CVE-2025-48633 — Android Framework Information Disclosure Vulnerability
Android Framework contains an unspecified vulnerability that allows for information disclosure.
Framework · Dec 2, 2025
CISA Known Exploited Vulnerabilities Directory
Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2025-48633 — Android Framework Information Disclosure Vulnerability
Android Framework contains an unspecified vulnerability that allows for information disclosure.
|
Android | Framework | Dec 2, 2025 | Dec 23, 2025 | |
|
CVE-2021-26829 — OpenPLC ScadaBR Cross-site Scripting Vulnerability
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
|
OpenPLC | ScadaBR | Nov 28, 2025 | Dec 19, 2025 | |
|
CVE-2025-61757 — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
|
Oracle | Fusion Middleware | Nov 21, 2025 | Dec 12, 2025 | |
|
CVE-2025-13223 — Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
|
Chromium V8 | Nov 19, 2025 | Dec 10, 2025 | ||
|
CVE-2025-58034 — Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
|
Fortinet | FortiWeb | Nov 18, 2025 | Nov 25, 2025 | |
|
CVE-2025-64446 — Fortinet FortiWeb Path Traversal Vulnerability
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
|
Fortinet | FortiWeb | Nov 14, 2025 | Nov 21, 2025 | |
|
CVE-2025-12480 — Gladinet Triofox Improper Access Control Vulnerability
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
|
Gladinet | Triofox | Nov 12, 2025 | Dec 3, 2025 | |
|
CVE-2025-62215 — Microsoft Windows Race Condition Vulnerability
Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
|
Microsoft | Windows | Nov 12, 2025 | Dec 3, 2025 | |
|
CVE-2025-9242 — WatchGuard Firebox Out-of-Bounds Write Vulnerability
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
|
WatchGuard | Firebox | Nov 12, 2025 | Dec 3, 2025 | |
|
CVE-2025-21042 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
|
Samsung | Mobile Devices | Nov 10, 2025 | Dec 1, 2025 |
CVE-2021-26829 — OpenPLC ScadaBR Cross-site Scripting Vulnerability
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
ScadaBR · Nov 28, 2025
CVE-2025-61757 — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
Fusion Middleware · Nov 21, 2025
CVE-2025-13223 — Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
Chromium V8 · Nov 19, 2025
CVE-2025-58034 — Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
FortiWeb · Nov 18, 2025
CVE-2025-64446 — Fortinet FortiWeb Path Traversal Vulnerability
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
FortiWeb · Nov 14, 2025
CVE-2025-12480 — Gladinet Triofox Improper Access Control Vulnerability
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
Triofox · Nov 12, 2025
CVE-2025-62215 — Microsoft Windows Race Condition Vulnerability
Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
Windows · Nov 12, 2025
CVE-2025-9242 — WatchGuard Firebox Out-of-Bounds Write Vulnerability
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
Firebox · Nov 12, 2025
CVE-2025-21042 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
Mobile Devices · Nov 10, 2025