CISA Known Exploited Vulnerabilities
KEV additions — January 2025
14 CVEs entered the KEV catalog in January 2025.
Added January 29, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24085 | Apple Multiple Products Use-After-Free Vulnerability | 10 | 28.4 % | February 19, 2025 |
Added January 24, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-23006ransomware | SonicWall SMA1000 Appliances Deserialization Vulnerability | 9.8 | 38.7 % | February 14, 2025 |
Added January 23, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2020-11023 | JQuery Cross-Site Scripting (XSS) Vulnerability | 6.1 | 36.3 % | February 13, 2025 |
Added January 16, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-50603 | Aviatrix Controllers OS Command Injection Vulnerability | 9.8 | 94.4 % | February 6, 2025 |
Added January 14, 20254
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-55591ransomware | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | 9.8 | 94.2 % | January 21, 2025 |
| CVE-2025-21333 | Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability | 7.8 | 78.0 % | February 4, 2025 |
| CVE-2025-21334 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | 7.8 | 7.6 % | February 4, 2025 |
| CVE-2025-21335 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | 7.8 | 9.9 % | February 4, 2025 |
Added January 13, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-48365ransomware | Qlik Sense HTTP Tunneling Vulnerability | 9.9 | 51.8 % | February 3, 2025 |
| CVE-2024-12686 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability | 7.2 | 34.8 % | February 3, 2025 |
Added January 8, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-0282ransomware | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | 9 | 94.1 % | January 15, 2025 |
Added January 7, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2020-2883 | Oracle WebLogic Server Unspecified Vulnerability | 9.8 | 94.4 % | January 28, 2025 |
| CVE-2024-41713ransomware | Mitel MiCollab Path Traversal Vulnerability | 9.1 | 94.1 % | January 28, 2025 |
| CVE-2024-55550ransomware | Mitel MiCollab Path Traversal Vulnerability | 2.7 | 14.9 % | January 28, 2025 |