Flaws added in June 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in June 2025. For the newest, see Exploited flaws.
In June 2025, CISA added 20 flaws to its list of vulnerabilities being used in attacks, 10 of them in things people have at home; 1 has been used by ransomware gangs. Most came from Qualcomm (3), Craft CMS (2) and ASUS (2).[1]
About half let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in June 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-6543At work |
Citrix NetScaler ADC and Gateway. Attackers can corrupt memory in Citrix NetScaler ADC and Gateway, which they use to take it over. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-54085At work |
AMI MegaRAC SPx. Attackers can get into AMI MegaRAC SPx without a valid password. | At work |
CVE-2024-0769At home |
D-Link DIR-859 Router. Someone who already has a foothold can use D-Link DIR-859 Router to take full control of the machine. | At home |
CVE-2019-6693† Used in ransomwareAt work |
Fortinet FortiOS. Attackers can get into Fortinet FortiOS without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-0386At work |
Linux Kernel. Attackers are using a flaw in Linux Kernel. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-43200At home |
Apple devices. Attackers are using a flaw in Apple devices that its maker hasn't described in detail. | At home |
CVE-2023-33538At home |
TP-Link Multiple Routers. Attackers can run commands on TP-Link Multiple Routers. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-33053At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2025-24016At work |
Wazuh Server. Attackers can run their own code on Wazuh Server. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-32433At work |
Erlang/OTP. Attackers can run their own code on Erlang/OTP from anywhere, without logging in. | At work |
CVE-2024-42009At work |
Roundcube Webmail. Attackers can run code in the browser of someone using Roundcube Webmail and act as them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-5419At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-27038At home |
Qualcomm Multiple Chipsets. Attackers can corrupt memory in Qualcomm Multiple Chipsets, which they use to take it over. | At home |
CVE-2025-21480At home |
Qualcomm Multiple Chipsets. Attackers can reach parts of Qualcomm Multiple Chipsets that should be locked to them. | At home |
CVE-2025-21479At home |
Qualcomm Multiple Chipsets. Attackers can reach parts of Qualcomm Multiple Chipsets that should be locked to them. | At home |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-3935At work |
ConnectWise ScreenConnect. Attackers can run their own code on ConnectWise ScreenConnect. | At work |
CVE-2025-35939At work |
Craft CMS. Attackers are using a flaw in Craft CMS. | At work |
CVE-2024-56145At work |
Craft CMS. Attackers can run their own code on Craft CMS. | At work |
CVE-2023-39780At home |
ASUS RT-AX55 Routers. Someone who already has a way in can use ASUS RT-AX55 Routers to run their own code. | At home |
CVE-2021-32030At home |
ASUS Routers. Attackers can get into ASUS Routers without a valid password. | At home |
Companies
The flaws were in 16 companies’ products; the most were in Qualcomm’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Qualcomm | 3 | – |
| ASUS | 2 | – |
| Craft CMS | 2 | – |
| AMI | 1 | – |
| Apple | 1 | – |
| Citrix | 1 | – |
| ConnectWise | 1 | – |
| D-Link | 1 | – |
| Erlang | 1 | – |
| Fortinet | 1 | 1 |
| 1 | – | |
| Linux | 1 | – |
| Microsoft | 1 | – |
| Roundcube | 1 | – |
| TP-Link | 1 | – |
| 1 others | 1 |
Other months
Every month since CISA started the list; June 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.