Skip to content

Patch first Vendors Added Changes Method

Home
Added
September 2025

CISA's list that month

September 2025

In September 2025 CISA added 16 vulnerabilities to its list of exploited vulnerabilities, on 7 days.

2 September 2025

2 added

CVE-2020-24363
CVE-2025-55177

3 September 2025

2 added

CVE-2023-50224
CVE-2025-9377

4 September 2025

3 added

CVE-2025-38352
CVE-2025-48543
CVE-2025-53690

11 September 2025

1 added

CVE-2025-5086

23 September 2025

1 added

CVE-2025-10585

25 September 2025

2 added

CVE-2025-20333
CVE-2025-20362

29 September 2025

5 added

CVE-2021-21311
CVE-2025-10035
CVE-2025-20352
CVE-2025-32463
CVE-2025-59689

30 September 2025

1 change

← August 2025Every monthOctober 2025 →

Sources and licence

CISA Known Exploited Vulnerabilities catalog. Not affiliated with or endorsed by CISA (source). Licence: CC0 1.0 Universal

Our text and compilation: CC BY 4.0. How to reuse and cite this page.

On this site

Patch first
Used in ransomware
Exploited, low EPSS
Likely next
Vendors
Added by day
Changes
Statistics
Federal deadlines
Methodology
Sources
About
Corrections
Privacy
Licence and reuse

Every vulnerability CISA lists as exploited, ranked by what to patch first with an open method, with EPSS scores, public exploits, US federal deadlines and the changes CISA's list does not keep.

whattopatch is independent and not affiliated with or endorsed by CISA, FIRST or MITRE. Our patch-first rank is our own reading of public data, not advice for your systems.

Corrections and questions: hello@whattopatch.com