CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2024-7262Arbitrary Code Execution in WPS OfficeKingsoft WPS Office
- CVE-2021-20124A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint.Draytek VigorConnect
- CVE-2021-20123A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet eDraytek VigorConnect
- CVE-2024-7965Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeApache Software Foundation Apache OFBiz
- CVE-2024-7971Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2024-39717The Versa Director GUI provides an option to customize the look and feel of the user interface.Versa Director
- CVE-2022-0185A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel
- CVE-2021-33045The identity authentication bypass vulnerability found in some Dahua products during the login process.Some Dahua IP Camera, Video Intercom, NVR, XVR devices
- CVE-2021-33044The identity authentication bypass vulnerability found in some Dahua products during the login process.Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Ther…
- CVE-2021-31196Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2024-38213Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38193Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38189Microsoft Project Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2024-38178Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows
- CVE-2024-38107Windows Power Dependency Coordinator Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38106Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-36971net: fix __dst_negative_advice() raceLinux
- CVE-2024-32113Apache OFBiz: Path traversal leading to RCEApache Software Foundation Apache OFBiz
- CVE-2018-0824A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micros
- CVE-2024-37085VMware ESXi contains an authentication bypass vulnerability.VMware ESXi · VMware Cloud Foundation
- CVE-2024-5217Incomplete Input Validation in GlideExpression ScriptServiceNow Now Platform
- CVE-2024-4879Jelly Template Injection Vulnerability in ServiceNow UI MacrosServiceNow Now Platform
- CVE-2023-45249Remote command execution due to use of default passwords.Acronis Cyber Infrastructure
- CVE-2024-39891In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to
- CVE-2012-4792Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web
- CVE-2024-34102XXE can expose crypt key and other secrets granting full admin accessAdobe Commerce · magento/community-edition
- CVE-2024-28995SolarWinds Serv-U L Directory Transversal VulnerabilitySolarWinds Serv-U
- CVE-2022-22948The vCenter Server contains an information disclosure vulnerability due to improper permission of files.VMware vCenter Server and VMware Cloud Foundation
- CVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoservergeoserver · org.geoserver.web:gs-web-app +2
- CVE-2024-38112Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-38080Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-23692Rejetto HTTP File Server 2.3m Unauthenticated RCERejetto HTTP File Server
- CVE-2024-20399Cisco NX-OS Software CLI Command Injection VulnerabilityCisco NX-OS Software
- CVE-2022-2586It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that The Linux Kernel Organization linux
- CVE-2022-24816Improper Control of Generation of Code in jai-extgeosolutions-it jai-ext · it.geosolutions.jaiext.jiffle:… +1
- CVE-2020-13965An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.
- CVE-2024-4358Registration Authentication Bypass VulnerabilityProgress Software Telerik Report Server
- CVE-2024-32896there is a possible way to bypass due to a logic error in the code.Google Android
- CVE-2024-26169Windows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-4610Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel Driv…
- CVE-2024-4577Argument Injection in PHP-CGIPHP Group PHP
- CVE-2017-3506Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).Oracle WebLogic Server
- CVE-2024-24919Information disclosurecheckpoint Check Point Quantum Gateway, Spark Gateway and C…
- CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2024-4978Malicious Code in Justice AV Solutions (JAVS) ViewerJustice AV Solutions Viewer
- CVE-2024-5274Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST APIApache Software Foundation Apache Flink · org.apache.fli… +1
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.