CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2025-58034 Fortinet FortiWeb OS Command Injection Vulnerability Fortinet FortiWeb Reported fix guidance →	Known exploitedCISA KEV	6.7Medium
CVE-2025-57819 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE FreePBX endpoint Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-5777 NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread NetScaler ADC, NetScaler Gateway Versions & vendor guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2025-55182 Meta React Server Components Remote Code Execution Vulnerability Meta react-server-dom-webpack, Meta react-server-dom-turbopack, Meta react-server-dom-parcel Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-55177 Meta Platforms WhatsApp Incorrect Authorization Vulnerability Facebook WhatsApp Desktop for Mac, Facebook WhatsApp Business for iOS, Facebook WhatsApp for iOS Versions & vendor guidance →	Known exploitedCISA KEV	5.4Medium
CVE-2025-54948 Trend Micro Apex One OS Command Injection Vulnerability Trend Micro, Inc. Trend Micro Apex One Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical
CVE-2025-54313 Prettier eslint-config-prettier Embedded Malicious Code Vulnerability prettier eslint-config-prettier Versions & vendor guidance →	Known exploitedCISA KEV	7.5High
CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability CrushFTP CrushFTP Versions & vendor guidance →	Known exploitedCISA KEV	9Critical
CVE-2025-54253 Adobe Experience Manager \| Incorrect Authorization (CWE-863) Adobe Adobe Experience Manager Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-54236 Adobe Commerce \| Improper Input Validation (CWE-20) Adobe Adobe Commerce Versions & vendor guidance →	Known exploitedCISA KEV	9.1Critical
CVE-2025-5419 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google Chrome Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-54068 Livewire vulnerable to remote command execution during property update hydration livewire livewire Versions & vendor guidance →	Known exploitedCISA KEV	9.2Critical
CVE-2025-53771 Microsoft SharePoint Server Spoofing Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance →	Not in downloaded KEV	6.5Medium
CVE-2025-53770 Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) Versions & vendor guidance →	Known exploitedCISA KEV	9Critical
CVE-2025-53521 BigIP APM Vulnerability F5 BIG-IP Versions & vendor guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2025-53110 Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix modelcontextprotocol servers Versions & vendor guidance →	Not in downloaded KEV	7.3High
CVE-2025-53109 Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling modelcontextprotocol servers Versions & vendor guidance →	Not in downloaded KEV	7.3High
CVE-2025-52691 Upload Arbitrary Files SmarterTools SmarterMail Reported fix guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-5086 Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 Dassault Systèmes DELMIA Apriso Versions & vendor guidance →	Known exploitedCISA KEV	9Critical
CVE-2025-49706 Microsoft SharePoint Server Spoofing Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance →	Known exploitedCISA KEV	6.5Medium
CVE-2025-49704 Microsoft SharePoint Remote Code Execution Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019 Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Vulnerability Roundcube Webmail Versions & vendor guidance →	Known exploitedCISA KEV	9.9Critical
CVE-2025-48928 TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability TeleMessage service Versions & vendor guidance →	Known exploitedCISA KEV	4Medium
CVE-2025-48927 TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability TeleMessage service Versions & vendor guidance →	Known exploitedCISA KEV	5.3Medium

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.