CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1–4 of 4 records

CVE Vendor Product Added Due Status
CVE-2025-32432 — Craft CMS Code Injection Vulnerability
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
 Craft CMS Craft CMS Mar 20, 2026 Apr 3, 2026
CVE-2024-56145 — Craft CMS Code Injection Vulnerability
Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.
 Craft CMS Craft CMS Jun 2, 2025 Jun 23, 2025
CVE-2025-35939 — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
 Craft CMS Craft CMS Jun 2, 2025 Jun 23, 2025
CVE-2025-23209 — Craft CMS Code Injection Vulnerability
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
 Craft CMS Craft CMS Feb 20, 2025 Mar 13, 2025