CISA Known Exploited Vulnerabilities
KEV additions — October 2025
23 CVEs entered the KEV catalog in October 2025.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added October 30, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24893 | XWiki Platform Eval Injection Vulnerability | 9.8 | 99.9 % | Nov 20, 2025 |
| CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability | 7.8 | 8.6 % | Nov 20, 2025 |
Added October 28, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-6204 | Dassault Systèmes DELMIA Apriso Code Injection Vulnerability | 8 | 79.2 % | Nov 18, 2025 |
| CVE-2025-6205 | Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability | 9.1 | 73.6 % | Nov 18, 2025 |
Added October 24, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-54236 | Adobe Commerce and Magento Improper Input Validation Vulnerability | 9.1 | 94.7 % | Nov 14, 2025 |
| CVE-2025-59287 | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability | 9.8 | 100.0 % | Nov 14, 2025 |
Added October 22, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-61932 | Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability | 9.8 | 2.8 % | Nov 12, 2025 |
Added October 20, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2022-48503 | Apple Multiple Products Unspecified Vulnerability | 8.8 | 3.2 % | Nov 10, 2025 |
| CVE-2025-2746 | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.8 | 74.1 % | Nov 10, 2025 |
| CVE-2025-2747 | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.8 | 97.2 % | Nov 10, 2025 |
| CVE-2025-33073 | Microsoft Windows SMB Client Improper Access Control Vulnerability | 8.8 | 82.7 % | Nov 10, 2025 |
| CVE-2025-61884ransomware | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | 7.5 | 95.9 % | Nov 10, 2025 |
Added October 15, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-54253 | Adobe Experience Manager Forms Code Execution Vulnerability | 10 | 88.3 % | Nov 5, 2025 |
Added October 14, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24990 | Microsoft Windows Untrusted Pointer Dereference Vulnerability | 7.8 | 6.4 % | Nov 4, 2025 |
| CVE-2025-47827 | IGEL OS Use of a Key Past its Expiration Date Vulnerability | 4.6 | 4.9 % | Nov 4, 2025 |
| CVE-2025-59230 | Microsoft Windows Improper Access Control Vulnerability | 7.8 | 2.7 % | Nov 4, 2025 |
Added October 9, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-43798 | Grafana Path Traversal Vulnerability | 7.5 | 88.5 % | Oct 30, 2025 |
Added October 7, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-27915 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 5.4 | 4.1 % | Oct 28, 2025 |
Added October 6, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-22555 | Linux Kernel Heap Out-of-Bounds Write Vulnerability | 7.8 | 78.7 % | Oct 27, 2025 |
| CVE-2021-43226 | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 3.3 % | Oct 27, 2025 |
| CVE-2025-61882ransomware | Oracle E-Business Suite Unspecified Vulnerability | 9.8 | 99.7 % | Oct 27, 2025 |
Added October 2, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-21043 | Samsung Mobile Devices Out-of-Bounds Write Vulnerability | 9.8 | 2.1 % | Oct 23, 2025 |
| CVE-2025-4008 | Smartbedded Meteobridge Command Injection Vulnerability | 8.8 | 93.3 % | Oct 23, 2025 |