| CVE-2025-4427 Known exploited | Medium 5.3 | Authentication Bypass Assigned by ivanti | May 13, 2025 |
| CVE-2025-32756 Known exploited | Critical 9.6 | A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.… Assigned by fortinet | May 13, 2025 |
| CVE-2025-4632 Known exploited | Critical 9.8 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority. Assigned by samsung.tv_appliance | May 13, 2025 |
| CVE-2025-42999 Known exploited | Critical 9.1 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) Assigned by sap | May 13, 2025 |
| CVE-2025-47729 Known exploited | Low 1.9 | The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage… Assigned by mitre | May 8, 2025 |
| CVE-2025-35939 Known exploited | Medium 5.3 | Craft CMS stores user-provided content in session files Assigned by cisa-cg | May 7, 2025 |
| CVE-2025-2776 Known exploited | Critical 9.3 | SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection Assigned by VulnCheck | May 7, 2025 |
| CVE-2025-2775 Known exploited | Critical 9.3 | SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection Assigned by VulnCheck | May 7, 2025 |
| CVE-2025-27920 Known exploited | High 7.2 | Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. Assigned by mitre | May 5, 2025 |
| CVE-2025-3935 Known exploited | High 8.1 | ScreenConnect Exposure to ASP.NET ViewState Code Injection Assigned by ConnectWise | Apr 25, 2025 |
| CVE-2025-3928 Known exploited | High 8.8 | Commvault Web Server unspecified vulnerability Assigned by cisa-cg | Apr 25, 2025 |
| CVE-2025-32432 Known exploited | Critical 10.0 | Craft CMS Allows Remote Code Execution Assigned by GitHub_M | Apr 25, 2025 |
| CVE-2025-31324 Known exploited | Critical 10.0 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) Assigned by sap | Apr 24, 2025 |
| CVE-2025-1976 Known exploited | High 8.6 | Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 Assigned by brocade | Apr 24, 2025 |
| CVE-2025-34028 Known exploited | Critical 9.3 | Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal Assigned by VulnCheck | Apr 22, 2025 |
| CVE-2025-42599 Known exploited | Critical 9.8 | Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Assigned by jpcert | Apr 18, 2025 |
| CVE-2025-32433 Known exploited | Critical 10.0 | Erlang/OTP SSH Vulnerable to Pre-Authentication RCE Assigned by GitHub_M | Apr 16, 2025 |
| CVE-2025-31200 Known exploited | Critical 9.8 | A memory corruption issue was addressed with improved bounds checking. Assigned by apple | Apr 16, 2025 |
| CVE-2025-31201 Known exploited | Critical 9.8 | This issue was addressed by removing the vulnerable code. Assigned by apple | Apr 16, 2025 |
| CVE-2024-58136 Known exploited | Critical 9.0 | Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025. Assigned by mitre | Apr 10, 2025 |
| CVE-2025-29824 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Apr 8, 2025 |
| CVE-2025-3248 Known exploited | Critical 9.8 | Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code Assigned by VulnCheck | Apr 7, 2025 |
| CVE-2025-22457 Known exploited | Critical 9.0 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthent… Assigned by ivanti | Apr 3, 2025 |
| CVE-2025-31161 Known exploited | Critical 9.8 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2… Assigned by mitre | Apr 3, 2025 |
| CVE-2025-30406 Known exploited | Critical 9.0 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in Mar… Assigned by mitre | Apr 3, 2025 |
| CVE-2025-31125 Known exploited | Medium 5.3 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Assigned by GitHub_M | Mar 31, 2025 |
| CVE-2025-2783 Known exploited | High 8.3 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. Assigned by Chrome | Mar 26, 2025 |
| CVE-2025-29635 Known exploited | High 7.2 | A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiti… Assigned by mitre | Mar 25, 2025 |
| CVE-2025-2749 Known exploited | High 7.2 | Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE Assigned by VulnCheck | Mar 24, 2025 |
| CVE-2025-2747 Known exploited | Critical 9.8 | Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass Assigned by VulnCheck | Mar 24, 2025 |
| CVE-2025-2746 Known exploited | Critical 9.8 | Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass Assigned by VulnCheck | Mar 24, 2025 |
| CVE-2025-30154 Known exploited | High 8.6 | Multiple Reviewdog actions were compromised during a specific time period Assigned by GitHub_M | Mar 19, 2025 |
| CVE-2025-30066 Known exploited | High 8.6 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. Assigned by mitre | Mar 15, 2025 |
| CVE-2025-21590 Known exploited | Medium 4.4 | Junos OS: An local attacker with shell access can execute arbitrary code Assigned by juniper | Mar 12, 2025 |
| CVE-2025-27915 Known exploited | Medium 5.4 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. Assigned by mitre | Mar 12, 2025 |
| CVE-2025-24201 Known exploited | Critical 10.0 | An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. Assigned by apple | Mar 11, 2025 |
| CVE-2025-26633 Known exploited | High 7.0 | Microsoft Management Console Security Feature Bypass Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2025-24993 Known exploited | High 7.8 | Windows NTFS Remote Code Execution Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2025-24991 Known exploited | Medium 5.5 | Windows NTFS Information Disclosure Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2025-24985 Known exploited | High 7.8 | Windows Fast FAT File System Driver Remote Code Execution Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2025-24984 Known exploited | Medium 4.6 | Windows NTFS Information Disclosure Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2025-24983 Known exploited | High 7.0 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2025-24054 Known exploited | Medium 6.5 | NTLM Hash Disclosure Spoofing Vulnerability Assigned by microsoft | Mar 11, 2025 |
| CVE-2024-54085 Known exploited | Critical 10.0 | Redfish Authentication Bypass Assigned by AMI | Mar 11, 2025 |
| CVE-2025-27363 Known exploited | High 8.1 | An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variab… Assigned by facebook | Mar 11, 2025 |
| CVE-2025-24813 Known exploited | Critical 10.0 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Assigned by apache | Mar 10, 2025 |
| CVE-2025-1316 Known exploited | Critical 9.8 | Edimax IC-7100 IP Camera OS Command Injection Assigned by icscert | Mar 4, 2025 |
| CVE-2025-22226 Known exploited | High 7.1 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Assigned by vmware | Mar 4, 2025 |
| CVE-2025-22225 Known exploited | High 8.2 | VMware ESXi contains an arbitrary write vulnerability. Assigned by vmware | Mar 4, 2025 |
| CVE-2025-22224 Known exploited | Critical 9.3 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. Assigned by vmware | Mar 4, 2025 |
