CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 6 added in the last 7 days.
- CVE-2023-49103An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.
- CVE-2023-6448Unitronics VisiLogic uses a default administrative passwordUnitronics VisiLogic
- CVE-2023-4911Glibc: buffer overflow in ld.so leading to privilege escalationglibc · Red Hat Enterprise Linux +1
- CVE-2023-36584Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-1671A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution Sophos Web Appliance
- CVE-2020-2551Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components).Oracle WebLogic Server
- CVE-2023-36036Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36033Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36025Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-47246In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we
- CVE-2023-29552The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.
- CVE-2023-22518All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackApache Software Foundation Apache ActiveMQ · org.apache.… +1
- CVE-2023-46748BIG-IP Configuration utility authenticated SQL injection vulnerabilityF5 BIG-IP
- CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityF5 BIG-IP
- CVE-2023-36851Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary filesJuniper Networks Junos OS
- CVE-2023-36847Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2023-36846Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2023-36845Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variableJuniper Networks Junos OS
- CVE-2023-36844Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variablesJuniper Networks Junos OS
- CVE-2023-5631Stored XSS vulnerability in RoundcubeRoundcubemail
- CVE-2023-4966Unauthenticated sensitive information disclosureCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, asapisix · aspnet-core +20
- CVE-2023-41763Skype for Business Elevation of Privilege VulnerabilityMicrosoft Skype for Business Server 2015 CU13 · Microsoft S…
- CVE-2023-36563Microsoft WordPad Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-21608Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-20109A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an Cisco IOS
- CVE-2023-20273A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the priCisco IOS XE Software
- CVE-2023-42824The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-40044WS_FTP Server Ad Hoc Transfer Module .NET Deserialization VulnerabilityProgress Software WS_FTP Server
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 6 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.