CISA Known Exploited Vulnerabilities
KEV additions — March 2025
31 CVEs entered the KEV catalog in March 2025.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added March 31, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-20439 | Cisco Smart Licensing Utility Static Credential Vulnerability | 9.8 | 97.1 % | Apr 21, 2025 |
Added March 27, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-2783 | Google Chromium Mojo Sandbox Escape Vulnerability | 8.3 | 9.2 % | Apr 17, 2025 |
Added March 26, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-9874 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 9.8 | 83.7 % | Apr 16, 2025 |
| CVE-2019-9875 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 8.8 | 13.8 % | Apr 16, 2025 |
Added March 24, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-30154 | reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability | 8.6 | 2.5 % | Apr 14, 2025 |
Added March 19, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-48248 | NAKIVO Backup and Replication Absolute Path Traversal Vulnerability | 8.6 | 94.4 % | Apr 9, 2025 |
| CVE-2025-1316 | Edimax IC-7100 IP Camera OS Command Injection Vulnerability | 9.8 | 74.5 % | Apr 9, 2025 |
Added March 18, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24472ransomware | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | 8.1 | 7.2 % | Apr 8, 2025 |
| CVE-2025-30066 | tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability | 8.6 | 72.1 % | Apr 8, 2025 |
Added March 13, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-21590 | Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability | 4.4 | 1.7 % | Apr 3, 2025 |
| CVE-2025-24201 | Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability | 10 | 3.8 % | Apr 3, 2025 |
Added March 11, 20256
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24983 | Microsoft Windows Win32k Use-After-Free Vulnerability | 7 | 1.4 % | Apr 1, 2025 |
| CVE-2025-24984 | Microsoft Windows NTFS Information Disclosure Vulnerability | 4.6 | 2.0 % | Apr 1, 2025 |
| CVE-2025-24985 | Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability | 7.8 | 3.9 % | Apr 1, 2025 |
| CVE-2025-24991 | Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability | 5.5 | 2.0 % | Apr 1, 2025 |
| CVE-2025-24993 | Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | 7.8 | 2.2 % | Apr 1, 2025 |
| CVE-2025-26633ransomware | Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability | 7 | 30.4 % | Apr 1, 2025 |
Added March 10, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 7.5 | 100.0 % | Mar 31, 2025 |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 7.5 | 91.2 % | Mar 31, 2025 |
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 7.5 | 90.1 % | Mar 31, 2025 |
| CVE-2024-57968 | Advantive VeraCore Unrestricted File Upload Vulnerability | 8.8 | 32.3 % | Mar 31, 2025 |
| CVE-2025-25181 | Advantive VeraCore SQL Injection Vulnerability | 7.5 | 55.5 % | Mar 31, 2025 |
Added March 4, 20254
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-50302 | Linux Kernel Use of Uninitialized Resource Vulnerability | 5.5 | 0.8 % | Mar 25, 2025 |
| CVE-2025-22224 | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 8.2 | 1.6 % | Mar 25, 2025 |
| CVE-2025-22225 | VMware ESXi Arbitrary Write Vulnerability | 8.2 | 1.0 % | Mar 25, 2025 |
| CVE-2025-22226 | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 6 | 1.8 % | Mar 25, 2025 |
Added March 3, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-8639ransomware | Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability | 7.8 | 22.2 % | Mar 24, 2025 |
| CVE-2022-43769 | Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability | 7.2 | 97.7 % | Mar 24, 2025 |
| CVE-2022-43939 | Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability | 9.8 | 92.3 % | Mar 24, 2025 |
| CVE-2023-20118 | Cisco Small Business RV Series Routers Command Injection Vulnerability | 7.2 | 54.1 % | Mar 24, 2025 |
| CVE-2024-4885 | Progress WhatsUp Gold Path Traversal Vulnerability | 9.8 | 99.3 % | Mar 24, 2025 |