CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 8 added in the last 7 days. Subscribe by RSS.
- CVE-2023-42793In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possibleJetBrains TeamCity
- CVE-2023-28229Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-4211Mali GPU Kernel Driver Allows Improper GPU Memory Processing OperationsArm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- CVE-2023-5217Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potenGoogle Chrome · Google libvpx +1
- CVE-2023-20198Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.Cisco IOS XE Software
- CVE-2018-14667The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.[UNKNOWN] RichFaces · org.richfaces:richfaces-core
- CVE-2023-41993The issue was addressed with improved checks.Apple macOS
- CVE-2023-41992The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-41991A certificate validation issue was addressed.Apple iOS and iPadOS · Apple macOS
- CVE-2023-22515Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknowAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-41179A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security anTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2023-28434MinIO is vulnerable to privilege escalation on Linux/MacOSminio · github.com/minio/minio
- CVE-2022-22265An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and codeSamsung Mobile Devices
- CVE-2021-3129Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of ifacade/ignition
- CVE-2017-6884A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8.
- CVE-2014-8361The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as…
- CVE-2023-26369[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildAdobe Acrobat Reader
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boGoogle Chrome · Google libwebp +13
- CVE-2023-35674In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code.Google Android
- CVE-2023-20269A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-36802Microsoft Streaming Service Proxy Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36761Microsoft Word Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-41064A buffer overflow issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS
- CVE-2023-41061A validation issue was addressed with improved logic.Apple iOS and iPadOS · Apple watchOS
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionApache Software Foundation Apache RocketMQ · org.apache.… +2
- CVE-2023-38831RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.
- CVE-2023-32315Openfire administration console authentication bypassigniterealtime Openfire · org.igniterealtime.openfire:xmpps…
- CVE-2023-38035A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass aIvanti MobileIron Sentry
- CVE-2023-27532Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.Veeam Backup & Replication
- CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionAdobe ColdFusion
- CVE-2023-24489A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthentCitrix ShareFile Storage Zones Controller
- CVE-2023-38180.NET and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft ASP.NET Core +6
- CVE-2023-36884Windows Search Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2017-18368The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in
- CVE-2023-35081A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatIvanti EPMM
- CVE-2023-37580Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
- CVE-2023-38606This issue was addressed with improved state management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-35078An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appliIvanti Endpoint Manager Mobile
- CVE-2023-38205ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298Adobe ColdFusion
- CVE-2023-29298Adobe ColdFusion Improper Access Control Security feature bypassAdobe ColdFusion
- CVE-2023-3519Unauthenticated remote code executionCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-37450The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2022-29303SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
- CVE-2023-36874Windows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC +2
- CVE-2023-32049Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-32046Windows MSHTML Platform Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-31199Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito
- CVE-2021-29256.
- CVE-2021-25489Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format stSamsung Mobile Devices
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 8 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.