The 10 Most Exploited Open Source Vulnerabilities of 2025

The difference between a theoretical vulnerability and an actively exploited one is the difference between future risk and present danger. A high CVSS score means a vulnerability could be dangerous. Active exploitation means attackers are already using it.

That is why security teams should pay special attention to the most exploited vulnerabilities 2025 list. These are not just CVEs sitting in a database. They are vulnerabilities that appeared in real-world exploitation reports, CISA Known Exploited Vulnerabilities entries, vendor advisories, and security research publications.

This list focuses on open source software, frameworks, libraries, and widely used software components that affected developers, DevOps teams, SaaS platforms, CMS operators, AI app builders, and infrastructure teams in 2025.

Important: CISA KEV confirms known exploitation, but it does not publish a public ranking by exploitation volume. This article is a practical prioritization guide based on KEV status, real-world exploitation reporting, severity, popularity, and remediation urgency.

Why Active Exploitation Changes Everything

Most vulnerability backlogs are too large to fix all at once. Teams may have hundreds of medium and high findings across applications, containers, operating systems, and dependencies. If everything is urgent, nothing is urgent.

Active exploitation changes the priority model. If a CVE is being used in real attacks, it should move above theoretical findings, even if another vulnerability has a higher CVSS score. Attackers do not prioritize based on your scanner dashboard. They prioritize based on reachable systems, available exploits, and business value.

For open source dependencies, active exploitation is especially dangerous because the same vulnerable package may appear across thousands of applications. A single vulnerable framework, CMS, runtime library, or build tool can become an internet-wide target within hours of proof-of-concept publication.

How We Selected This List

To build this most exploited vulnerabilities 2025 shortlist, we prioritized vulnerabilities that met one or more of these conditions:

• Listed in the CISA Known Exploited Vulnerabilities catalog.
• Confirmed by vendor or reputable research teams as exploited in the wild.
• Affected widely used open source software, developer tooling, frameworks, or web platforms.
• Had public proof-of-concept exploit activity or mass scanning.
• Had clear remediation guidance and fixed versions.

Where public data does not provide a reliable number of affected applications, the “Estimated still affected” field uses a conservative exposure label instead of inventing a number.

The 10 Most Exploited Vulnerabilities

1. CVE-2025-24813: Apache Tomcat Path Equivalence — Apache Tomcat

Apache Tomcat is one of the most widely deployed Java web servers. CVE-2025-24813 involves path equivalence behavior around partial PUT requests and can lead to remote code execution, information disclosure, or malicious content injection under vulnerable configurations.

Attackers targeted exposed Tomcat instances because the vulnerable component is common in enterprise Java stacks. The fix is to upgrade Tomcat immediately and check container images, embedded application servers, vendor appliances, and legacy WAR deployments.

<!-- Maven users should verify the Tomcat version resolved by Spring Boot or embedded containers -->

mvn dependency:tree | grep tomcat

Still dangerous: Tomcat often appears inside container images and vendor products, so patching only the system package may miss embedded copies.

2. CVE-2025-29927: Middleware Authorization Bypass — Next.js

CVE-2025-29927 affects Next.js middleware authorization logic. Attackers can bypass middleware-based authorization checks by sending crafted requests with the x-middleware-subrequest header.

This issue was dangerous because many applications used middleware to protect private routes, admin pages, dashboards, and API paths. If middleware was the only authorization layer, attackers could potentially reach sensitive routes without proper access.

npm install next@latest

If immediate upgrading is not possible, block external requests that include the x-middleware-subrequest header before they reach your application.

3. CVE-2025-55182: React2Shell RCE — React Server Components

React2Shell was one of the most urgent JavaScript ecosystem vulnerabilities of 2025. It affected server-side React Server Components and could allow unauthenticated remote code execution when vulnerable packages processed attacker-controlled requests.

Because React Server Components are used through frameworks such as Next.js, many teams had to check framework versions, React package versions, deployment models, and server-side routing behavior. Attackers quickly moved from proof-of-concept testing to real exploitation, including cryptomining and malware deployment.

npm install react@19.2.1 react-dom@19.2.1

Patch immediately: React2Shell is pre-authentication RCE. If server-side React packages are exposed, treat this as emergency work.

4. CVE-2025-3248: Unauthenticated Code Injection — Langflow

Langflow became a major AI application builder in 2025, and CVE-2025-3248 showed how quickly open-source AI tooling can become part of the attack surface. The vulnerability allowed unauthenticated attackers to execute arbitrary code through the /api/v1/validate/code endpoint.

Attackers targeted exposed Langflow instances because many teams deployed AI tooling quickly without the same hardening applied to traditional production services.

pip install --upgrade langflow

5. CVE-2025-32433: SSH Server RCE — Erlang/OTP

CVE-2025-32433 affects the Erlang/OTP SSH server. It can allow unauthenticated remote code execution through flawed SSH protocol message handling.

This vulnerability mattered because Erlang/OTP is embedded in many systems and products, and some teams may not realize they are exposing the vulnerable SSH server functionality. The fix is to upgrade Erlang/OTP and verify whether any application or vendor product bundles an affected OTP release.

erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell

6. CVE-2025-48384: Link Following / Submodule Attack — Git

Git is not just a developer tool; it is part of CI/CD, deployment automation, build containers, dependency fetching, and internal platform engineering. CVE-2025-48384 stems from inconsistent handling of carriage return characters in configuration files and can lead to attacker-controlled behavior through malicious repositories and submodules.

The exploitation path is especially concerning in build systems that clone untrusted repositories, recursively fetch submodules, or execute hooks and build scripts.

git --version

Mitigations include upgrading Git, avoiding recursive submodule clones from untrusted sources, disabling hooks where appropriate, and auditing CI/CD pipelines.

7. CVE-2025-57819: Authentication Bypass to RCE — FreePBX

FreePBX is an open-source web-based PBX management interface. CVE-2025-57819 allows unauthenticated access to FreePBX Administrator paths, arbitrary database manipulation, and possible remote code execution through insufficient sanitization in the Endpoint Manager module.

Attackers targeted exposed PBX systems because telephony infrastructure is often internet-accessible, under-monitored, and operationally sensitive.

PBX risk: Exposed FreePBX admin paths should never be treated as ordinary web apps. Patch and restrict access immediately.

8. CVE-2025-23209: Code Injection / RCE — Craft CMS

Craft CMS had multiple security issues in 2025, and CVE-2025-23209 was added to CISA KEV due to active exploitation. The flaw can lead to remote code execution in certain Craft installations, especially where application security keys are compromised.

CMS vulnerabilities are heavily exploited because attackers can scan the web for exposed instances and quickly deploy web shells, defacement payloads, credential stealers, or spam infrastructure.

composer update craftcms/cms

9. CVE-2025-49113: PHP Object Deserialization RCE — Roundcube Webmail

Roundcube is widely used for self-hosted webmail. CVE-2025-49113 allows authenticated remote code execution because a parameter is not properly validated, leading to PHP object deserialization.

Even though authentication is required, webmail systems are high-value targets. Attackers can combine stolen credentials, phishing, or session compromise with server-side RCE to gain persistence or access sensitive communications.

10. CVE-2025-49844: Lua Use-After-Free RCE — Redis

CVE-2025-49844 is a Redis Lua use-after-free vulnerability that can lead to remote code execution. Redis is often used for caching, queues, sessions, rate limiting, and background job coordination, which makes it a valuable target.

Even when Redis is not meant to be public, misconfigurations happen frequently. A vulnerable Redis instance exposed to untrusted networks should be treated as critical.

redis-server --version

Do not expose Redis publicly: Patch, restrict network access, require authentication, and rotate credentials if compromise is suspected.

Are You Affected? Check in 60 Seconds

The fastest way to check whether these most exploited vulnerabilities 2025 affect your applications is to scan the exact dependency files your builds use.

For JavaScript applications, check package-lock.json, yarn.lock, or pnpm-lock.yaml. For Java applications, check pom.xml, build.gradle, and resolved dependency trees. For PHP, check composer.lock. For Python, check requirements.txt and lock files. For infrastructure, check SBOMs, container images, and vendor software inventories.

Vulert helps teams identify vulnerable open-source dependencies by scanning manifests and SBOMs. It checks direct and transitive dependencies against 458,000+ CVEs and provides fix guidance, safe versions, and CLI commands where available.

Upload your dependency file or SBOM to Vulert and check whether any of these 2025 exploited vulnerabilities appear in your application stack.

Key Takeaways

• Active exploitation beats theoretical severity: A KEV-listed vulnerability should jump to the top of your remediation queue.
• Open source frameworks became major 2025 targets: Next.js, React Server Components, Langflow, Tomcat, Git, and Craft CMS all had high-impact exploitation stories.
• Developer tooling is part of your attack surface: Git vulnerabilities can affect CI/CD pipelines, build workers, and developer machines.
• CMS and webmail remain heavily targeted: Craft CMS, FreePBX, and Roundcube show why public admin panels and self-hosted apps need fast patching.
• Embedded copies matter: Tomcat, Redis, Git, and Erlang/OTP may be bundled inside containers, appliances, or vendor products.
• Continuous scanning is essential: The next exploited CVE may affect a package you already shipped months ago.

Frequently Asked Questions

1. Where does the CISA KEV list come from?

The CISA Known Exploited Vulnerabilities catalog is maintained by the U.S. Cybersecurity and Infrastructure Security Agency. It includes vulnerabilities with evidence of active exploitation and is used by federal agencies and private organizations to prioritize remediation.

2. What’s the difference between CVSS score and active exploitation?

CVSS estimates theoretical severity. Active exploitation means attackers are already using the vulnerability in real attacks. A vulnerability with confirmed exploitation should usually be prioritized above a similar vulnerability with no exploitation evidence.

3. Should I fix KEV vulnerabilities before non-KEV critical vulnerabilities?

Usually yes, especially if the affected system is internet-facing or business-critical. KEV means exploitation is known, while a non-KEV critical CVE may still be theoretical in your environment. Use KEV, exposure, exploitability, and business impact together.