CISA Known Exploited Vulnerabilities
KEV additions — June 2025
20 CVEs entered the KEV catalog in June 2025.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added June 30, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-6543 | Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | 9.8 | 10.6 % | Jul 21, 2025 |
Added June 25, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-6693ransomware | Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability | 6.5 | 6.6 % | Jul 16, 2025 |
| CVE-2024-0769 | D-Link DIR-859 Router Path Traversal Vulnerability | 9.8 | 82.7 % | Jul 16, 2025 |
| CVE-2024-54085 | AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability | 9.8 | 60.7 % | Jul 16, 2025 |
Added June 17, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-0386 | Linux Kernel Improper Ownership Management Vulnerability | 7.8 | 7.9 % | Jul 8, 2025 |
Added June 16, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-33538 | TP-Link Multiple Routers Command Injection Vulnerability | 8.8 | 41.6 % | Jul 7, 2025 |
| CVE-2025-43200 | Apple Multiple Products Unspecified Vulnerability | 4.2 | 1.2 % | Jul 7, 2025 |
Added June 10, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24016 | Wazuh Server Deserialization of Untrusted Data Vulnerability | 9.9 | 93.8 % | Jul 1, 2025 |
| CVE-2025-33053 | Microsoft Windows External Control of File Name or Path Vulnerability | 8.8 | 87.0 % | Jul 1, 2025 |
Added June 9, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-42009 | RoundCube Webmail Cross-Site Scripting Vulnerability | 9.3 | 82.9 % | Jun 30, 2025 |
| CVE-2025-32433 | Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability | 10 | 98.8 % | Jun 30, 2025 |
Added June 5, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-5419 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 8.8 | 7.8 % | Jun 26, 2025 |
Added June 3, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-21479 | Incorrect Authorization in Graphics | 8.6 | 0.8 % | Jun 24, 2025 |
| CVE-2025-21480 | Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability | 8.6 | 0.5 % | Jun 24, 2025 |
| CVE-2025-27038 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 7.5 | 1.0 % | Jun 24, 2025 |
Added June 2, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-32030 | ASUS Routers Improper Authentication Vulnerability | 9.8 | 99.4 % | Jun 23, 2025 |
| CVE-2023-39780 | ASUS RT-AX55 Routers OS Command Injection Vulnerability | 8.8 | 39.5 % | Jun 23, 2025 |
| CVE-2024-56145 | Craft CMS Code Injection Vulnerability | 9.8 | 97.4 % | Jun 23, 2025 |
| CVE-2025-35939 | Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability | 5.3 | 1.3 % | Jun 23, 2025 |
| CVE-2025-3935 | ConnectWise ScreenConnect Improper Authentication Vulnerability | 7.2 | 3.5 % | Jun 23, 2025 |