RewindexCVEs
CVEs
923 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-4658 Authentication Bypass in OPKSSH
CVSS 9.8 criticalEPSS 0.34%Cloudflare
CVE-2025-3757 Authentication Bypass in OpenPubKey
CVSS 9.8 criticalEPSS 0.43%Cloudflare
CVE-2025-29813 Azure DevOps Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 1.8%Microsoft Azure
CVE-2025-29827 Azure Automation Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 1.7%Microsoft Azure
CVE-2025-29972 Azure Storage Resource Provider Spoofing Vulnerability
CVSS 9.9 criticalEPSS 3.5%Microsoft Azure
CVE-2024-6047 GeoVision EOL device - OS Command Injection
CVSS 9.8 criticalKEV added EPSS 10.1%
CVE-2024-11120 GeoVision EOL devices - OS Command Injection
CVSS 9.8 criticalKEV added EPSS 28.4%
CVE-2025-46572 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping
CVSS 9.3 criticalEPSS 0.42%Auth0
CVE-2025-25014 Kibana arbitrary code execution via prototype pollution
CVSS 9.1 criticalEPSS 22.3%Elastic Cloud
CVE-2025-3248 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
CVSS 9.8 criticalKEV added EPSS 100.0%
CVE-2025-34028 Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
CVSS 10.0 criticalKEV added EPSS 97.6%
CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path Vulnerability
CVSS 9.0 criticalKEV added EPSS 87.8%
CVE-2024-38475 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
CVSS 9.1 criticalKEV added EPSS 100.0%
CVE-2025-4144 PKCE bypass via downgrade attack
CVSS 9.8 criticalEPSS 0.57%Cloudflare
CVE-2025-30392 Azure AI Bot Elevation of Privilege Vulnerability
CVSS 9.8 criticalEPSS 1.1%Microsoft Azure
CVE-2025-30390 Azure ML Compute Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.97%Microsoft Azure
CVE-2025-31324 Missing Authorization check in SAP NetWeaver (Visual Composer development server)
CVSS 10.0 criticalKEV added EPSS 99.5%
CVE-2025-42599 Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
CVSS 9.8 criticalKEV added EPSS 3.4%
CVE-2025-31201 Apple Multiple Products Arbitrary Read and Write Vulnerability
CVSS 9.8 criticalKEV added EPSS 13.9%
CVE-2025-31200 Apple Multiple Products Memory Corruption Vulnerability
CVSS 9.8 criticalKEV added EPSS 20.9%
CVE-2025-30406 Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
CVSS 9.0 criticalKEV added EPSS 94.3%
CVE-2025-31161 CrushFTP Authentication Bypass Vulnerability
CVSS 9.8 criticalKEV added EPSS 100.0%
CVE-2025-31480 aiven-extras allows PostgreSQL Privilege Escalation through format function
CVSS 9.1 criticalEPSS 0.49%Aiven
CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
CVSS 9.0 criticalKEV added EPSS 100.0%
CVE-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVSS 10.0 criticalKEV added EPSS 99.9%
CVE-2024-20439 Cisco Smart Licensing Utility Static Credential Vulnerability
CVSS 9.8 criticalKEV added EPSS 97.1%
CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVSS 9.8 criticalKEV added EPSS 83.7%
CVE-2025-29927 Authorization Bypass in Next.js Middleware
CVSS 9.1 criticalEPSS 99.2%Vercel
CVE-2024-8019 Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning
CVSS 9.1 criticalEPSS 1.1%Lightning AI
CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection
CVSS 9.8 criticalKEV added EPSS 74.5%
CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
CVSS 10.0 criticalKEV added EPSS 3.8%
CVE-2025-27407 Remote code execution when loading a crafted GraphQL schema
CVSS 9.1 criticalEPSS 3.1%GitLab
CVE-2024-57968 Advantive VeraCore Unrestricted File Upload Vulnerability
CVSS 9.9 criticalKEV added EPSS 32.3%
CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
CVSS 9.8 criticalKEV added EPSS 89.8%
CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
CVSS 9.8 criticalKEV added EPSS 91.0%
CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
CVSS 9.8 criticalKEV added EPSS 100.0%
CVE-2025-25015 Kibana arbitrary code execution via prototype pollution
CVSS 9.9 criticalEPSS 1.3%Elastic Cloud
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVSS 9.3 criticalKEV added EPSS 1.6%
CVE-2024-4885 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 99.3%
CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
CVSS 9.0 criticalKEV added EPSS 77.3%
CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards
CVSS 9.9 criticalEPSS 0.61%Mattermost
CVE-2025-24490 SQL Injection in Mattermost Boards via board category ID reordering
CVSS 9.6 criticalEPSS 0.51%Mattermost
CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive
CVSS 9.9 criticalEPSS 24.2%Mattermost
CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability
CVSS 9.8 criticalKEV added EPSS 90.6%
CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface
CVSS 9.1 criticalKEV added EPSS 98.1%
CVE-2024-57727 SimpleHelp Path Traversal Vulnerability
CVSS 9.1 criticalKEV added EPSS 96.8%
CVE-2024-7102 Execution with Unnecessary Privileges in GitLab
CVSS 9.6 criticalEPSS 0.51%GitLab
CVE-2025-0982 Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
CVSS 10.0 criticalEPSS 0.26%Google Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)