Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-24984 |
🚨 Marked as known exploited on March 11th, 2025 (about 1 month ago).
Description: Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
CVSS: MEDIUM (4.6) EPSS Score: 19.24% SSVC Exploitation: active
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-24055 |
Description: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.
CVSS: MEDIUM (4.3) EPSS Score: 0.05%
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-24054 |
🚨 Marked as known exploited on April 17th, 2025 (2 days ago).
Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVSS: MEDIUM (6.5) EPSS Score: 0.12%
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-21247 |
Description: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
CVSS: MEDIUM (4.3) EPSS Score: 0.1%
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-21199 |
Description: Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
CVSS: MEDIUM (6.7) EPSS Score: 0.04%
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-24984 |
Description: Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an authorized attacker to disclose information locally. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
CVSS: MEDIUM (4.6) EPSS Score: 19.24%
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-24991 |
Description: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that could allow for information disclosure.
CVSS: MEDIUM (5.5) EPSS Score: 2.97%
March 11th, 2025 (about 1 month ago)
|
|
CVE-2025-26643 |
Description: No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVSS: MEDIUM (5.4) EPSS Score: 0.07% SSVC Exploitation: none
March 7th, 2025 (about 1 month ago)
|
|
CVE-2023-20118 |
Description: CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
CVE-2023-20118 Cisco Small Business RV Series Routers Command Injection Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
CVE-2024-4885 Progress WhatsUp Gold Path Traversal Vulnerability
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the cata...
CVSS: MEDIUM (6.5)
March 3rd, 2025 (about 2 months ago)
|
|
CVE-2025-1488 |
Description: The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured.
CVSS: MEDIUM (4.7) EPSS Score: 0.02%
February 24th, 2025 (about 2 months ago)
|