CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 6 added in the last 7 days.
- CVE-2022-38028Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-3273D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injectionD-Link DNS-320L · D-Link DNS-325 +2
- CVE-2024-3272D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsD-Link DNS-320L · D-Link DNS-325 +2
- CVE-2024-4040Unauthenticated arbitrary file read and remote code execution in CrushFTPCrushFTP
- CVE-2024-20359A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco AdapCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20353A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-29748there is a possible way to bypass due to a logic error in the code.Google Android
- CVE-2024-29745there is a possible Information Disclosure due to uninitialized data.Google Android
- CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2023-48788A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.Fortinet FortiClientEMS
- CVE-2021-44529A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code witIvanti EPM
- CVE-2019-7256Linear eMerge E3-Series devices allow Command Injections.
- CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possibleJetBrains TeamCity
- CVE-2024-23296A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-23225A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2023-21237In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading orAndroid
- CVE-2021-36380Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDia
- CVE-2024-21338Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-29360Microsoft Streaming Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-21410Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2020-3259Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2024-21412Internet Shortcut Files Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-21351Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-43770Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of
- CVE-2024-1709Authentication bypass using an alternate path or channelConnectWise ScreenConnect
- CVE-2023-4762Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2022-48618The issue was addressed with improved checks.Apple tvOS · Apple macOS +2
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-22527A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE Atlassian Confluence Data Center · Atlassian Confluence Ser…
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 6 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.