CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 8 added in the last 7 days. Subscribe by RSS.
- CVE-2021-25487Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it resSamsung Mobile Devices
- CVE-2021-25395A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilSamsung Mobile Devices
- CVE-2021-25394A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radioSamsung Mobile Devices
- CVE-2021-25372An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.Samsung Mobile Devices
- CVE-2021-25371A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.Samsung Mobile Devices
- CVE-2019-20500D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality i
- CVE-2019-17621The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec
- CVE-2023-32439A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-32435A memory corruption issue was addressed with improved state management.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32434An integer overflow was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-27992The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versZyxel NAS326 firmware · Zyxel NAS540 firmware +1
- CVE-2023-20867VMware Tools Authentication Bypass VulnerabilityVMware Tools
- CVE-2023-20887Aria Operations for Networks contains a command injection vulnerability.Aria Operations for Networks
- CVE-2021-44026Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
- CVE-2020-35730An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.
- CVE-2020-12641rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set
- CVE-2016-9079A use-after-free vulnerability in SVG Animation has been discovered.Mozilla Firefox · Mozilla Thunderbird
- CVE-2016-0165The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G
- CVE-2023-27997A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,Fortinet FortiOS-6K7K · Fortinet FortiProxy +1
- CVE-2023-3079Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-33010A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX seriZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4
- CVE-2023-33009A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serieZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4
- CVE-2023-34362In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL
- CVE-2023-28771Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.Zyxel ZyWALL/USG series firmware · Zyxel VPN series firm… +2
- CVE-2023-2868Remote Code injection in Barracuda Email Security GatewayBarracuda Email Security Gateway
- CVE-2023-32409The issue was addressed with improved bounds checks.Apple macOS · Apple Safari +3
- CVE-2023-32373A use-after-free issue was addressed with improved memory management.Apple macOS · Apple Safari +3
- CVE-2023-28204An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple Safari +3
- CVE-2023-21492Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.Samsung Mobile Devices
- CVE-2016-6415The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5
- CVE-2004-1464Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a craf
- CVE-2023-25717Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin
- CVE-2021-3560It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestorpolkit
- CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x beforeApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2016-3427Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to aff
- CVE-2015-5317The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name inorg.jenkins-ci.main:jenkins-core
- CVE-2014-0196The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO
- CVE-2010-3904The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before
- CVE-2023-29336Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-21839Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-1389TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form oTP-Link Archer AX21
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2023-28432Minio Information Disclosure in Cluster Deploymentminio
- CVE-2023-27350This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).PaperCut NG
- CVE-2023-2136Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2017-6742A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to rCisco IOS XE Software · IntelliShield Universal Product
- CVE-2023-2033Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2019-8526A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2023-29492Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account.
- CVE-2023-20963In WorkSource, there is a possible parcel mismatch.Android
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 8 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.