CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 6 added in the last 7 days. Subscribe by RSS.
- CVE-2011-1823The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows
- CVE-2022-26352An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02.
- CVE-2022-24706Remote Code Execution Vulnerability in PackagingApache Software Foundation Apache CouchDB
- CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP headerApache Software Foundation Apache APISIX
- CVE-2022-22963In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toSpring Cloud Function · org.springframework.cloud:spring-cl…
- CVE-2022-2294Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2021-39226Snapshot authentication bypass in grafanagrafana · github.com/grafana/grafana
- CVE-2021-38406Delta Electronics DOPSoft 2 Out-of-Bounds WriteDelta Electronics DOPSoft
- CVE-2021-31010A deserialization issue was addressed through improved validation.Apple macOS · Apple watchOS
- CVE-2020-36193Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relatpear/archive_tar
- CVE-2020-28949Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fildrupal/core · pear/archive_tar
- CVE-2022-0028PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL FilteringPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2022-32894An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2022-32893An out-of-bounds write issue was addressed with improved bounds checking.Apple Safari · Apple iOS and iPadOS +1
- CVE-2022-2856Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitGoogle Chrome
- CVE-2022-26923Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher SAP SE SAP NetWeaver and ABAP Platform · SAP SE SAP Web… +1
- CVE-2022-21971Windows Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2017-15944Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute
- CVE-2020-8218A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code ePulse Connect Secure
- CVE-2019-11581There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail aAtlassian Jira Server and Data Center
- CVE-2017-6077ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via s
- CVE-2016-6277NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before
- CVE-2013-0631Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in
- CVE-2013-0629Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspeci
- CVE-2013-0625Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe
- CVE-2009-3960Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and
- CVE-2022-37042Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.
- CVE-2022-27925Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.
- CVE-2022-34713Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-30333RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonst
- CVE-2022-27924Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta
- CVE-2017-8570Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office RemoteMicrosoft Office 2007 SP3, Microsoft Office 2010 SP2, Micro…
- CVE-2017-0222A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2014-6352Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
- CVE-2022-26138The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users gAtlassian Questions For Confluence
- CVE-2019-0752A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Windows
- CVE-2018-20250In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (inCheck Point Software Technologies WinRAR
- CVE-2018-15982Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.
- CVE-2017-9841Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST daphpunit/phpunit
- CVE-2014-1761Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Wor
- CVE-2013-3906GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and
- CVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requeMicrosoft Windows
- CVE-2018-1000861A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cororg.jenkins-ci.main:jenkins-core
- CVE-2017-9791The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message tApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-8464Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, WindoMicrosoft Windows Shell
- CVE-2017-10271Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).Oracle WebLogic Server
- CVE-2017-0263The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WindowMicrosoft Windows
- CVE-2017-0262Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly Microsoft Office
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 6 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.