CISA Known Exploited Vulnerabilities
KEV additions — March 2025
31 CVEs entered the KEV catalog in March 2025.
Added March 31, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-20439 | Cisco Smart Licensing Utility Static Credential Vulnerability | 9.8 | 85.8 % | April 21, 2025 |
Added March 27, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-2783 | Google Chromium Mojo Sandbox Escape Vulnerability | 8.3 | 41.6 % | April 17, 2025 |
Added March 26, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-9874 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 9.8 | 78.9 % | April 16, 2025 |
| CVE-2019-9875 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 8.8 | 24.8 % | April 16, 2025 |
Added March 24, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-30154 | reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability | 8.6 | 15.4 % | April 14, 2025 |
Added March 19, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-48248 | NAKIVO Backup and Replication Absolute Path Traversal Vulnerability | 8.6 | 94.0 % | April 9, 2025 |
| CVE-2025-1316 | Edimax IC-7100 IP Camera OS Command Injection Vulnerability | 9.8 | 84.9 % | April 9, 2025 |
Added March 18, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24472ransomware | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | 8.1 | 1.7 % | April 8, 2025 |
| CVE-2025-30066 | tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability | 8.6 | 86.6 % | April 8, 2025 |
Added March 13, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-21590 | Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability | 4.4 | 0.9 % | April 3, 2025 |
| CVE-2025-24201 | Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability | 10 | 0.1 % | April 3, 2025 |
Added March 11, 20256
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-24983 | Microsoft Windows Win32k Use-After-Free Vulnerability | 7 | 0.7 % | April 1, 2025 |
| CVE-2025-24984 | Microsoft Windows NTFS Information Disclosure Vulnerability | 4.6 | 5.0 % | April 1, 2025 |
| CVE-2025-24985 | Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability | 7.8 | 0.9 % | April 1, 2025 |
| CVE-2025-24991 | Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability | 5.5 | 0.7 % | April 1, 2025 |
| CVE-2025-24993 | Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | 7.8 | 1.5 % | April 1, 2025 |
| CVE-2025-26633ransomware | Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability | 7 | 7.8 % | April 1, 2025 |
Added March 10, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 7.5 | 94.0 % | March 31, 2025 |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 7.5 | 93.0 % | March 31, 2025 |
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 7.5 | 91.6 % | March 31, 2025 |
| CVE-2024-57968 | Advantive VeraCore Unrestricted File Upload Vulnerability | 8.8 | 25.1 % | March 31, 2025 |
| CVE-2025-25181 | Advantive VeraCore SQL Injection Vulnerability | 7.5 | 79.7 % | March 31, 2025 |
Added March 4, 20254
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-50302 | Linux Kernel Use of Uninitialized Resource Vulnerability | 5.5 | 1.4 % | March 25, 2025 |
| CVE-2025-22224 | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 8.2 | 60.0 % | March 25, 2025 |
| CVE-2025-22225 | VMware ESXi Arbitrary Write Vulnerability | 8.2 | 6.0 % | March 25, 2025 |
| CVE-2025-22226 | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 6 | 6.7 % | March 25, 2025 |
Added March 3, 20255
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-8639ransomware | Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability | 7.8 | 31.9 % | March 24, 2025 |
| CVE-2022-43769 | Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability | 7.2 | 94.0 % | March 24, 2025 |
| CVE-2022-43939 | Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability | 9.8 | 93.4 % | March 24, 2025 |
| CVE-2023-20118 | Cisco Small Business RV Series Routers Command Injection Vulnerability | 7.2 | 3.4 % | March 24, 2025 |
| CVE-2024-4885 | Progress WhatsUp Gold Path Traversal Vulnerability | 9.8 | 94.3 % | March 24, 2025 |