CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 6 added in the last 7 days. Subscribe by RSS.
- CVE-2017-0145The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2016-3088The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTorg.apache.activemq:activemq-client
- CVE-2015-2051The D-Link DIR-645 Wired/Wireless Router Rev.
- CVE-2015-1635HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a
- CVE-2015-1130The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileg
- CVE-2014-4404Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privil
- CVE-2022-22047Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-5722The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.Grandstream UCM6200 Series
- CVE-2020-0787An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic lMicrosoft Windows
- CVE-2017-5689An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AIntel Active Mangement Technology, Intel Small Business Tec…
- CVE-2014-7169GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variabl
- CVE-2014-6271GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac
- CVE-2014-1776Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial
- CVE-2022-26925Windows LSA Spoofing VulnerabilityMicrosoft Windows
- CVE-2018-8453An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception haorg.apache.struts:struts2-core · org.apache.struts.xwork:xw…
- CVE-2006-1547ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vstruts:struts
- CVE-2022-29499The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.
- CVE-2021-4034A local privilege escalation vulnerability was found on polkit's pkexec utility.polkit
- CVE-2021-30983A buffer overflow issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2021-30533Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restriGoogle Chrome
- CVE-2020-9907A memory corruption issue was addressed by removing the vulnerable code.Apple iOS · Apple tvOS
- CVE-2020-3837A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2019-8605A use after free issue was addressed with improved memory management.Apple iOS · Apple macOS +2
- CVE-2018-4344A memory corruption issue was addressed with improved memory handling.iOS, macOS, tvOS, watchOS
- CVE-2020-14864Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation).Oracle Business Intelligence Enterprise Edition
- CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riApache Airflow · apache-airflow
- CVE-2020-13671Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extenDrupal Core · drupal/core +1
- CVE-2020-11978An issue was found in Apache Airflow versions 1.10.10 and below.Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2020-6572Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2019-9670mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as
- CVE-2019-7609Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.Elastic Kibana
- CVE-2019-2725Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).Oracle Tape Library ACSLS
- CVE-2019-1579Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or Palo Alto Networks GlobalProtect Portal/Gateway Interface
- CVE-2019-1458An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-10149A flaw was found in Exim versions 4.87 to 4.91 (inclusive).exim
- CVE-2018-13383A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxFortinet FortiOS and FortiProxy
- CVE-2018-13382An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 tFortinet FortiOS, FortiProxy
- CVE-2017-1000486Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code executionorg.primefaces:primefaces
- CVE-2015-7450Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allo
- CVE-2013-3900WinVerifyTrust Signature Validation VulnerabilityMicrosoft Windows
- CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-38163SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administraSAP SE SAP NetWeaver
- CVE-2016-2388The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted
- CVE-2016-2386SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v
- CVE-2019-7195This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2019-7194This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2019-7193This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.QNAP NAS devices
- CVE-2019-7192This improper access control vulnerability allows remote attackers to gain unauthorized access to the system.QNAP NAS devices running Photo Station
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 6 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.