| CVE-2025-9377 Known exploited | High 8.6 | Authenticated RCE via Parental Control command injection Assigned by TPLink | Aug 29, 2025 |
| CVE-2025-53690 Known exploited | Critical 9.0 | Sitecore Products ViewState Deserialization Vulnerability Assigned by Wiz | Sep 3, 2025 |
| CVE-2025-48543 Known exploited | High 8.8 | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. Assigned by google_android | Sep 4, 2025 |
| CVE-2025-39682 Known exploited | Critical 9.8 | tls: fix handling of zero-length records on the rx_list Assigned by Linux | Sep 5, 2025 |
| CVE-2025-54236 Known exploited | Critical 9.1 | Adobe Commerce | Improper Input Validation (CWE-20) Assigned by adobe | Sep 9, 2025 |
| CVE-2025-21042 Known exploited | High 8.8 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. Assigned by SamsungMobile | Sep 12, 2025 |
| CVE-2025-21043 Known exploited | High 8.8 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. Assigned by SamsungMobile | Sep 12, 2025 |
| CVE-2025-9242 Known exploited | Critical 9.3 | WatchGuard Firebox iked Out of Bounds Write Vulnerability Assigned by WatchGuard | Sep 17, 2025 |
| CVE-2025-10035 Known exploited | Critical 10.0 | Deserialization Vulnerability in GoAnywhere MFT's License Servlet Assigned by Fortra | Sep 18, 2025 |
| CVE-2025-59689 Known exploited | Medium 6.1 | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. Assigned by mitre | Sep 19, 2025 |
| CVE-2025-48703 Known exploited | Critical 9.0 | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. Assigned by mitre | Sep 19, 2025 |
| CVE-2025-26399 Known exploited | Critical 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability Assigned by SolarWinds | Sep 23, 2025 |
| CVE-2025-10585 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Sep 24, 2025 |
| CVE-2025-20352 Known exploited | High 7.7 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privil… Assigned by cisco | Sep 24, 2025 |
| CVE-2025-20333 Known exploited | Critical 9.9 | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote… Assigned by cisco | Sep 25, 2025 |
| CVE-2025-20362 Known exploited | Medium 6.5 | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and… Assigned by cisco | Sep 25, 2025 |
| CVE-2025-41244 Known exploited | High 7.8 | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) Assigned by vmware | Sep 29, 2025 |
| CVE-2025-61882 Known exploited | Critical 9.8 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Assigned by oracle | Oct 5, 2025 |
| CVE-2025-11371 Known exploited | High 7.5 | Gladinet CentreStack and TrioFox Local File Inclusion Flaw Assigned by Huntress | Oct 9, 2025 |
| CVE-2025-61884 Known exploited | High 7.5 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Assigned by oracle | Oct 12, 2025 |
| CVE-2025-39964 Known exploited | High 7.8 | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Assigned by Linux | Oct 13, 2025 |
| CVE-2025-24990 Known exploited | High 7.8 | Windows Agere Modem Driver Elevation of Privilege Vulnerability Assigned by microsoft | Oct 14, 2025 |
| CVE-2025-59230 Known exploited | High 7.8 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Assigned by microsoft | Oct 14, 2025 |
| CVE-2025-59287 Known exploited | Critical 9.8 | Windows Server Update Service (WSUS) Remote Code Execution Vulnerability Assigned by microsoft | Oct 14, 2025 |
| CVE-2025-53521 Known exploited | Critical 9.8 | BigIP APM Vulnerability Assigned by f5 | Oct 15, 2025 |
| CVE-2025-61932 Known exploited | Critical 9.3 | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending s… Assigned by jpcert | Oct 20, 2025 |
| CVE-2025-61757 Known exploited | Critical 9.8 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Assigned by oracle | Oct 21, 2025 |
| CVE-2025-11953 Known exploited | Critical 9.8 | Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests Assigned by JFROG | Nov 3, 2025 |
| CVE-2023-43000 Known exploited | High 8.8 | A use-after-free issue was addressed with improved memory management. Assigned by apple | Nov 5, 2025 |
| CVE-2025-64328 Known exploited | High 8.6 | FreePBX Administration GUI is Vulnerable to Authenticated Command Injection Assigned by GitHub_M | Nov 7, 2025 |
| CVE-2025-12480 Known exploited | Critical 9.1 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. Assigned by Mandiant | Nov 10, 2025 |
| CVE-2025-60710 Known exploited | High 7.8 | Host Process for Windows Tasks Elevation of Privilege Vulnerability Assigned by microsoft | Nov 11, 2025 |
| CVE-2025-62215 Known exploited | High 7.0 | Windows Kernel Elevation of Privilege Vulnerability Assigned by microsoft | Nov 11, 2025 |
| CVE-2025-64446 Known exploited | Critical 9.4 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0… Assigned by fortinet | Nov 14, 2025 |
| CVE-2025-13223 Known exploited | High 8.8 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 17, 2025 |
| CVE-2025-58034 Known exploited | Medium 6.7 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6… Assigned by fortinet | Nov 18, 2025 |
| CVE-2025-58360 Known exploited | High 8.2 | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Assigned by GitHub_M | Nov 25, 2025 |
| CVE-2025-62593 Known exploited | Critical 9.4 | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack Assigned by GitHub_M | Nov 26, 2025 |
| CVE-2025-55182 Known exploited | Critical 10.0 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react… Assigned by Meta | Dec 3, 2025 |
| CVE-2025-66644 Known exploited | High 7.2 | Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. Assigned by mitre | Dec 5, 2025 |
| CVE-2025-34291 Known exploited | Critical 9.4 | Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE Assigned by VulnCheck | Dec 5, 2025 |
| CVE-2025-48572 Known exploited | High 7.8 | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Assigned by google_android | Dec 8, 2025 |
| CVE-2025-48633 Known exploited | Medium 5.5 | In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. Assigned by google_android | Dec 8, 2025 |
| CVE-2025-59718 Known exploited | Critical 9.1 | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, Fort… Assigned by fortinet | Dec 9, 2025 |
| CVE-2025-62221 Known exploited | High 7.8 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Assigned by microsoft | Dec 9, 2025 |
| CVE-2025-8110 Known exploited | High 8.7 | File overwrite in file update API in Gogs Assigned by Wiz | Dec 10, 2025 |
| CVE-2025-14174 Known exploited | High 8.8 | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Assigned by Chrome | Dec 12, 2025 |
| CVE-2025-43520 Known exploited | Medium 5.5 | A memory corruption issue was addressed with improved memory handling. Assigned by apple | Dec 12, 2025 |
| CVE-2025-43510 Known exploited | High 7.8 | A memory corruption issue was addressed with improved lock state checking. Assigned by apple | Dec 12, 2025 |
| CVE-2025-14611 Known exploited | High 7.1 | Gladinet CentreStack and TrioFox Hard Coded AES Keys Assigned by Huntress | Dec 12, 2025 |
