Exploited vulnerabilities (CISA KEV)

CVE-2025-62593 High · 8.8 KEV High · 69 Public exploit CWE-94 Nov 26, 2025

Ray-Project Ray Code Injection Vulnerability

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

CVE-2025-58360 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-611 Nov 25, 2025

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.

CVE-2025-58034 High · 7.2 KEV High · 68 Public exploit CWE-78 Nov 18, 2025

Fortinet FortiWeb OS Command Injection Vulnerability

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

CVE-2025-13223 High · 8.8 KEV High · 55 CWE-843 Nov 17, 2025

Google Chromium V8 Type Confusion Vulnerability

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-64446 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-23 Nov 14, 2025

Fortinet FortiWeb Path Traversal Vulnerability

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CVE-2025-62215 High · 7.0 KEV High · 69 Public exploit CWE-362 Nov 11, 2025

Microsoft Windows Race Condition Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-60710 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-59 Nov 11, 2025

Microsoft Windows Link Following Vulnerability

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

CVE-2025-12480 Critical · 9.1 KEV High · 67 Public exploit CWE-284 Nov 10, 2025

Gladinet Triofox Improper Access Control Vulnerability

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

CVE-2025-64328 High · 7.2 KEV Urgent · 76 Public exploit CWE-78 Nov 7, 2025

Sangoma FreePBX OS Command Injection Vulnerability

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

CVE-2023-43000 High · 8.8 KEV High · 55 CWE-416 Nov 5, 2025

Apple Multiple products Use-After-Free Vulnerability

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

CVE-2025-11953 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-78 Nov 3, 2025

React Native Community CLI OS Command Injection Vulnerability

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.