CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2024-21413Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2022-23748mDNSResponder.exe is vulnerable to DLL Sideloading attack.Audinate Dante Application Library for Windows
- CVE-2020-29574An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s
- CVE-2020-15069Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientles
- CVE-2024-53104media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatLinux
- CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)Apache Software Foundation Apache OFBiz
- CVE-2024-29059.NET Framework Information Disclosure VulnerabilityMicrosoft .NET Framework
- CVE-2018-9276An issue was discovered in PRTG Network Monitor before 18.2.39.
- CVE-2018-19410PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including admin
- CVE-2025-24085A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-23006Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) andSonicWall SMA1000
- CVE-2020-11023Potential XSS vulnerability in jQueryjQuery · jquery-rails +2
- CVE-2024-50603An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996.Aviatrix Controller
- CVE-2025-21335Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21334Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21333Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-12686Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)BeyondTrust Remote Support(RS) & Privileged Remote Access
- CVE-2023-48365Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.
- CVE-2024-55550Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insu
- CVE-2024-41713A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenti
- CVE-2020-2883Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2024-55591An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiFortinet FortiOS · Fortinet FortiProxy
- CVE-2024-3393PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted PacketPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS
- CVE-2025-0282A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti NeuIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2021-44207Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
- CVE-2022-23227NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users
- CVE-2021-40407An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2019-11001On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" function
- CVE-2018-14933upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeup
- CVE-2024-55956In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit
- CVE-2024-35250Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-20767ColdFusion | Improper Access Control (CWE-284)Adobe ColdFusion
- CVE-2024-50623In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download th
- CVE-2024-49138Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-12356Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)BeyondTrust Remote Support · BeyondTrust Privileged Remote…
- CVE-2024-51378getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat
- CVE-2024-11680ProjectSend Unauthenticated Configuration ModificationProjectSend
- CVE-2024-11667A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seriZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2023-45727Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1North Grid Proself Enterprise/Standard Edition · North G… +1
- CVE-2023-28461Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.
- CVE-2024-44309A cookie management issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-44308The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-21287Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).Oracle Agile PLM Framework
- CVE-2024-38813Privilege escalation vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2024-38812Heap-overflow vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2024-9474PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-1212LoadMaster Pre-Authenticated OS Command InjectionProgress Software LoadMaster
- CVE-2024-0012PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-9465Expedition: SQL Injection Leads to Firewall Admin Credential DisclosurePalo Alto Networks Expedition
- CVE-2024-9463Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential DisclosurePalo Alto Networks Expedition
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.