Update KEV: Thu Jun 26 00:13:16 UTC 2025

Signed-off-by: AboutCode Automation <[email protected]>

Author: aboutcode-automation

known_exploited_vulnerabilities.json

@@ -1,9 +1,54 @@
 {
     "title": "CISA Catalog of Known Exploited Vulnerabilities",
-    "catalogVersion": "2025.06.20",
-    "dateReleased": "2025-06-20T15:54:44.9005Z",
-    "count": 1367,
+    "catalogVersion": "2025.06.25",
+    "dateReleased": "2025-06-25T16:52:26.9744Z",
+    "count": 1370,
     "vulnerabilities": [
+        {
+            "cveID": "CVE-2019-6693",
+            "vendorProject": "Fortinet",
+            "product": "FortiOS",
+            "vulnerabilityName": "Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability",
+            "dateAdded": "2025-06-25",
+            "shortDescription": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. ",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-07-16",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/fortiguard.com\/advisory\/FG-IR-19-007 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-6693",
+            "cwes": [
+                "CWE-798"
+            ]
+        },
+        {
+            "cveID": "CVE-2024-0769",
+            "vendorProject": "D-Link",
+            "product": "DIR-859 Router",
+            "vulnerabilityName": " D-Link DIR-859 Router Path Traversal Vulnerability",
+            "dateAdded": "2025-06-25",
+            "shortDescription": "D-Link DIR-859 routers contain a path traversal vulnerability in the file \/hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ..\/..\/..\/..\/htdocs\/webinc\/getcfg\/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-07-16",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/supportannouncement.us.dlink.com\/announcement\/publication.aspx?name=SAP10371 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-0769",
+            "cwes": [
+                "CWE-22"
+            ]
+        },
+        {
+            "cveID": "CVE-2024-54085",
+            "vendorProject": "AMI",
+            "product": "MegaRAC SPx",
+            "vulnerabilityName": "AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability",
+            "dateAdded": "2025-06-25",
+            "shortDescription": "AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and\/or availability.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-07-16",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https:\/\/go.ami.com\/hubfs\/Security%20Advisories\/2025\/AMI-SA-2025003.pdf ; https:\/\/security.netapp.com\/advisory\/ntap-20250328-0003\/ ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-54085",
+            "cwes": [
+                "CWE-290"
+            ]
+        },
         {
             "cveID": "CVE-2023-0386",
             "vendorProject": "Linux",