CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2024-49039Windows Task Scheduler Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-43451NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-41277GeoJSON URL validation can expose server files and environment variables to unauthorized usersmetabase
- CVE-2021-26086Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilitAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2014-2120Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attacker
- CVE-2024-5910Expedition: Missing Authentication Leads to Admin Account TakeoverPalo Alto Networks Expedition
- CVE-2024-51567upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
- CVE-2024-43093In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitGoogle Android
- CVE-2019-16278Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c
- CVE-2024-8957PTZOptics NDI and SDI Cameras Command Injection via NTP Address ConfigurationPTZOptics PT30X-SDI · PTZOptics PT30X-NDI
- CVE-2024-8956PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient AuthenticationPTZOptics PT30X-SDI · PTZOptics PT30X-NDI
- CVE-2024-37383Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- CVE-2024-20481A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefeCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-47575A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FoFortinet FortiManager
- CVE-2024-38094Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-9537ScienceLogic SL1 unspecified vulnerabilityScienceLogic SL1
- CVE-2024-40711A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).Veeam Backup and Recovery
- CVE-2024-9680An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-30088Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-28987SolarWinds Web Help Desk Hardcoded Credential VulnerabilitySolarWinds Web Help Desk
- CVE-2024-9380An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker witIvanti CSA
- CVE-2024-9379SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ruIvanti CSA
- CVE-2024-23113A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FoFortinet FortiSwitchManager · Fortinet FortiOS +2
- CVE-2024-43573Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-43572Microsoft Management Console Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-43047Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2024-45519The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.
- CVE-2024-29824An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2023-25280OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with t
- CVE-2020-15415On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution v
- CVE-2019-0344Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possiSAP SE SAP Commerce Cloud
- CVE-2024-7593Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated aIvanti vTM
- CVE-2024-8963Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.Ivanti CSA
- CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlinApache Software Foundation Apache HugeGraph-Server · org… +1
- CVE-2022-21445Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).Oracle Application Development Framework
- CVE-2020-14644Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2020-0618A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'MicrMicrosoft SQL Server
- CVE-2014-0502Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and b
- CVE-2014-0497Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1
- CVE-2013-0648Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.
- CVE-2013-0643The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 an
- CVE-2024-6670WhatsUp Gold HasErrors SQL Injection Authentication Bypass VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-43461Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-8190An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attIvanti CSA
- CVE-2024-38226Microsoft Publisher Security Feature Bypass VulnerabilityMicrosoft Office · Microsoft Publisher
- CVE-2024-38217Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38014Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-40766An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorizedSonicWall SonicOS
- CVE-2017-1000253Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86
- CVE-2016-3714The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x befor
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.