Four vulnerabilities across four entirely unrelated vendors were confirmed exploited over the past several months, none scoring above 8.8 on CVSS and none carrying a confirmed ransomware association — yet each was still confirmed as actively exploited by CISA. That combination is worth examining as its own pattern: a file-transfer server, a database engine, a network video recorder, and an email security gateway, none individually as headline-grabbing as this series' critical-severity clusters, all still real enough in the wild to earn a KEV listing.
| CVE | CVSS | Vendor / Product | Added to KEV |
|---|---|---|---|
| CVE-2023-52163 | 8.8 | Digiever DS-2105 Pro (NVR) | 22 Dec 2025 |
| CVE-2025-14847 | 7.5 | MongoDB / MongoDB Server | 29 Dec 2025 |
| CVE-2025-59689 | 6.1 | Libraesva Email Security Gateway | 29 Sep 2025 |
| CVE-2025-47813 | 4.3 | Wing FTP Server | 16 Mar 2026 |
Why lower CVSS scores in KEV still deserve full attention
CISA's KEV catalogue has exactly one admission criterion that matters above all others: confirmed evidence of active exploitation. It is not a severity ranking, and a 4.3-scored bug sitting in the same catalogue as a 9.8 supply-chain compromise is not an error — it reflects that attackers found both worth using. Wing FTP Server's CVE-2025-47813 is a good illustration of why a "medium" severity information-disclosure bug earns a KEV slot: NVD describes it as loginok.html disclosing "the full local installation path of the application when using a long value in the UID cookie." On its own, a leaked file path discloses no credentials and compromises no data directly. But it is precisely the kind of reconnaissance detail that sharpens a subsequent attack — knowing the exact installation path narrows the search space for other vulnerabilities in the same software stack, including the more serious remote-code-execution bug referenced in this CVE's own public research (a related Wing FTP Server RCE, CVE-2025-47812, covered independently by security researchers). A low-severity information leak chained ahead of a higher-severity bug is a longstanding attacker pattern, and CISA confirming this specific leak was exploited suggests it was being used exactly that way.
MongoDB's bug shows why "unauthenticated" changes the calculus regardless of score
CVE-2025-14847 affects a strikingly broad swath of MongoDB Server versions — NVD lists affected ranges across the 3.6, 4.0, 4.2, 4.4, 5.0, 6.0, 7.0, and 8.0/8.2 branches, meaning nearly every MongoDB Server deployment not on the very latest patch level within each branch is potentially exposed. The vulnerability itself involves mismatched length fields in Zlib-compressed protocol headers, allowing "a read of uninitialized heap memory by an unauthenticated client." The CVSS vector confirms no authentication is required (PR:N) and no user interaction (UI:N) — an attacker needs only network reachability to the database's compression-enabled listener. Uninitialized heap memory reads are a classic vector for leaking fragments of other clients' data, credentials, or internal application state that happened to occupy that memory previously — a real risk for any multi-tenant or shared-infrastructure MongoDB deployment even though the CVSS confidentiality-only impact (no integrity or availability effect) keeps the overall score at a comparatively modest 7.5.
Digiever and Libraesva: two very different products, one shared theme of overdue lifecycle attention
CVE-2023-52163 affects the Digiever DS-2105 Pro, a network video recorder, via unauthenticated command injection in time_tzsetup.cgi — and NVD's own note states plainly that "this vulnerability only affects products that are no longer supported by the maintainer." An 8.8-severity, unauthenticated command-injection bug in a device the vendor has stopped supporting is arguably the single riskiest combination on this list: no patch is coming, and the only real remediation path is replacement or network isolation. This is a recurring theme across IoT and embedded-device findings throughout KEV — inexpensive, long-lived hardware that quietly outlives its vendor's support commitment while continuing to sit on a network, often for physical security purposes ironically enough, given this device's role as a video recorder.
Libraesva's CVE-2025-59689, by contrast, affects actively-maintained software (fixes exist across the 5.0 through 5.5 branches) and involves command injection via a compressed email attachment in the company's Email Security Gateway — a product whose entire purpose is inspecting untrusted content, including attachments, safely. A command-injection bug triggered by processing a compressed attachment is a pointed irony for a security product specifically: the gateway's job is to be the thing that safely handles hostile-by-default input, and this bug describes exactly that safety boundary failing.
What to check this week
Patch Wing FTP Server past 7.4.4 and treat any exposed installation path disclosure as a signal to review the instance for other unpatched issues in the same version, given the documented pattern of chaining this leak with more serious bugs.
Upgrade MongoDB Server to the fixed version for your specific branch (7.0.28, 8.0.17, 8.2.3, 6.0.27, 5.0.32, or 4.4.30, per NVD) and confirm Zlib compression is not enabled on internet-reachable instances where it is not operationally necessary.
Identify and isolate or replace any Digiever DS-2105 Pro units still in service, given the maintainer has confirmed end-of-support status — network segmentation is the realistic interim control since no further patch is expected.
Update Libraesva ESG to the fixed release for your branch (5.0.31, 5.1.20, 5.2.31, 5.4.8, or 5.5.7) given this product's specific role processing untrusted email content makes any bypass of its own safety handling especially consequential.
A closing note on treating KEV membership, not CVSS score, as the triage signal
An organization that filters its vulnerability backlog primarily by CVSS score risks deprioritizing exactly this kind of finding — a 4.3 or 6.1 bug that CISA has nonetheless confirmed was exploited in the wild. KEV membership itself should function as an override on standard severity-based triage, since it represents ground truth about attacker behavior that a CVSS score, calculated independent of any observed exploitation, cannot capture on its own.
How Safeguard helps
Safeguard's continuous inventory surfaces confirmed-exploited findings across exactly this kind of diverse, easy-to-overlook software population — file-transfer servers, database engines, embedded NVR firmware, and email security appliances — flagging KEV membership as its own priority signal independent of CVSS score, so a modest-looking 4.3 information leak in Wing FTP Server gets the same visibility as a headline-grabbing critical bug elsewhere in the environment.
