | 88% | 15 Oct 2025 |
| 7.8 high | CVE-2025-59230 KEV | Microsoft Windows 10 Version 1507 Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | 2.7% | 14 Oct 2025 |
| 7.8 high | CVE-2025-24990 KEV | Microsoft Windows 10 Version 1507 Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware. | 6.4% | 14 Oct 2025 |
| 4.6 medium | CVE-2025-47827 KEV | igel os In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. | 4.9% | 14 Oct 2025 |
| 9.8 critical | CVE-2016-7836 KEV | Sky Co., LTD. SKYSEA Client View SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. | 19% | 14 Oct 2025 |
| 7.5 high | CVE-2021-43798 KEV | grafana Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline. | 89% | 9 Oct 2025 |
| 5.4 medium | CVE-2025-27915 KEV | synacor zimbra collaboration suite An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. | 4.1% | 7 Oct 2025 |