| CVE-2025-43300 Known exploited | Critical 10.0 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | Aug 21, 2025 |
| CVE-2025-8875 Known exploited | Critical 9.4 | Insecure Deserialization Vulnerability Assigned by N-able | Aug 14, 2025 |
| CVE-2025-8876 Known exploited | Critical 9.4 | Command Injection Vulnerability Assigned by N-able | Aug 14, 2025 |
| CVE-2025-8088 Known exploited | High 8.4 | Path traversal vulnerability in WinRAR Assigned by ESET | Aug 8, 2025 |
| CVE-2025-54253 Known exploited | Critical 10.0 | Adobe Experience Manager | Incorrect Authorization (CWE-863) Assigned by adobe | Aug 5, 2025 |
| CVE-2025-54948 Known exploited | Critical 9.4 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. Assigned by trendmicro | Aug 5, 2025 |
| CVE-2025-6205 Known exploited | Critical 9.1 | Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 Assigned by 3DS | Aug 4, 2025 |
| CVE-2025-6204 Known exploited | High 8.0 | Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 Assigned by 3DS | Aug 4, 2025 |
| CVE-2025-31277 Known exploited | High 8.8 | The issue was addressed with improved memory handling. Assigned by apple | Jul 29, 2025 |
| CVE-2025-38352 Known exploited | High 7.8 | posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() Assigned by Linux | Jul 22, 2025 |
| CVE-2025-53770 Known exploited | Critical 9.8 | Microsoft SharePoint Server Remote Code Execution Vulnerability Assigned by microsoft | Jul 20, 2025 |
| CVE-2025-54313 Known exploited | High 7.5 | eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Assigned by mitre | Jul 19, 2025 |
| CVE-2025-54309 Known exploited | Critical 9.0 | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as expl… Assigned by mitre | Jul 18, 2025 |
| CVE-2025-54068 Known exploited | Critical 9.2 | Livewire vulnerable to remote command execution during property update hydration Assigned by GitHub_M | Jul 17, 2025 |
| CVE-2025-25257 Known exploited | Critical 9.6 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, Fo… Assigned by fortinet | Jul 17, 2025 |
| CVE-2025-20337 Known exploited | Critical 10.0 | Cisco ISE API Unauthenticated Remote Code Execution Vulnerability Assigned by cisco | Jul 16, 2025 |
| CVE-2025-6558 Known exploited | High 8.8 | Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome | Jul 15, 2025 |
| CVE-2025-47813 Known exploited | Medium 4.3 | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. Assigned by mitre | Jul 10, 2025 |
| CVE-2025-47812 Known exploited | Critical 10.0 | In Wing FTP Server before 7.4.4. Assigned by mitre | Jul 10, 2025 |
| CVE-2025-48384 Known exploited | High 8.1 | Git allows arbitrary code execution through broken config quoting Assigned by GitHub_M | Jul 8, 2025 |
| CVE-2025-49706 Known exploited | Medium 6.5 | Microsoft SharePoint Server Spoofing Vulnerability Assigned by microsoft | Jul 8, 2025 |
| CVE-2025-49704 Known exploited | High 8.8 | Microsoft SharePoint Remote Code Execution Vulnerability Assigned by microsoft | Jul 8, 2025 |
| CVE-2025-6554 Known exploited | High 8.1 | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Assigned by Chrome | Jun 30, 2025 |
| CVE-2025-32463 Known exploited | Critical 9.3 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. Assigned by mitre | Jun 30, 2025 |
| CVE-2025-20281 Known exploited | Critical 10.0 | Cisco ISE API Unauthenticated Remote Code Execution Vulnerability Assigned by cisco | Jun 25, 2025 |
| CVE-2025-6543 Known exploited | Critical 9.2 | Memory overflow vulnerability leading to unintended control flow and Denial of Service Assigned by Citrix | Jun 25, 2025 |
| CVE-2025-32975 Known exploited | Critical 10.0 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an… Assigned by mitre | Jun 24, 2025 |
| CVE-2025-48700 Known exploited | Medium 6.1 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. Assigned by mitre | Jun 23, 2025 |
| CVE-2025-6218 Known exploited | High 7.8 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability Assigned by zdi | Jun 21, 2025 |
| CVE-2025-5777 Known exploited | Critical 9.3 | NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread Assigned by Citrix | Jun 17, 2025 |
| CVE-2025-43200 Known exploited | Medium 4.2 | This issue was addressed with improved checks. Assigned by apple | Jun 16, 2025 |
| CVE-2025-33073 Known exploited | High 8.8 | Windows SMB Client Elevation of Privilege Vulnerability Assigned by microsoft | Jun 10, 2025 |
| CVE-2025-33053 Known exploited | High 8.8 | Internet Shortcut Files Remote Code Execution Vulnerability Assigned by microsoft | Jun 10, 2025 |
| CVE-2025-47827 Known exploited | Medium 4.6 | In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Assigned by mitre | Jun 5, 2025 |
| CVE-2025-21479 Known exploited | High 8.6 | Incorrect Authorization in Graphics Assigned by qualcomm | Jun 3, 2025 |
| CVE-2025-27038 Known exploited | High 7.5 | Use After Free in Graphics Assigned by qualcomm | Jun 3, 2025 |
| CVE-2025-21480 Known exploited | High 8.6 | Incorrect Authorization in Graphics Windows Assigned by qualcomm | Jun 3, 2025 |
| CVE-2025-5419 Known exploited | High 8.8 | Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Jun 2, 2025 |
| CVE-2025-5086 Known exploited | Critical 9.0 | Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 Assigned by 3DS | Jun 2, 2025 |
| CVE-2025-49113 Known exploited | Critical 9.9 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.ph… Assigned by mitre | Jun 2, 2025 |
| CVE-2025-48928 Known exploited | Medium 4.0 | The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be includ… Assigned by mitre | May 28, 2025 |
| CVE-2025-48927 Known exploited | Medium 5.3 | The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. Assigned by mitre | May 28, 2025 |
| CVE-2025-34026 Known exploited | Critical 9.2 | Versa Concerto Actuator Authentication Bypass Information Leak Assigned by VulnCheck | May 21, 2025 |
| CVE-2025-4008 Known exploited | High 8.7 | Arbitrary Command Injection in Smartbedded MeteoBridge Assigned by ONEKEY | May 21, 2025 |
| CVE-2025-30397 Known exploited | High 7.5 | Scripting Engine Memory Corruption Vulnerability Assigned by microsoft | May 13, 2025 |
| CVE-2025-32709 Known exploited | High 7.8 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Assigned by microsoft | May 13, 2025 |
| CVE-2025-32706 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | May 13, 2025 |
| CVE-2025-32701 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | May 13, 2025 |
| CVE-2025-30400 Known exploited | High 7.8 | Microsoft DWM Core Library Elevation of Privilege Vulnerability Assigned by microsoft | May 13, 2025 |
| CVE-2025-4428 Known exploited | High 7.2 | Remote Code Execution Assigned by ivanti | May 13, 2025 |
