CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 6 added in the last 7 days.
- CVE-2024-23222A type confusion issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +3
- CVE-2023-34048VMware vCenter Server Out-of-Bounds Write VulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resouIvanti EPMM
- CVE-2024-0519Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2023-6549Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated DenialCloud Software Group NetScaler ADC
- CVE-2018-15133In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potelaravel/framework
- CVE-2024-21893A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) Ivanti ICS · Ivanti IPS
- CVE-2023-29357Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft SharePoint Server
- CVE-2023-41990The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-38203Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEAdobe ColdFusion
- CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionAdobe ColdFusion
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEYApache Software Foundation Apache Superset · superset +1
- CVE-2023-23752[20230201] - Core - Improper access check in webservice endpointsJoomla! Project Joomla! CMS
- CVE-2016-20017D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil
- CVE-2023-6548Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLICloud Software Group NetScaler ADC · Cloud Software Group N…
- CVE-2023-7101Arbitrary Code Execution (ACE) VulnerabilityDouglas Wilson Spreadsheet::ParseExcel
- CVE-2023-7024Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2024-21887A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autIvanti ICS · Ivanti IPS
- CVE-2023-46805An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accIvanti ICS · Ivanti IPS
- CVE-2023-49897An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.FXC AE1021PE · FXC AE1021
- CVE-2023-47565Legacy VioStor NVRQNAP Systems VioStor NVR
- CVE-2023-41266A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a
- CVE-2023-41265An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023
- CVE-2023-33107Integer Overflow or Wraparound in Graphics LinuxQualcomm Snapdragon
- CVE-2023-33106Use of Out-of-range Pointer Offset in GraphicsQualcomm Snapdragon
- CVE-2023-33063Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2022-22071Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2023-42917A memory corruption vulnerability was addressed with improved locking.Apple Safari · Apple macOS +1
- CVE-2023-42916An out-of-bounds read was addressed with improved input validation.Apple Safari · Apple macOS +1
- CVE-2023-6345Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 6 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.