CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-96655Plex Media Server arbitrary-host SSRFPlex Media Server
- CVE-2026-96652Plex Media Server SSRFPlex Media Server
- CVE-2026-110936A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).Siemens Software Center
- CVE-2026-111357Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege…Ivanti Connect Secure
- CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab
- CVE-2026-76418Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescingLinux
- CVE-2026-109619RCE via stale global statePHP Group PHP
- CVE-2026-109618RCE via OOM corruptionPHP Group PHP
- CVE-2026-114625Security Advisory 0199Arista Networks VeloCloud Orchestrator
- CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in…Collabora Online - Built-in CODE Server
- CVE-2026-96656Plex Media Server arbitrary file writePlex Media Server
- CVE-2026-96654Plex Media Server URL injectionPlex Media Server
- CVE-2026-106931SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with…EG Secure Solutions SiteGuard Server Edition for Apache… +1
- CVE-2026-102764Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportBeyondTrust Remote Support
- CVE-2025-61624An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7Fortinet FortiOS · Fortinet FortiProxy +2
- CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, BaAtlassian Bamboo Data Center · Atlassian Bitbucket Data… +6
- CVE-2026-76519Cisco Secure Email Gateway Arbitrary File Write VulnerabilityCisco Secure Email
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionAhsayCBS
- CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationAhsayCBS
- CVE-2026-0322PAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-96951Windows Shell Security Feature Bypass VulnerabilityMicrosoft Edge · Microsoft Outlook.com +1
- CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.Ivanti Connect Secure
- CVE-2026-86950An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.@strapi/strapi
- CVE-2021-3199Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..
- CVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackerorg.apache.struts:struts2-core
- CVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion…
- CVE-2015-3306The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
- CVE-2026-88779Memory overflow vulnerability leading to Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2026-102490Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packageZammad
- CVE-2026-102489Undisclosed RCE in Zammad v6.3 and higherZammad
- CVE-2026-104286An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FFortinet FortiMail
- CVE-2026-76504Cisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the WordPress
- CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSMikrotik RouterOS
- CVE-2026-65660Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-71362Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverWSO2 Universal Gateway · WSO2 Traffic Manager +3
- CVE-2026-94127BIG-IP APM OAuth vulnerabilityF5 BIG-IP
- CVE-2026-93952Security Advisory 0183Arista Networks VeloCloud Orchestrator (VCO) On-Prem
- CVE-2026-93616Directory Traversal and File upload allows execution of arbitrary script on the Management Servercheckpoint Quantum Security Management
- CVE-2026-85102Improper Certificate Validation in Quantum Security Gatewaycheckpoint Quantum Security Gateway
- CVE-2026-42018Anonymous user token generation exposure in JFrog Artifactoryjfrog artifactory
- CVE-2026-42016Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalationjfrog artifactory
- CVE-2026-7273A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow aZyxel GS1900-48HPv2 firmware · Zyxel GS1900-8 firmware +8
- CVE-2026-87491Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viaGoogle Chrome
- CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityMicrosoft Windows
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.