2025: 245 exploited CVEs added
Every number below is computed from CISA's Known Exploited Vulnerabilities catalog and refreshed daily. That's +32% versus the same period of 2024 (186).
Adds per month
2025 against 2024. Hover a month for exact counts.
How urgent, how dangerous
Shares of the 245 entries added in 2025.
19 with ≤ 7 daysto the federal due date. Median window is 21 days.
31 ransomware-linkedCISA marks known use in ransomware campaigns.
30 old CVEsassigned 2020 or earlier, newly confirmed exploited.
Top vendors in 2025
Most KEV additions. R = ransomware-linked. Click a vendor for every entry.
Plus 87 more vendors. See all vendors.
Old bugs, new exploitation
CVEs from 2020 or earlier added in 2025. Patch backlogs matter.
| CVE | Vendor / product | Age |
|---|---|---|
| CVE-2007-0671 | Microsoft Office | 18y |
| CVE-2010-3765 | Mozilla Multiple Products | 15y |
| CVE-2010-3962 | Microsoft Internet Explorer | 15y |
| CVE-2011-3402 | Microsoft Windows | 14y |
| CVE-2013-3893 | Microsoft Internet Explorer | 12y |
| CVE-2013-3918 | Microsoft Windows | 12y |
| CVE-2014-3931 | Looking Glass Multi-Router Looking Glass (MRLG) | 11y |
| CVE-2014-6278 | GNU GNU Bash | 11y |
| CVE-2015-7755 | Juniper ScreenOS | 10y |
| CVE-2016-7836 | SKYSEA Client View | 9y |
| CVE-2016-10033 | PHP PHPMailer | 9y |
| CVE-2017-3066 | Adobe ColdFusion | 8y |
| CVE-2017-12637 | SAP NetWeaver | 8y |
| CVE-2017-1000353 | Jenkins Jenkins | 8y |
| CVE-2018-4063 | Sierra Wireless AirLink ALEOS | 7y |
Showing the 15 oldest of 30.
Only see the ones that hit your stack.
Pick your vendors. Get a free weekly digest of new KEV entries for just those.
Method: counts use the catalog's dateAdded; "same period" is Jan 1 – 2024-12-31. Due window = dueDate − dateAdded. Data: CISA Known Exploited Vulnerabilities Catalog (CC0). KEV Watch is not affiliated with or endorsed by CISA. Also available as an RSS feed.