CISA KEV · exploited vulnerabilities

InformationCISA KEV · updated 2h ago

Known Exploited Vulnerabilities from CISA, cross-referenced against ingested MENA cases. “MENA-relevant” means a CVE surfaced in a tracked case — not the full undifferentiated catalog. Each carries a remediation priority (P1–P3) so it's clear which to patch first, and why. For direct SIEM/SOAR ingestion, the same data is available as a machine-readable JSON feed →.

Sort

MENA-RELEVANT FULL CATALOG

50 of ~1,722

Comfortable Compact

CVECVE-2021-21311

Adminer Server-Side Request Forgery Vulnerability

Adminer · Adminerremediation: past CISA due date

P2added 2025-09-29due 2025-10-20

⋮

CVECVE-2025-10035

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Fortra · GoAnywhere MFTremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2025-09-29due 2025-10-20

⋮

CVECVE-2025-20352

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Cisco · IOS and IOS XEremediation: past CISA due date

P2added 2025-09-29due 2025-10-20

⋮

CVECVE-2025-32463

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo · Sudoremediation: past CISA due date

P2added 2025-09-29due 2025-10-20

⋮

CVECVE-2025-59689

Libraesva Email Security Gateway Command Injection Vulnerability

Libraesva · Email Security Gatewayremediation: past CISA due date

P2added 2025-09-29due 2025-10-20

⋮

CVECVE-2025-20333

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defenseremediation: past CISA due date

P2added 2025-09-25due 2025-09-26

⋮

CVECVE-2025-20362

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defenseremediation: past CISA due date

P2added 2025-09-25due 2025-09-26

⋮

CVECVE-2025-10585

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8remediation: past CISA due date

P2added 2025-09-23due 2025-10-14

⋮

CVECVE-2025-5086

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Dassault Systèmes · DELMIA Aprisoremediation: past CISA due date

P2added 2025-09-11due 2025-10-02

⋮

CVECVE-2025-38352

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Linux · Kernelremediation: past CISA due date

P2added 2025-09-04due 2025-09-25

⋮

CVECVE-2025-48543

Android Runtime Use-After-Free Vulnerability

Android · Runtimeremediation: past CISA due date

P2added 2025-09-04due 2025-09-25

⋮

CVECVE-2025-53690

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Sitecore · Multiple Productsremediation: past CISA due date

P2added 2025-09-04due 2025-09-25

⋮

CVECVE-2023-50224

TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

TP-Link · TL-WR841Nremediation: past CISA due date

P2added 2025-09-03due 2025-09-24

⋮

CVECVE-2025-9377

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

TP-Link · Multiple Routersremediation: past CISA due date

P2added 2025-09-03due 2025-09-24

⋮

CVECVE-2020-24363

TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

TP-Link · TL-WA855REremediation: past CISA due date

P2added 2025-09-02due 2025-09-23

⋮

CVECVE-2025-55177

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Meta Platforms · WhatsAppremediation: past CISA due date

P2added 2025-09-02due 2025-09-23

⋮

CVECVE-2025-57819

Sangoma FreePBX Authentication Bypass Vulnerability

Sangoma · FreePBXremediation: past CISA due date

P2added 2025-08-29due 2025-09-19

⋮

CVECVE-2025-7775

Citrix NetScaler Memory Overflow Vulnerability

Citrix · NetScalerremediation: past CISA due date

P2added 2025-08-26due 2025-08-28

⋮

CVECVE-2024-8068

Citrix Session Recording Improper Privilege Management Vulnerability

Citrix · Session Recordingremediation: past CISA due date

P2added 2025-08-25due 2025-09-15

⋮

CVECVE-2024-8069

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Citrix · Session Recordingremediation: past CISA due date

P2added 2025-08-25due 2025-09-15

⋮

CVECVE-2025-48384

Git Link Following Vulnerability

Git · Gitremediation: past CISA due date

P2added 2025-08-25due 2025-09-15

⋮

CVECVE-2025-43300

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple · iOS, iPadOS, and macOSremediation: past CISA due date

P2added 2025-08-21due 2025-09-11

⋮

CVECVE-2025-54948

Trend Micro Apex One OS Command Injection Vulnerability

Trend Micro · Apex Oneremediation: past CISA due date

P2added 2025-08-18due 2025-09-08

⋮

CVECVE-2025-8875

N-able N-Central Insecure Deserialization Vulnerability

N-able · N-Centralremediation: past CISA due date

P2added 2025-08-13due 2025-08-20

⋮

CVECVE-2025-8876

N-able N-Central Command Injection Vulnerability

N-able · N-Centralremediation: past CISA due date

P2added 2025-08-13due 2025-08-20

⋮

CVECVE-2007-0671

Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft · Officeremediation: past CISA due date

P2added 2025-08-12due 2025-09-02

⋮

CVECVE-2013-3893

Microsoft Internet Explorer Resource Management Errors Vulnerability

Microsoft · Internet Explorerremediation: past CISA due date

P2added 2025-08-12due 2025-09-02

⋮

CVECVE-2025-8088

RARLAB WinRAR Path Traversal Vulnerability

RARLAB · WinRARremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2025-08-12due 2025-09-02

⋮

CVECVE-2020-25078

D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

D-Link · DCS-2530L and DCS-2670L Devicesremediation: past CISA due date

P2added 2025-08-05due 2025-08-26

⋮

CVECVE-2020-25079

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

D-Link · DCS-2530L and DCS-2670L Devicesremediation: past CISA due date

P2added 2025-08-05due 2025-08-26

⋮

CVECVE-2022-40799

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

D-Link · DNR-322Lremediation: past CISA due date

P2added 2025-08-05due 2025-08-26

⋮

CVECVE-2023-2533

PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

PaperCut · NG/MFremediation: past CISA due date

ATT&CKT1566.002exploitation T1547primary impact T1059primary impact

P2added 2025-07-28due 2025-08-18

⋮

CVECVE-2025-20281

Cisco Identity Services Engine Injection Vulnerability

Cisco · Identity Services Engineremediation: past CISA due date

ATT&CKT1106exploitation T1059primary impact

P2added 2025-07-28due 2025-08-18

⋮

CVECVE-2025-20337

Cisco Identity Services Engine Injection Vulnerability

Cisco · Identity Services Engineremediation: past CISA due date

ATT&CKT1106exploitation T1059primary impact

P2added 2025-07-28due 2025-08-18

⋮

CVECVE-2025-2775

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid · SysAid On-Premremediation: past CISA due date

P2added 2025-07-22due 2025-08-12

⋮

CVECVE-2025-2776

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid · SysAid On-Premremediation: past CISA due date

P2added 2025-07-22due 2025-08-12

⋮

CVECVE-2025-49704

Microsoft SharePoint Code Injection Vulnerability

Microsoft · SharePointremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1059.003primary impact

P1added 2025-07-22due 2025-07-23

⋮

CVECVE-2025-49706

Microsoft SharePoint Improper Authentication Vulnerability

Microsoft · SharePointremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1505primary impact T1059.003secondary impact

P1added 2025-07-22due 2025-07-23

⋮

CVECVE-2025-54309

CrushFTP Unprotected Alternate Channel Vulnerability

CrushFTP · CrushFTPremediation: past CISA due date

ATT&CKT1068exploitation T1567primary impact T1021secondary impact

P2added 2025-07-22due 2025-08-12

⋮

CVECVE-2025-6558

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Google · Chromiumremediation: past CISA due date

ATT&CKT1189exploitation T1497primary impact T1203exploitation

P2added 2025-07-22due 2025-08-12

⋮

CVECVE-2025-53770

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePointremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1059exploitation

P1added 2025-07-20due 2025-07-21

⋮

CVECVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

Fortinet · FortiWebremediation: past CISA due date

ATT&CKT1055exploitation T1190exploitation T1068exploitation T1059.004primary impact T1485secondary impact

P2added 2025-07-18due 2025-08-08

⋮

CVECVE-2025-47812

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Wing FTP Server · Wing FTP Serverremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-07-14due 2025-08-04

⋮

CVECVE-2025-5777

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Citrix · NetScaler ADC and Gatewayremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1555primary impact

P1added 2025-07-10due 2025-07-11

⋮

CVECVE-2014-3931

Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

Looking Glass · Multi-Router Looking Glass (MRLG)remediation: past CISA due date

P2added 2025-07-07due 2025-07-28

⋮

CVECVE-2016-10033

PHPMailer Command Injection Vulnerability

PHP · PHPMailerremediation: past CISA due date

ATT&CKT1190exploitation T1059.004primary impact

P2added 2025-07-07due 2025-07-28

⋮

CVECVE-2019-5418

Rails Ruby on Rails Path Traversal Vulnerability

Rails · Ruby on Railsremediation: past CISA due date

P2added 2025-07-07due 2025-07-28

⋮

CVECVE-2019-9621

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS)remediation: past CISA due date

P2added 2025-07-07due 2025-07-28

⋮

CVECVE-2025-6554

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8remediation: past CISA due date

ATT&CKT1203exploitation T1189exploitation T1059primary impact

P2added 2025-07-02due 2025-07-23

⋮

CVECVE-2025-48927

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

TeleMessage · TM SGNLremediation: past CISA due date

ATT&CKT1212exploitation T1005primary impact T1555primary impact

P2added 2025-07-01due 2025-07-22

⋮

301–350 of ~1,722

← Prev Next →