CISA Adds 5 New Vulnerabilities To KEV Catalog For 2025

CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog affecting Advantive VeraCore (SQL injection CVE-2025-25181 and unrestricted file upload CVE-2024-57968) and Ivanti Endpoint Manager (three absolute path traversal vulnerabilities CVE-2024-13159/13160/13161). Several issues are rated critical (CVSS 9.8–9.9); CISA urges immediate patching, monitoring for suspicious activity, stricter access controls, and use of intrusion detection/prevention to mitigate exploitation risk.