Exploited vulnerabilities (CISA KEV)

CVE-2025-24085 Critical · 10.0 KEV Urgent · 77 Public exploit CWE-416 Jan 27, 2025

Apple Multiple Products Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

CVE-2025-0411 High · 7.0 KEV High · 62 Public exploit CWE-693 Jan 25, 2025

7-Zip Mark of the Web Bypass Vulnerability

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

CVE-2025-23006 Critical · 9.8 KEV Urgent · 73 Ransomware CWE-502 Jan 23, 2025

SonicWall SMA1000 Appliances Deserialization Vulnerability

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

CVE-2025-23209 High · 8.1 KEV High · 56 CWE-94 Jan 17, 2025

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CVE-2024-57727 High · 7.5 KEV Urgent · 89 Public exploit Ransomware CWE-22 Jan 15, 2025

SimpleHelp Path Traversal Vulnerability

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

CVE-2024-57726 Critical · 9.9 KEV Urgent · 74 Public exploit Ransomware CWE-862 Jan 15, 2025

SimpleHelp Missing Authorization Vulnerability

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

CVE-2024-57728 High · 7.2 KEV Urgent · 70 Public exploit Ransomware CWE-59 Jan 15, 2025

SimpleHelp Path Traversal Vulnerability

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

CVE-2025-21333 High · 7.8 KEV High · 69 Public exploit CWE-122 Jan 14, 2025

Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

CVE-2025-21334 High · 7.8 KEV High · 52 CWE-416 Jan 14, 2025

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

CVE-2025-21335 High · 7.8 KEV High · 52 CWE-416 Jan 14, 2025

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

CVE-2024-13159 High · 7.5 KEV High · 69 Public exploit CWE-36 Jan 14, 2025

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

CVE-2024-13160 High · 7.5 KEV High · 63 Public exploit CWE-36 Jan 14, 2025

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

CVE-2024-13161 High · 7.5 KEV High · 63 Public exploit CWE-36 Jan 14, 2025

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

CVE-2024-55591 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-288 Jan 14, 2025

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

CVE-2024-53704 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Jan 9, 2025

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

CVE-2025-0282 Critical · 9.0 KEV Urgent · 88 Public exploit Ransomware CWE-787 Jan 8, 2025

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

CVE-2024-50603 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-78 Jan 7, 2025

Aviatrix Controllers OS Command Injection Vulnerability

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.