CISA Known Exploited Vulnerabilities

KEV additions — February 2025

26 CVEs entered the KEV catalog in February 2025.

Get an alert for each new CVE published for the software you run.

Set up CVE WatchFree account · no credit card

Added February 25, 20252

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2023-34192	Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability	9	77.3 %	Mar 18, 2025
CVE-2024-49035	Microsoft Partner Center Improper Access Control Vulnerability	9.8	1.3 %	Mar 18, 2025

Added February 24, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-20953	Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability	8.8	3.9 %	Mar 17, 2025

Added February 21, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-24989	Microsoft Power Pages Improper Access Control Vulnerability	9.8	1.6 %	Mar 14, 2025

Added February 20, 20252

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-0111	Palo Alto Networks PAN-OS File Read Vulnerability	6.5	2.0 %	Mar 13, 2025
CVE-2025-23209	Craft CMS Code Injection Vulnerability	8.1	21.8 %	Mar 13, 2025

Added February 18, 20252

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-53704ransomware	SonicWall SonicOS SSLVPN Improper Authentication Vulnerability	9.8	95.3 %	Mar 11, 2025
CVE-2025-0108	Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	9.1	98.5 %	Mar 11, 2025

Added February 13, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-57727ransomware	SimpleHelp Path Traversal Vulnerability	7.5	96.6 %	Mar 6, 2025

Added February 12, 20252

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-41710	Mitel SIP Phones Argument Injection Vulnerability	7.2	41.6 %	Mar 5, 2025
CVE-2025-24200	Apple iOS and iPadOS Incorrect Authorization Vulnerability	6.1	4.4 %	Mar 5, 2025

Added February 11, 20254

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-40890	Zyxel DSL CPE OS Command Injection Vulnerability	8.8	20.7 %	Mar 4, 2025
CVE-2024-40891	Zyxel DSL CPE OS Command Injection Vulnerability	8.8	21.7 %	Mar 4, 2025
CVE-2025-21391	Microsoft Windows Storage Link Following Vulnerability	7.1	2.3 %	Mar 4, 2025
CVE-2025-21418	Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability	7.8	1.6 %	Mar 4, 2025

Added February 7, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-0994	Trimble Cityworks Deserialization Vulnerability	8.8	31.1 %	Feb 28, 2025

Added February 6, 20255

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2020-15069	Sophos XG Firewall Buffer Overflow Vulnerability	9.8	10.7 %	Feb 27, 2025
CVE-2020-29574	CyberoamOS (CROS) SQL Injection Vulnerability	9.8	4.7 %	Feb 27, 2025
CVE-2022-23748	Dante Discovery Process Control Vulnerability	7.8	8.3 %	Feb 27, 2025
CVE-2024-21413	Microsoft Outlook Improper Input Validation Vulnerability	9.8	94.7 %	Feb 27, 2025
CVE-2025-0411	7-Zip Mark of the Web Bypass Vulnerability	7	67.1 %	Feb 27, 2025

Added February 5, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-53104	Linux Kernel Out-of-Bounds Write Vulnerability	7.8	3.4 %	Feb 26, 2025

Added February 4, 20254

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2018-19410	Paessler PRTG Network Monitor Local File Inclusion Vulnerability	9.8	97.9 %	Feb 25, 2025
CVE-2018-9276	Paessler PRTG Network Monitor OS Command Injection Vulnerability	7.2	87.0 %	Feb 25, 2025
CVE-2024-29059	Microsoft .NET Framework Information Disclosure Vulnerability	7.5	98.6 %	Feb 25, 2025
CVE-2024-45195	Apache OFBiz Forced Browsing Vulnerability	7.5	100.0 %	Feb 25, 2025

← All recent KEV additions