CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2025-2783Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attackerGoogle Chrome
- CVE-2019-9875Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code
- CVE-2019-9874Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to
- CVE-2025-30154Multiple Reviewdog actions were compromised during a specific time periodreviewdog
- CVE-2025-22457A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTAIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2025-1316Edimax IC-7100 IP Camera OS Command InjectionEdimax IC-7100 IP Camera
- CVE-2024-48248NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lNAKIVO Backup & Replication Director
- CVE-2017-12637Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows
- CVE-2025-30066tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.tj-actions changed-files
- CVE-2025-24472An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.Fortinet FortiOS · Fortinet FortiProxy
- CVE-2025-24201An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-21590Junos OS: An local attacker with shell access can execute arbitrary codeJuniper Networks Junos OS
- CVE-2025-26633Microsoft Management Console Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-24993Windows NTFS Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-24991Windows NTFS Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-24985Windows Fast FAT File System Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-24984Windows NTFS Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-24983Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-25181A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL Advantive VeraCore
- CVE-2024-57968Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessibleAdvantive VeraCore
- CVE-2024-13161Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2024-13160Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2024-13159Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2025-22226VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.ESXi · VMware Workstation +4
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability.VMware ESXi · VMware Cloud Foundation +2
- CVE-2025-22224VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.VMware ESXi · VMware Workstation +3
- CVE-2024-50302HID: core: zero-initialize the report bufferLinux · :linux_kernel:
- CVE-2024-4885WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution VulnerabilityProgress Software WhatsUp Gold
- CVE-2023-20118A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Cisco Small Business RV Series Router Firmware
- CVE-2022-43939Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization DecisionsHitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43769Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)Hitachi Vantara Pentaho Business Analytics Server
- CVE-2018-8639An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2024-49035Partner.Microsoft.Com Elevation of Privilege VulnerabilityMicrosoft Partner Center
- CVE-2023-34192Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr
- CVE-2024-20953Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).Oracle Agile PLM Framework
- CVE-2017-3066Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializaAdobe ColdFusion ColdFusion 2016 Update 3 and earlier, Cold…
- CVE-2025-24989Microsoft Power Pages Elevation of Privilege VulnerabilityMicrosoft Power Pages
- CVE-2025-23209Potential RCE with a compromised security key in craft/cmscraftcms cms · craftcms/cms
- CVE-2025-0111PAN-OS: Authenticated File Read Vulnerability in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0108PAN-OS: Authentication Bypass in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-53704An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.SonicWall SonicOS
- CVE-2024-57727SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re
- CVE-2025-24200An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple iPadOS
- CVE-2024-41710A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (
- CVE-2025-21418Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21391Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-40891**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VZyxel VMG4325-B10A firmware
- CVE-2024-40890**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-BZyxel VMG4325-B10A firmware
- CVE-2025-0994Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vTrimble Cityworks
- CVE-2025-04117-Zip Mark-of-the-Web Bypass Vulnerability7-Zip
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.