CISA KEV · exploited vulnerabilities

InformationCISA KEV · updated 3h ago

Known Exploited Vulnerabilities from CISA, cross-referenced against ingested MENA cases. “MENA-relevant” means a CVE surfaced in a tracked case — not the full undifferentiated catalog. Each carries a remediation priority (P1–P3) so it's clear which to patch first, and why. For direct SIEM/SOAR ingestion, the same data is available as a machine-readable JSON feed →.

Sort

MENA-RELEVANT FULL CATALOG

50 of ~1,722

Comfortable Compact

CVECVE-2025-31200

Apple Multiple Products Memory Corruption Vulnerability

Apple · Multiple Productsremediation: past CISA due date

ATT&CKT1203exploitation T1105primary impact T1562secondary impact T1106secondary impact T1059secondary impact T1001secondary impact T1557secondary impact

P2added 2025-04-17due 2025-05-08

⋮

CVECVE-2025-31201

Apple Multiple Products Arbitrary Read and Write Vulnerability

Apple · Multiple Productsremediation: past CISA due date

ATT&CKT1203exploitation T1105primary impact T1562secondary impact T1106secondary impact T1059secondary impact T1001secondary impact T1557secondary impact

P2added 2025-04-17due 2025-05-08

⋮

CVECVE-2021-20035

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall · SMA100 Appliancesremediation: past CISA due date

ATT&CKT1078exploitation T1059exploitation

P2added 2025-04-16due 2025-05-07

⋮

CVECVE-2024-53150

Linux Kernel Out-of-Bounds Read Vulnerability

Linux · Kernelremediation: past CISA due date

ATT&CKT1091exploitation T1005primary impact T1011secondary impact

P2added 2025-04-09due 2025-04-30

⋮

CVECVE-2024-53197

Linux Kernel Out-of-Bounds Access Vulnerability

Linux · Kernelremediation: past CISA due date

ATT&CKT1091exploitation T1068exploitation T1059primary impact

P2added 2025-04-09due 2025-04-30

⋮

CVECVE-2025-29824

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Microsoft · Windowsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2025-04-08due 2025-04-29

⋮

CVECVE-2025-30406

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Gladinet · CentreStackremediation: past CISA due date

ATT&CKT1203exploitation T1059primary impact

P2added 2025-04-08due 2025-04-29

⋮

CVECVE-2025-31161

CrushFTP Authentication Bypass Vulnerability

CrushFTP · CrushFTPremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1078exploitation T1059primary impact T1136primary impact

P1added 2025-04-07due 2025-04-28

⋮

CVECVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gatewaysremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1059primary impact

P1added 2025-04-04due 2025-04-11

⋮

CVECVE-2025-24813

Apache Tomcat Path Equivalence Vulnerability

Apache · Tomcatremediation: past CISA due date

P2added 2025-04-01due 2025-04-22

⋮

CVECVE-2024-20439

Cisco Smart Licensing Utility Static Credential Vulnerability

Cisco · Smart Licensing Utilityremediation: past CISA due date

ATT&CKT1552exploitation T1106primary impact

P2added 2025-03-31due 2025-04-21

⋮

CVECVE-2025-2783

Google Chromium Mojo Sandbox Escape Vulnerability

Google · Chromium Mojoremediation: past CISA due date

ATT&CKT1497secondary impact T1203exploitation T1548primary impact

P2added 2025-03-27due 2025-04-17

⋮

CVECVE-2019-9874

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore · CMS and Experience Platform (XP)remediation: past CISA due date

P2added 2025-03-26due 2025-04-16

⋮

CVECVE-2019-9875

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore · CMS and Experience Platform (XP)remediation: past CISA due date

P2added 2025-03-26due 2025-04-16

⋮

CVECVE-2025-30154

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

reviewdog · action-setup GitHub Actionremediation: past CISA due date

P2added 2025-03-24due 2025-04-14

⋮

CVECVE-2017-12637

SAP NetWeaver Directory Traversal Vulnerability

SAP · NetWeaverremediation: past CISA due date

ATT&CKT1190exploitation T1083primary impact T1592secondary impact T1555secondary impact

P2added 2025-03-19due 2025-04-09

⋮

CVECVE-2024-48248

NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

NAKIVO · Backup and Replicationremediation: past CISA due date

ATT&CKT1190exploitation T1005primary impact T1003secondary impact

P2added 2025-03-19due 2025-04-09

⋮

CVECVE-2025-1316

Edimax IC-7100 IP Camera OS Command Injection Vulnerability

Edimax · IC-7100 IP Cameraremediation: past CISA due date

ATT&CKT1190exploitation T1055primary impact

P2added 2025-03-19due 2025-04-09

⋮

CVECVE-2025-24472

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet · FortiOS and FortiProxyremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2025-03-18due 2025-04-08

⋮

CVECVE-2025-30066

tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

tj-actions · changed-files GitHub Actionremediation: past CISA due date

P2added 2025-03-18due 2025-04-08

⋮

CVECVE-2025-21590

Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Juniper · Junos OSremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-03-13due 2025-04-03

⋮

CVECVE-2025-24201

Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Apple · Multiple Productsremediation: past CISA due date

ATT&CKT1059primary impact T1189exploitation

P2added 2025-03-13due 2025-04-03

⋮

CVECVE-2025-24983

Microsoft Windows Win32k Use-After-Free Vulnerability

Microsoft · Windowsremediation: past CISA due date

P2added 2025-03-11due 2025-04-01

⋮

CVECVE-2025-24984

Microsoft Windows NTFS Information Disclosure Vulnerability

Microsoft · Windowsremediation: past CISA due date

P2added 2025-03-11due 2025-04-01

⋮

CVECVE-2025-24985

Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1091exploitation T1059primary impact

P2added 2025-03-11due 2025-04-01

⋮

CVECVE-2025-24991

Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1091exploitation T1005primary impact

P2added 2025-03-11due 2025-04-01

⋮

CVECVE-2025-24993

Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1068exploitation T1204exploitation T1203exploitation T1055primary impact T1565secondary impact

P2added 2025-03-11due 2025-04-01

⋮

CVECVE-2025-26633

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Microsoft · Windowsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2025-03-11due 2025-04-01

⋮

CVECVE-2024-13159

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM)remediation: past CISA due date

ATT&CKT1190exploitation T1558exploitation T1550.002primary impact T1087secondary impact

P2added 2025-03-10due 2025-03-31

⋮

CVECVE-2024-13160

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM)remediation: past CISA due date

ATT&CKT1190exploitation T1558exploitation T1550.002primary impact T1087secondary impact

P2added 2025-03-10due 2025-03-31

⋮

CVECVE-2024-13161

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM)remediation: past CISA due date

ATT&CKT1190exploitation T1558exploitation T1550.002primary impact T1087secondary impact

P2added 2025-03-10due 2025-03-31

⋮

CVECVE-2024-57968

Advantive VeraCore Unrestricted File Upload Vulnerability

Advantive · VeraCoreremediation: past CISA due date

ATT&CKT1078exploitation T1059primary impact

P2added 2025-03-10due 2025-03-31

⋮

CVECVE-2025-25181

Advantive VeraCore SQL Injection Vulnerability

Advantive · VeraCoreremediation: past CISA due date

ATT&CKT1055exploitation T1068exploitation T1485primary impact

P2added 2025-03-10due 2025-03-31

⋮

CVECVE-2024-50302

Linux Kernel Use of Uninitialized Resource Vulnerability

Linux · Kernelremediation: past CISA due date

ATT&CKT1091exploitation T1005primary impact T1011secondary impact

P2added 2025-03-04due 2025-03-25

⋮

CVECVE-2025-22224

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

VMware · ESXi and Workstationremediation: past CISA due date

ATT&CKT1055exploitation T1611primary impact

P2added 2025-03-04due 2025-03-25

⋮

CVECVE-2025-22225

VMware ESXi Arbitrary Write Vulnerability

VMware · ESXiremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1068exploitation T1611primary impact

P1added 2025-03-04due 2025-03-25

⋮

CVECVE-2025-22226

VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

VMware · ESXi, Workstation, and Fusionremediation: past CISA due date

ATT&CKT1611secondary impact T1005primary impact

P2added 2025-03-04due 2025-03-25

⋮

CVECVE-2018-8639

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Microsoft · Windowsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2025-03-03due 2025-03-24

⋮

CVECVE-2022-43769

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara · Pentaho Business Analytics (BA) Serverremediation: past CISA due date

ATT&CKT1203exploitation T1059primary impact

P2added 2025-03-03due 2025-03-24

⋮

CVECVE-2022-43939

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara · Pentaho Business Analytics (BA) Serverremediation: past CISA due date

ATT&CKT1190exploitation T1059primary impact

P2added 2025-03-03due 2025-03-24

⋮

CVECVE-2023-20118

Cisco Small Business RV Series Routers Command Injection Vulnerability

Cisco · Small Business RV Series Routersremediation: past CISA due date

ATT&CKT1068exploitation T1078exploitation T1059primary impact T1505.003secondary impact

P2added 2025-03-03due 2025-03-24

⋮

CVECVE-2024-4885

Progress WhatsUp Gold Path Traversal Vulnerability

Progress · WhatsUp Goldremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-03-03due 2025-03-24

⋮

CVECVE-2023-34192

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS)remediation: past CISA due date

ATT&CKT1055exploitation T1059primary impact T1185secondary impact

P2added 2025-02-25due 2025-03-18

⋮

CVECVE-2024-49035

Microsoft Partner Center Improper Access Control Vulnerability

Microsoft · Partner Centerremediation: past CISA due date

ATT&CKT1068exploitation T1530primary impact T1195primary impact

P2added 2025-02-25due 2025-03-18

⋮

CVECVE-2017-3066

Adobe ColdFusion Deserialization Vulnerability

Adobe · ColdFusionremediation: past CISA due date

P2added 2025-02-24due 2025-03-17

⋮

CVECVE-2024-20953

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Oracle · Agile Product Lifecycle Management (PLM)remediation: past CISA due date

ATT&CKT1190exploitation T1059primary impact

P2added 2025-02-24due 2025-03-17

⋮

CVECVE-2025-24989

Microsoft Power Pages Improper Access Control Vulnerability

Microsoft · Power Pagesremediation: past CISA due date

P2added 2025-02-21due 2025-03-14

⋮

CVECVE-2025-0111

Palo Alto Networks PAN-OS File Read Vulnerability

Palo Alto Networks · PAN-OSremediation: past CISA due date

ATT&CKT1068exploitation T1005primary impact

P2added 2025-02-20due 2025-03-13

⋮

CVECVE-2025-23209

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMSremediation: past CISA due date

P2added 2025-02-20due 2025-03-13

⋮

CVECVE-2024-53704

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

SonicWall · SonicOSremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1199exploitation T1212exploitation T1078.004primary impact T1083primary impact T1021.001secondary impact

P1added 2025-02-18due 2025-03-11

⋮

401–450 of ~1,722

← Prev Next →