By publication date
Exploited and new serious CVEs: March 2025
209 records · 26 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 3 of 3
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2025-2292Weaponized | Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosurexorcom · completepbx · CWE-22 | Medium6.5 | — | 1.7% | Mar 31, 2025 |
40Plan | CVE-2025-30004Weaponized | Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injectionxorcom · completepbx · CWE-78 | High8.8 | — | 4.3% | Mar 31, 2025 |
40Plan | CVE-2025-30005Weaponized | Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletionxorcom · completepbx · CWE-22 | High8.3 | — | 1.8% | Mar 31, 2025 |
82Now | CVE-2025-31125Weaponized | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryvitejs · vite · CWE-200 | High7.5 | KEV | 74.9% | Mar 31, 2025 |
35Monitor | CVE-2025-31129Proof of concept | jooby-pac4j: deserialization of untrusted datajooby-project · jooby · CWE-502 | High8.8 | — | 0.6% | Mar 31, 2025 |
20Monitor | CVE-2025-24203Proof of concept | The issue was addressed with improved checks.apple · ipad os | Medium5.0 | — | 0.6% | Mar 31, 2025 |
40Plan | CVE-2025-24204Proof of concept | The issue was addressed with improved checks.apple · macos · CWE-200 | Critical9.8 | — | 2.2% | Mar 31, 2025 |
28Monitor | CVE-2025-24257Proof of concept | An out-of-bounds write issue was addressed with improved input validation.apple · ipados · CWE-787 | High7.1 | — | 0.3% | Mar 31, 2025 |
31Monitor | CVE-2025-30456Proof of concept | A parsing issue in the handling of directory paths was addressed with improved path validation.apple · ipados · CWE-281 | High7.8 | — | 0.9% | Mar 31, 2025 |
- CVE-2025-229240Plan
Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure
MediumCVSS 6.5WeaponizedEPSS 1%xorcom · completepbxMar 31, 2025
- CVE-2025-3000440Plan
Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection
HighCVSS 8.8WeaponizedEPSS 4%xorcom · completepbxMar 31, 2025
- CVE-2025-3000540Plan
Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion
HighCVSS 8.3WeaponizedEPSS 1%xorcom · completepbxMar 31, 2025
- CVE-2025-3112582Now
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
HighCVSS 7.5KEVWeaponizedEPSS 74%vitejs · viteMar 31, 2025
- CVE-2025-3112935Monitor
jooby-pac4j: deserialization of untrusted data
HighCVSS 8.8Proof of conceptEPSS 0%jooby-project · joobyMar 31, 2025
- CVE-2025-2420320Monitor
The issue was addressed with improved checks.
MediumCVSS 5.0Proof of conceptEPSS 0%apple · ipad osMar 31, 2025
- CVE-2025-2420440Plan
The issue was addressed with improved checks.
CriticalCVSS 9.8Proof of conceptEPSS 2%apple · macosMar 31, 2025
- CVE-2025-2425728Monitor
An out-of-bounds write issue was addressed with improved input validation.
HighCVSS 7.1Proof of conceptEPSS 0%apple · ipadosMar 31, 2025
- CVE-2025-3045631Monitor
A parsing issue in the handling of directory paths was addressed with improved path validation.
HighCVSS 7.8Proof of conceptEPSS 0%apple · ipadosMar 31, 2025