CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 8 added in the last 7 days. Subscribe by RSS.
- CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionAdobe ColdFusion
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEYApache Software Foundation Apache Superset · superset +1
- CVE-2023-23752[20230201] - Core - Improper access check in webservice endpointsJoomla! Project Joomla! CMS
- CVE-2016-20017D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil
- CVE-2023-6548Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLICloud Software Group NetScaler ADC · Cloud Software Group N…
- CVE-2023-7101Arbitrary Code Execution (ACE) VulnerabilityDouglas Wilson Spreadsheet::ParseExcel
- CVE-2023-7024Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2024-21887A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autIvanti ICS · Ivanti IPS
- CVE-2023-46805An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accIvanti ICS · Ivanti IPS
- CVE-2023-49897An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.FXC AE1021PE · FXC AE1021
- CVE-2023-47565Legacy VioStor NVRQNAP Systems VioStor NVR
- CVE-2023-41266A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a
- CVE-2023-41265An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023
- CVE-2023-33107Integer Overflow or Wraparound in Graphics LinuxQualcomm Snapdragon
- CVE-2023-33106Use of Out-of-range Pointer Offset in GraphicsQualcomm Snapdragon
- CVE-2023-33063Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2022-22071Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2023-42917A memory corruption vulnerability was addressed with improved locking.Apple Safari · Apple macOS +1
- CVE-2023-42916An out-of-bounds read was addressed with improved input validation.Apple Safari · Apple macOS +1
- CVE-2023-6345Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2023-49103An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.
- CVE-2023-6448Unitronics VisiLogic uses a default administrative passwordUnitronics VisiLogic
- CVE-2023-4911Glibc: buffer overflow in ld.so leading to privilege escalationglibc · Red Hat Enterprise Linux +1
- CVE-2023-36584Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-1671A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution Sophos Web Appliance
- CVE-2020-2551Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components).Oracle WebLogic Server
- CVE-2023-36036Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36033Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36025Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-47246In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we
- CVE-2023-29552The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.
- CVE-2023-22518All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackApache Software Foundation Apache ActiveMQ · org.apache.… +1
- CVE-2023-46748BIG-IP Configuration utility authenticated SQL injection vulnerabilityF5 BIG-IP
- CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityF5 BIG-IP
- CVE-2023-36851Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary filesJuniper Networks Junos OS
- CVE-2023-36847Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2023-36846Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2023-36845Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variableJuniper Networks Junos OS
- CVE-2023-36844Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variablesJuniper Networks Junos OS
- CVE-2023-5631Stored XSS vulnerability in RoundcubeRoundcubemail
- CVE-2023-4966Unauthenticated sensitive information disclosureCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, asapisix · aspnet-core +20
- CVE-2023-41763Skype for Business Elevation of Privilege VulnerabilityMicrosoft Skype for Business Server 2015 CU13 · Microsoft S…
- CVE-2023-36563Microsoft WordPad Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-21608Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-20109A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an Cisco IOS
- CVE-2023-20273A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the priCisco IOS XE Software
- CVE-2023-42824The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-40044WS_FTP Server Ad Hoc Transfer Module .NET Deserialization VulnerabilityProgress Software WS_FTP Server
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 8 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.