| CVE-2025-14174 Known exploited | High 8.8 | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Assigned by Chrome | Dec 12, 2025 |
| CVE-2025-8110 Known exploited | High 8.7 | File overwrite in file update API in Gogs Assigned by Wiz | Dec 10, 2025 |
| CVE-2025-62221 Known exploited | High 7.8 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Assigned by microsoft | Dec 9, 2025 |
| CVE-2025-59718 Known exploited | Critical 9.1 | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, Fort… Assigned by fortinet | Dec 9, 2025 |
| CVE-2025-48633 Known exploited | Medium 5.5 | In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. Assigned by google_android | Dec 8, 2025 |
| CVE-2025-48572 Known exploited | High 7.8 | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Assigned by google_android | Dec 8, 2025 |
| CVE-2025-34291 Known exploited | Critical 9.4 | Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE Assigned by VulnCheck | Dec 5, 2025 |
| CVE-2025-66644 Known exploited | High 7.2 | Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. Assigned by mitre | Dec 5, 2025 |
| CVE-2025-55182 Known exploited | Critical 10.0 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react… Assigned by Meta | Dec 3, 2025 |
| CVE-2025-62593 Known exploited | Critical 9.4 | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack Assigned by GitHub_M | Nov 26, 2025 |
| CVE-2025-58360 Known exploited | High 8.2 | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Assigned by GitHub_M | Nov 25, 2025 |
| CVE-2025-58034 Known exploited | Medium 6.7 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6… Assigned by fortinet | Nov 18, 2025 |
| CVE-2025-13223 Known exploited | High 8.8 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 17, 2025 |
| CVE-2025-64446 Known exploited | Critical 9.4 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0… Assigned by fortinet | Nov 14, 2025 |
| CVE-2025-62215 Known exploited | High 7.0 | Windows Kernel Elevation of Privilege Vulnerability Assigned by microsoft | Nov 11, 2025 |
| CVE-2025-60710 Known exploited | High 7.8 | Host Process for Windows Tasks Elevation of Privilege Vulnerability Assigned by microsoft | Nov 11, 2025 |
| CVE-2025-12480 Known exploited | Critical 9.1 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. Assigned by Mandiant | Nov 10, 2025 |
| CVE-2025-64328 Known exploited | High 8.6 | FreePBX Administration GUI is Vulnerable to Authenticated Command Injection Assigned by GitHub_M | Nov 7, 2025 |
| CVE-2023-43000 Known exploited | High 8.8 | A use-after-free issue was addressed with improved memory management. Assigned by apple | Nov 5, 2025 |
| CVE-2025-11953 Known exploited | Critical 9.8 | Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests Assigned by JFROG | Nov 3, 2025 |
| CVE-2025-61757 Known exploited | Critical 9.8 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Assigned by oracle | Oct 21, 2025 |
| CVE-2025-61932 Known exploited | Critical 9.3 | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending s… Assigned by jpcert | Oct 20, 2025 |
| CVE-2025-53521 Known exploited | Critical 9.8 | BigIP APM Vulnerability Assigned by f5 | Oct 15, 2025 |
| CVE-2025-59287 Known exploited | Critical 9.8 | Windows Server Update Service (WSUS) Remote Code Execution Vulnerability Assigned by microsoft | Oct 14, 2025 |
| CVE-2025-59230 Known exploited | High 7.8 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Assigned by microsoft | Oct 14, 2025 |
| CVE-2025-24990 Known exploited | High 7.8 | Windows Agere Modem Driver Elevation of Privilege Vulnerability Assigned by microsoft | Oct 14, 2025 |
| CVE-2025-39964 Known exploited | High 7.8 | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Assigned by Linux | Oct 13, 2025 |
| CVE-2025-61884 Known exploited | High 7.5 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Assigned by oracle | Oct 12, 2025 |
| CVE-2025-11371 Known exploited | High 7.5 | Gladinet CentreStack and TrioFox Local File Inclusion Flaw Assigned by Huntress | Oct 9, 2025 |
| CVE-2025-61882 Known exploited | Critical 9.8 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Assigned by oracle | Oct 5, 2025 |
| CVE-2025-41244 Known exploited | High 7.8 | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) Assigned by vmware | Sep 29, 2025 |
| CVE-2025-20362 Known exploited | Medium 6.5 | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and… Assigned by cisco | Sep 25, 2025 |
| CVE-2025-20333 Known exploited | Critical 9.9 | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote… Assigned by cisco | Sep 25, 2025 |
| CVE-2025-20352 Known exploited | High 7.7 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privil… Assigned by cisco | Sep 24, 2025 |
| CVE-2025-10585 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Sep 24, 2025 |
| CVE-2025-26399 Known exploited | Critical 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability Assigned by SolarWinds | Sep 23, 2025 |
| CVE-2025-59689 Known exploited | Medium 6.1 | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. Assigned by mitre | Sep 19, 2025 |
| CVE-2025-48703 Known exploited | Critical 9.0 | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. Assigned by mitre | Sep 19, 2025 |
| CVE-2025-10035 Known exploited | Critical 10.0 | Deserialization Vulnerability in GoAnywhere MFT's License Servlet Assigned by Fortra | Sep 18, 2025 |
| CVE-2025-9242 Known exploited | Critical 9.3 | WatchGuard Firebox iked Out of Bounds Write Vulnerability Assigned by WatchGuard | Sep 17, 2025 |
| CVE-2025-21043 Known exploited | High 8.8 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. Assigned by SamsungMobile | Sep 12, 2025 |
| CVE-2025-21042 Known exploited | High 8.8 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. Assigned by SamsungMobile | Sep 12, 2025 |
| CVE-2025-54236 Known exploited | Critical 9.1 | Adobe Commerce | Improper Input Validation (CWE-20) Assigned by adobe | Sep 9, 2025 |
| CVE-2025-39682 Known exploited | Critical 9.8 | tls: fix handling of zero-length records on the rx_list Assigned by Linux | Sep 5, 2025 |
| CVE-2025-48543 Known exploited | High 8.8 | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. Assigned by google_android | Sep 4, 2025 |
| CVE-2025-53690 Known exploited | Critical 9.0 | Sitecore Products ViewState Deserialization Vulnerability Assigned by Wiz | Sep 3, 2025 |
| CVE-2025-9377 Known exploited | High 8.6 | Authenticated RCE via Parental Control command injection Assigned by TPLink | Aug 29, 2025 |
| CVE-2025-55177 Known exploited | Medium 5.4 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed… Assigned by facebook | Aug 29, 2025 |
| CVE-2025-57819 Known exploited | Critical 10.0 | FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE Assigned by GitHub_M | Aug 28, 2025 |
| CVE-2025-7775 Known exploited | Critical 9.2 | Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service Assigned by Citrix | Aug 26, 2025 |
