CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-119977WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionWordPress Foundation WordPress
- CVE-2026-118527Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to…Ivanti Connect Secure
- CVE-2026-111357Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege…Ivanti Connect Secure
- CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab
- CVE-2026-76418Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescingLinux
- CVE-2026-41709ESX insufficient logging vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +2
- CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli · node +6
- CVE-2026-109619RCE via stale global statePHP Group PHP
- CVE-2026-109618RCE via OOM corruptionPHP Group PHP
- CVE-2026-114625Security Advisory 0199Arista Networks VeloCloud Orchestrator
- CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in…Collabora Online - Built-in CODE Server
- CVE-2026-96656Plex Media Server arbitrary file writePlex Media Server
- CVE-2026-96655Plex Media Server arbitrary-host SSRFPlex Media Server
- CVE-2026-96654Plex Media Server URL injectionPlex Media Server
- CVE-2026-96652Plex Media Server SSRFPlex Media Server
- CVE-2026-110936A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).Siemens Software Center
- CVE-2026-106931SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with…EG Secure Solutions SiteGuard Server Edition for Apache… +1
- CVE-2026-102764Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportBeyondTrust Remote Support
- CVE-2025-61624An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7Fortinet FortiOS · Fortinet FortiProxy +2
- CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, BaAtlassian Bamboo Data Center · Atlassian Bitbucket Data… +6
- CVE-2026-76519Cisco Secure Email Gateway Arbitrary File Write VulnerabilityCisco Secure Email
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionAhsayCBS
- CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationAhsayCBS
- CVE-2026-0322PAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-96951Windows Shell Security Feature Bypass VulnerabilityMicrosoft Edge · Microsoft Outlook.com +1
- CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.Ivanti Connect Secure
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.@strapi/strapi
- CVE-2021-3199Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..
- CVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackerorg.apache.struts:struts2-core
- CVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion…
- CVE-2015-3306The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.