CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2025-47812 Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability wftpserver Wing FTP Server Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-47729 TeleMessage TM SGNL Hidden Functionality Vulnerability TeleMessage archiving backend Versions & vendor guidance →	Known exploitedCISA KEV	1.9Low
CVE-2025-4632 Samsung MagicINFO 9 Server Path Traversal Vulnerability Samsung Electronics MagicINFO 9 Server Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2025-4428 Remote Code Execution Ivanti Endpoint Manager Mobile Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-4427 Authentication Bypass Ivanti Endpoint Manager Mobile Versions & vendor guidance →	Known exploitedCISA KEV	5.3Medium
CVE-2025-43529 Apple Multiple Products Use-After-Free WebKit Vulnerability Apple Safari, Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance →	Known exploitedCISA KEV	5.5Medium
CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability Apple iOS and iPadOS, Apple iPadOS, Apple macOS Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-43200 Apple Multiple Products Unspecified Vulnerability Apple iOS and iPadOS, Apple iPadOS, Apple macOS, Apple visionOS, Apple watchOS Versions & vendor guidance →	Known exploitedCISA KEV	4.2Medium
CVE-2025-42999 Insecure Deserialization in SAP NetWeaver (Visual Composer development server) SAP_SE SAP NetWeaver (Visual Composer development server) Versions & vendor guidance →	Known exploitedCISA KEV	9.1Critical
CVE-2025-42599 Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability QUALITIA CO., LTD. Active! mail 6 Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2025-41244 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) VMware VCF operations, VMware VMware tools, VMware VMware Aria Operations, VMware VMware Cloud Foundation, VMware VMware Telco Cloud Platform, VMware VMware Telco Cloud Infrastructure Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability SonicWall SMA1000 Versions & vendor guidance →	Known exploitedCISA KEV	6.6Medium
CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability SolarWinds Web Help Desk Reported fix guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability SolarWinds Web Help Desk Reported fix guidance →	Known exploitedCISA KEV	8.1High
CVE-2025-4008 Arbitrary Command Injection in Smartbedded MeteoBridge Smartbedded MeteoBridge Versions & vendor guidance →	Known exploitedCISA KEV	8.7High
CVE-2025-39964 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Linux Linux Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2025-39682 tls: fix handling of zero-length records on the rx_list Linux Linux Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2025-3935 ScreenConnect Exposure to ASP.NET ViewState Code Injection ConnectWise ScreenConnect Reported fix guidance →	Known exploitedCISA KEV	8.1High
CVE-2025-3928 Commvault Web Server unspecified vulnerability Commvault Web Server Versions & vendor guidance →	Known exploitedCISA KEV	8.7High
CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() Linux Linux Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability Hewlett Packard Enterprise (HPE) HPE OneView Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-35939 Craft CMS stores user-provided content in session files Craft CMS Versions & vendor guidance →	Known exploitedCISA KEV	6.9Medium
CVE-2025-34291 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE Langflow Langflow Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.