RewindexCVEs
CVEs
923 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability
CVSS 9.0 criticalKEV added EPSS 60.6%
CVE-2025-57819 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
CVSS 9.8 criticalKEV added EPSS 95.0%
CVE-2025-7775 Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
CVSS 9.8 criticalKEV added EPSS 20.3%
CVE-2025-9118 Dataform Path Traversal
CVSS 10.0 criticalEPSS 0.68%Google Cloud
CVSS 9.3 criticalEPSS 0.21%SalesforceTableau
CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
CVSS 10.0 criticalKEV added EPSS 65.2%
CVE-2025-9288 Missing type checks leading to hash rewind and passing on crafted data
CVSS 9.1 criticalEPSS 0.74%Jira
CVE-2025-9287 Missing type checks leading to hash rewind and passing on crafted data
CVSS 9.1 criticalEPSS 0.55%Jira
CVE-2025-9074 Docker Desktop allows unauthenticated access to Docker Engine API from containers
CVSS 9.3 criticalEPSS 1.9%Docker
CVE-2025-55283 aiven-db-migrate allows Privilege Escalation through use of psql during migration
CVSS 9.1 criticalEPSS 0.62%Aiven
CVE-2025-55282 aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration
CVSS 9.1 criticalEPSS 0.72%Aiven
CVE-2025-54948 Trend Micro Apex One OS Command Injection Vulnerability
CVSS 9.4 criticalKEV added EPSS 23.9%
CVE-2025-49457 Zoom Clients for Windows - Untrusted Search Path
CVSS 9.6 criticalEPSS 0.62%Zoom
CVE-2025-53767 Azure OpenAI Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 1.1%Microsoft Azure
CVE-2025-53792 Azure Portal Elevation of Privilege Vulnerability
CVSS 9.1 criticalEPSS 0.82%Microsoft Azure
CVE-2025-54982 SAML 2.0 Public Key Validation Issue
CVSS 9.6 criticalEPSS 0.40%Zscaler
CVE-2025-54133 Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog
CVSS 9.6 criticalEPSS 0.41%Cursor
CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse
CVSS 9.1 criticalEPSS 0.95%HashiCorp
CVE-2025-20337 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
CVSS 10.0 criticalKEV added EPSS 74.5%
CVE-2025-20281 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
CVSS 10.0 criticalKEV added EPSS 97.6%
CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
CVSS 9.0 criticalKEV added EPSS 93.5%
CVE-2025-2776 SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
CVSS 9.3 criticalKEV added EPSS 64.7%
CVE-2025-2775 SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
CVSS 9.3 criticalKEV added EPSS 42.6%
CVE-2025-53770 Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 100.0%
CVE-2025-47158 Azure DevOps Server Elevation of Privilege Vulnerability
CVSS 9.0 criticalEPSS 0.83%Microsoft Azure
CVE-2025-49746 Azure Machine Learning Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.87%Microsoft Azure
CVE-2025-49747 Azure Machine Learning Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.81%Microsoft Azure
CVE-2025-25257 Fortinet FortiWeb SQL Injection Vulnerability
CVSS 9.6 criticalKEV added EPSS 99.9%
CVE-2025-47812 Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
CVSS 10.0 criticalKEV added EPSS 93.9%
CVE-2016-10033 PHPMailer Command Injection Vulnerability
CVSS 9.8 criticalKEV added EPSS 99.7%
CVE-2014-3931 Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability
CVSS 9.8 criticalKEV added EPSS 29.0%
CVE-2025-34072 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling
CVSS 9.3 criticalEPSS 0.43%Anthropic
CVE-2025-6543 Memory overflow vulnerability leading to unintended control flow and Denial of Service
CVSS 9.8 criticalKEV added EPSS 10.4%
CVE-2024-54085 Redfish Authentication Bypass
CVSS 9.8 criticalKEV added EPSS 60.7%
CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
CVSS 9.9 criticalEPSS 1.0%Mattermost
CVE-2025-52467 pgai secrets exfiltration via `pull_request_target`
CVSS 9.1 criticalEPSS 0.40%Timescale (Tiger Data)
CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint
CVSS 9.1 criticalEPSS 0.97%Cloudflare
CVSS 9.1 criticalEPSS 0.49%Salesforce
CVE-2025-24016 Remote code execution in Wazuh server
CVSS 9.9 criticalKEV added EPSS 93.8%
CVE-2025-32433 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
CVSS 10.0 criticalKEV added EPSS 98.9%
CVE-2024-42009 RoundCube Webmail Cross-Site Scripting Vulnerability
CVSS 9.3 criticalKEV added EPSS 82.9%
CVE-2025-48951 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CVSS 9.3 criticalEPSS 0.75%Auth0
CVE-2024-56145 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
CVSS 9.8 criticalKEV added EPSS 97.4%
CVE-2021-32030 ASUS Routers Improper Authentication Vulnerability
CVSS 9.8 criticalKEV added EPSS 99.4%
CVE-2025-4632 Samsung MagicINFO 9 Server Path Traversal Vulnerability
CVSS 9.8 criticalKEV added EPSS 24.1%
CVE-2025-47275 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
CVSS 9.1 criticalEPSS 0.54%Auth0
CVE-2025-42999 Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
CVSS 9.1 criticalKEV added EPSS 12.9%
CVE-2025-32756 Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
CVSS 9.6 criticalKEV added EPSS 30.9%
CVE-2025-30387 Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability
CVSS 9.8 criticalEPSS 1.2%Microsoft Azure
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)