CISA Known Exploited Vulnerabilities

This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).

CVE-2024-54085

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Vendor: AMI

Product: MegaRAC SPx

Added: 2025-06-25

Due Date: 2025-07-16

Description:

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-290

CVE-2023-0386

Linux Kernel Improper Ownership Management Vulnerability

Vendor: Linux

Product: Kernel

Added: 2025-06-17

Due Date: 2025-07-08

Description:

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-282

CVE-2023-33538

TP-Link Multiple Routers Command Injection Vulnerability

Vendor: TP-Link

Product: Multiple Routers

Added: 2025-06-16

Due Date: 2025-07-07

Description:

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-77

CVE-2025-43200

Apple Multiple Products Unspecified Vulnerability

Vendor: Apple

Product: Multiple Products

Added: 2025-06-16

Due Date: 2025-07-07

Description:

Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-33053

Microsoft Windows External Control of File Name or Path Vulnerability

Vendor: Microsoft

Product: Windows

Added: 2025-06-10

Due Date: 2025-07-01

Description:

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-73

CVE-2025-24016

Wazuh Server Deserialization of Untrusted Data Vulnerability

Vendor: Wazuh

Product: Wazuh Server

Added: 2025-06-10

Due Date: 2025-07-01

Description:

Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-502

CVE-2024-42009

RoundCube Webmail Cross-Site Scripting Vulnerability

Vendor: Roundcube

Product: Webmail

Added: 2025-06-09

Due Date: 2025-06-30

Description:

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-79

CVE-2025-32433

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Vendor: Erlang

Product: Erlang/OTP

Added: 2025-06-09

Due Date: 2025-06-30

Description:

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-306

CVE-2025-5419

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Vendor: Google

Product: Chromium V8

Added: 2025-06-05

Due Date: 2025-06-26

Description:

Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-125 CWE-787

CVE-2025-21479

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Vendor: Qualcomm

Product: Multiple Chipsets

Added: 2025-06-03

Due Date: 2025-06-24

Description:

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-863

CVE-2025-21480

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Vendor: Qualcomm

Product: Multiple Chipsets

Added: 2025-06-03

Due Date: 2025-06-24

Description:

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-863

CVE-2025-27038

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Vendor: Qualcomm

Product: Multiple Chipsets

Added: 2025-06-03

Due Date: 2025-06-24

Description:

Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-416

CVE-2021-32030

ASUS Routers Improper Authentication Vulnerability

Vendor: ASUS

Product: Routers

Added: 2025-06-02

Due Date: 2025-06-23

Description:

ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-287

CVE-2025-3935

ConnectWise ScreenConnect Improper Authentication Vulnerability

Vendor: ConnectWise

Product: ScreenConnect

Added: 2025-06-02

Due Date: 2025-06-23

Description:

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-287

CVE-2025-35939

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Vendor: Craft CMS

Product: Craft CMS

Added: 2025-06-02

Due Date: 2025-06-23

Description:

Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.

Required Action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-472