CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2025-31201Apple Multiple Products Arbitrary Read and Write Vulnerability Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-31200Apple Multiple Products Memory Corruption Vulnerability Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-31161CrushFTP Authentication Bypass Vulnerability CrushFTP CrushFTP Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query vitejs vite Versions & vendor guidance → |
Known exploitedCISA KEV | 5.3Medium |
| CVE-2025-30406Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability Gladinet CentreStack Versions & vendor guidance → |
Known exploitedCISA KEV | 9Critical |
| CVE-2025-30400Microsoft DWM Core Library Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-30397Scripting Engine Memory Corruption Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2025-30154Multiple Reviewdog actions were compromised during a specific time period reviewdog reviewdog Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2025-30066tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability tj-actions changed-files Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-29635D-Link DIR-823X Command Injection Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 7.2High |
| CVE-2025-27920Srimax Output Messenger Directory Traversal Vulnerability Srimax Output Messenger Versions & vendor guidance → |
Known exploitedCISA KEV | 7.2High |
| CVE-2025-27915Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 5.4Medium |
| CVE-2025-2783Google Chromium Mojo Sandbox Escape Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.3High |
| CVE-2025-2776SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection SysAid SysAid On-Prem Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-2775SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection SysAid SysAid On-Prem Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-2749Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE Kentico Xperience Versions & vendor guidance → |
Known exploitedCISA KEV | 7.2High |
| CVE-2025-2747Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass Kentico Xperience Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-2746Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass Kentico Xperience Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-27363FreeType Out-of-Bounds Write Vulnerability FreeType FreeType Versions & vendor guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2025-27038Use After Free in Graphics Qualcomm, Inc. Snapdragon Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2025-26633Microsoft Management Console Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7High |
| CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability SolarWinds Web Help Desk Reported fix guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability Fortinet FortiWeb Reported fix guidance → |
Known exploitedCISA KEV | 9.6Critical |
| CVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Fortinet FortiSwitchManager, Fortinet FortiOS Reported fix guidance → |
Known exploitedCISA KEV | 7.4High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.