CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries

The SecurityWeek report notes that the CISA Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, topping 1,484 exploitable software and hardware flaws. Throughout 2025, 245 security defects were added to the KEV list, including 24 bugs exploited in ransomware attacks, with the oldest addition in 2007 (CVE-2007-0671) described as a remote code execution issue in Microsoft Office.

Of the 24 vulnerabilities exploited by ransomware groups, CitrixBleed 2 (CVE-2025-5777) and Oracle E-Business Suite (CVE-2025-61882 and CVE-2025-61884) are highlighted for their broad impact. The article notes that most new entries were fresh vulnerabilities, while 94 flaws disclosed in 2024 or earlier were also added in 2025, according to Cyble.

The piece, published on 5 January 2026, emphasises that federal agencies, organisations of all sizes, and software developers should monitor the KEV list to understand the prevalent weaknesses threat actors are targeting. According to Cyble, OS command injection, deserialization of untrusted data, path traversal, and other flaw types dominated the 2025 additions.