CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 8 added in the last 7 days. Subscribe by RSS.
- CVE-2024-4947Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2023-43208NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.
- CVE-2024-4761Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a Google Chrome
- CVE-2021-40655An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT.
- CVE-2014-100005Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev.
- CVE-2024-30051Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30040Windows MSHTML Platform Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-4671Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2023-7028Weak Password Recovery Mechanism for Forgotten Password in GitLabGitLab
- CVE-2024-29988SmartScreen Prompt Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-38028Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-3273D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injectionD-Link DNS-320L · D-Link DNS-325 +2
- CVE-2024-3272D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsD-Link DNS-320L · D-Link DNS-325 +2
- CVE-2024-4040Unauthenticated arbitrary file read and remote code execution in CrushFTPCrushFTP
- CVE-2024-20359A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco AdapCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20353A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-29748there is a possible way to bypass due to a logic error in the code.Google Android
- CVE-2024-29745there is a possible Information Disclosure due to uninitialized data.Google Android
- CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2023-48788A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.Fortinet FortiClientEMS
- CVE-2021-44529A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code witIvanti EPM
- CVE-2019-7256Linear eMerge E3-Series devices allow Command Injections.
- CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possibleJetBrains TeamCity
- CVE-2024-23296A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-23225A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2023-21237In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading orAndroid
- CVE-2021-36380Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDia
- CVE-2024-21338Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-29360Microsoft Streaming Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-21410Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2020-3259Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2024-21412Internet Shortcut Files Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-21351Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-43770Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of
- CVE-2024-1709Authentication bypass using an alternate path or channelConnectWise ScreenConnect
- CVE-2023-4762Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2022-48618The issue was addressed with improved checks.Apple tvOS · Apple macOS +2
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-22527A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2024-23222A type confusion issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +3
- CVE-2023-34048VMware vCenter Server Out-of-Bounds Write VulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resouIvanti EPMM
- CVE-2024-0519Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2023-6549Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated DenialCloud Software Group NetScaler ADC
- CVE-2018-15133In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potelaravel/framework
- CVE-2024-21893A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) Ivanti ICS · Ivanti IPS
- CVE-2023-29357Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft SharePoint Server
- CVE-2023-41990The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-38203Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEAdobe ColdFusion
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 8 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.