CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-81963Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-53266netfilter: bridge: make ebt_snat ARP rewrite writableLinux
- CVE-2025-39964crypto: af_alg - Disallow concurrent writes in af_alg_sendmsgLinux
- CVE-2025-39682tls: fix handling of zero-length records on the rx_listLinux · :linux_kernel:
- CVE-2026-87886Local privilege escalation due to insecure file permissions.Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1
- CVE-2026-76460Cisco Identity Services Engine Authentication Bypass VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2026-58704In Cellular Modem, there is a possible permission bypass due to a logic error in the code.Google Android
- CVE-2026-85046Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-76461Cisco Secure Email Gateway SQL Injection VulnerabilityCisco Secure Email
- CVE-2026-59822LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackBerriAI litellm · litellm
- CVE-2026-48710Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksKludex starlette · starlette
- CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2026-84869ScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsConnectWise ScreenConnect
- CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorPaperCut MF/NG
- CVE-2026-81578PaperCut MF/NG: Authentication BypassPaperCut MF/NG
- CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOSMikrotik RouterOS
- CVE-2026-67277Kernel memory disclosure and denial of service in MikroTik RouterOS btest serviceMikrotik RouterOS
- CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-19490NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490NetScaler ADC · NetScaler Gateway
- CVE-2025-25249A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.1Fortinet FortiSwitchManager · Fortinet FortiOS
- CVE-2026-86218pre-authentication remote code executionN-able N-central
- CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-66384Authenticated users may write data outside the intended Docker cache pathjfrog artifactory
- CVE-2021-23758Deserialization of Untrusted DataAjaxPro.2 · AjaxNetProfessional
- CVE-2015-5287The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain priv
- CVE-2015-3246libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, w
- CVE-2026-9586Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMBSangoma Switchvox SMB Edition
- CVE-2026-83549Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identiSonicWall SMA1000
- CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.SonicWall SMA1000
- CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactoryjfrog artifactory
- CVE-2026-49869Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`kestra-io kestra
- CVE-2026-72530A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X tTrueConf Server
- CVE-2026-64849MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)mlflow
- CVE-2026-53362ipv6: account for fraggap on the paged allocation pathLinux
- CVE-2023-49105An issue was discovered in ownCloud owncloud/core before 10.13.1.
- CVE-2026-8452Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2022-0995An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.kernel
- CVE-2019-1068A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'MicrMicrosoft SQL Server 2014 Service Pack 2 for 32-bit Systems…
- CVE-2026-60004Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.Gitea · gitea.dev +1
- CVE-2026-21962Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic ServeOracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
- CVE-2026-68820Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installedZimbra Collaboration
- CVE-2026-72529A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X tTrueConf Server
- CVE-2026-65400An authentication issue was addressed with improved state management.Apple macOS
- CVE-2026-59310vCenter directory-traversal vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +3
- CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attackray-project ray · ray
- CVE-2026-72898Metabase SQL injection via password reset endpointMetabase
- CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.