{
  "title": "CISA Catalog of Known Exploited Vulnerabilities",
  "catalogVersion": "2025.10.09",
  "dateReleased": "2025-10-09T16:52:28.6547Z",
  "count": 2,
  "vulnerabilities": [
    {
      "cveID": "CVE-2021-43798",
      "vendorProject": "Grafana Labs",
      "product": "Grafana",
      "vulnerabilityName": "Grafana Path Traversal Vulnerability",
      "dateAdded": "2025-10-09",
      "shortDescription": "Grafana contains a path traversal vulnerability that could allow access to local files.",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "dueDate": "2025-10-30",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://grafana.com/security/advisory; https://nvd.nist.gov/vuln/detail/CVE-2021-43798",
      "cwes": [
        "CWE-22"
      ]
    },
    {
      "cveID": "CVE-2024-12345",
      "vendorProject": "Acme Corp",
      "product": "Acme Widget",
      "vulnerabilityName": "Acme Widget Buffer Overflow",
      "dateAdded": "2025-08-01",
      "shortDescription": "Acme Widget contains a buffer overflow that may allow remote code execution.",
      "requiredAction": "Apply vendor patch KB-1234.",
      "knownRansomwareCampaignUse": "Confirmed",
      "notes": "https://acme.example/advisories/KB-1234 https://nvd.nist.gov/vuln/detail/CVE-2024-12345 additional context ignored",
      "cwes": [
        "CWE-120",
        "CWE-787"
      ]
    }
  ]
}
