CISA Known Exploited Vulnerabilities
KEV additions — June 2025
20 CVEs entered the KEV catalog in June 2025.
Added June 30, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-6543 | Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | 9.8 | 0.9 % | July 21, 2025 |
Added June 25, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-6693ransomware | Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability | 6.5 | 71.0 % | July 16, 2025 |
| CVE-2024-0769 | D-Link DIR-859 Router Path Traversal Vulnerability | 9.8 | 75.2 % | July 16, 2025 |
| CVE-2024-54085 | AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability | 9.8 | 8.2 % | July 16, 2025 |
Added June 17, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-0386 | Linux Kernel Improper Ownership Management Vulnerability | 7.8 | 61.6 % | July 8, 2025 |
Added June 16, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-33538 | TP-Link Multiple Routers Command Injection Vulnerability | 8.8 | 91.3 % | July 7, 2025 |
| CVE-2025-43200 | Apple Multiple Products Unspecified Vulnerability | 4.2 | 0.9 % | July 7, 2025 |
Added June 10, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24016 | Wazuh Server Deserialization of Untrusted Data Vulnerability | 9.9 | 93.8 % | July 1, 2025 |
| CVE-2025-33053 | Microsoft Windows External Control of File Name or Path Vulnerability | 8.8 | 50.3 % | July 1, 2025 |
Added June 9, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-42009 | RoundCube Webmail Cross-Site Scripting Vulnerability | 9.3 | 91.2 % | June 30, 2025 |
| CVE-2025-32433 | Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability | 10 | 50.3 % | June 30, 2025 |
Added June 5, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-5419 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 8.8 | 3.5 % | June 26, 2025 |
Added June 3, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-21479 | Incorrect Authorization in Graphics | 8.6 | 0.1 % | June 24, 2025 |
| CVE-2025-21480 | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 8.6 | 2.0 % | June 24, 2025 |
| CVE-2025-27038 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 7.5 | 1.4 % | June 24, 2025 |
Added June 2, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-32030 | ASUS Routers Improper Authentication Vulnerability | 9.8 | 94.2 % | June 23, 2025 |
| CVE-2023-39780 | ASUS RT-AX55 Routers OS Command Injection Vulnerability | 8.8 | 42.7 % | June 23, 2025 |
| CVE-2024-56145 | Craft CMS Code Injection Vulnerability | 9.8 | 94.0 % | June 23, 2025 |
| CVE-2025-35939 | Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability | 5.3 | 20.8 % | June 23, 2025 |
| CVE-2025-3935 | ConnectWise ScreenConnect Improper Authentication Vulnerability | 7.2 | 15.5 % | June 23, 2025 |