Skip to content

Patch first Vendors Added Changes Method

Home
Added
May 2025

CISA's list that month

May 2025

In May 2025 CISA added 25 vulnerabilities to its list of exploited vulnerabilities, on 11 days.

1 May 2025

2 added

CVE-2023-44221
CVE-2024-38475

2 May 2025

2 added

CVE-2024-58136
CVE-2025-34028

5 May 2025

1 added

CVE-2025-3248

6 May 2025

1 added

CVE-2025-27363

7 May 2025

2 added

CVE-2024-6047
CVE-2024-11120

12 May 2025

1 added

CVE-2025-47729

13 May 2025

5 added

CVE-2025-30397
CVE-2025-30400
CVE-2025-32701
CVE-2025-32706
CVE-2025-32709

14 May 2025

1 added

CVE-2025-32756

15 May 2025

3 added

CVE-2024-12987
CVE-2025-4664
CVE-2025-42999

19 May 2025

6 added

CVE-2023-38950
CVE-2024-11182
CVE-2024-27443
CVE-2025-4427
CVE-2025-4428
CVE-2025-27920

22 May 2025

1 added

CVE-2025-4632

← April 2025Every monthJune 2025 →

Sources and licence

CISA Known Exploited Vulnerabilities catalog. Not affiliated with or endorsed by CISA (source). Licence: CC0 1.0 Universal

Our text and compilation: CC BY 4.0. How to reuse and cite this page.

On this site

Patch first
Used in ransomware
Exploited, low EPSS
Likely next
Vendors
Added by day
Changes
Statistics
Federal deadlines
Methodology
Sources
About
Corrections
Privacy
Licence and reuse

Every vulnerability CISA lists as exploited, ranked by what to patch first with an open method, with EPSS scores, public exploits, US federal deadlines and the changes CISA's list does not keep.

whattopatch is independent and not affiliated with or endorsed by CISA, FIRST or MITRE. Our patch-first rank is our own reading of public data, not advice for your systems.

Corrections and questions: hello@whattopatch.com