CISA's list that day

9 June 2025

On CISA added 2 vulnerabilities to its list of exploited vulnerabilities, in Roundcube Webmail and Erlang/OTP. US federal agencies must fix them by .

Added that day

Added that day
VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2025-32433SSH Server Missing Authentication for Critical FunctionErlang Erlang/OTPPatch this weekMetasploit module; EPSS 0.990.99
CVE-2024-42009Cross-Site ScriptingRoundcube WebmailPatch this weekEPSS 0.830.83

Other changes that day

  1. CVE-2012-1710 Oracle Fusion MiddlewareRansomware use: Unknown to Known.
  2. CVE-2012-4681 Oracle Java SERansomware use: Unknown to Known.
  3. CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)Ransomware use: Unknown to Known.
  4. CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS)Ransomware use: Unknown to Known.
  5. CVE-2022-30333 RARLAB UnRARRansomware use: Unknown to Known.
  6. CVE-2023-43208 NextGen Healthcare Mirth ConnectRansomware use: Unknown to Known.
  7. CVE-2024-21762 Fortinet FortiOSRansomware use: Unknown to Known.
  8. CVE-2024-57727 SimpleHelpRansomware use: Unknown to Known.
  9. CVE-2025-4428 Ivanti Endpoint Manager Mobile (EPMM)Edited: description.
  10. CVE-2025-4664 Google ChromiumRemoved from CISA's list.