CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command Injection FreePBX filestore Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack ray-project ray Versions & vendor guidance → |
Known exploitedCISA KEV | 9.4Critical |
| CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-62215Windows Kernel Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7High |
| CVE-2025-6218RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability RARLAB WinRAR Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-6205Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 Dassault Systèmes DELMIA Apriso Versions & vendor guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 Dassault Systèmes DELMIA Apriso Versions & vendor guidance → |
Known exploitedCISA KEV | 8High |
| CVE-2025-61932Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability MOTEX Inc. Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-61884Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Oracle Corporation Oracle Configurator Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability Oracle Corporation Oracle Concurrent Processing Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-61757Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Oracle Corporation Identity Manager Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-61624Fortinet Multiple Products Path Traversal Vulnerability Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager, Fortinet FortiPAM Reported fix guidance → |
Known exploitedCISA KEV | 5.4Medium |
| CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege Vulnerability Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability Fortinet FortiSwitchManager, Fortinet FortiOS, Fortinet FortiProxy Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2025-59689Libraesva Email Security Gateway Command Injection Vulnerability Libraesva Email Security Gateway Versions & vendor guidance → |
Known exploitedCISA KEV | 6.1Medium |
| CVE-2025-59374ASUS Live Update Embedded Malicious Code Vulnerability ASUS live update Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution Vulnerability Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-59230Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-58360GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature geoserver geoserver Versions & vendor guidance → |
Known exploitedCISA KEV | 8.2High |
| CVE-2025-58034Fortinet FortiWeb OS Command Injection Vulnerability Fortinet FortiWeb Reported fix guidance → |
Known exploitedCISA KEV | 6.7Medium |
| CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE FreePBX endpoint Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread NetScaler ADC, NetScaler Gateway Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-55182Meta React Server Components Remote Code Execution Vulnerability Meta react-server-dom-webpack, Meta react-server-dom-turbopack, Meta react-server-dom-parcel Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-55177Meta Platforms WhatsApp Incorrect Authorization Vulnerability Facebook WhatsApp Desktop for Mac, Facebook WhatsApp Business for iOS, Facebook WhatsApp for iOS Versions & vendor guidance → |
Known exploitedCISA KEV | 5.4Medium |
| CVE-2025-54948Trend Micro Apex One OS Command Injection Vulnerability Trend Micro, Inc. Trend Micro Apex One Versions & vendor guidance → |
Known exploitedCISA KEV | 9.4Critical |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.