CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 6 added in the last 7 days.
- CVE-2023-24489A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthentCitrix ShareFile Storage Zones Controller
- CVE-2023-38180.NET and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft ASP.NET Core +6
- CVE-2023-36884Windows Search Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2017-18368The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in
- CVE-2023-35081A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatIvanti EPMM
- CVE-2023-37580Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
- CVE-2023-38606This issue was addressed with improved state management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-35078An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appliIvanti Endpoint Manager Mobile
- CVE-2023-38205ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298Adobe ColdFusion
- CVE-2023-29298Adobe ColdFusion Improper Access Control Security feature bypassAdobe ColdFusion
- CVE-2023-3519Unauthenticated remote code executionCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-37450The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2022-29303SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
- CVE-2023-36874Windows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC +2
- CVE-2023-32049Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-32046Windows MSHTML Platform Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-31199Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito
- CVE-2021-29256.
- CVE-2021-25489Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format stSamsung Mobile Devices
- CVE-2021-25487Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it resSamsung Mobile Devices
- CVE-2021-25395A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilSamsung Mobile Devices
- CVE-2021-25394A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radioSamsung Mobile Devices
- CVE-2021-25372An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.Samsung Mobile Devices
- CVE-2021-25371A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.Samsung Mobile Devices
- CVE-2019-20500D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality i
- CVE-2019-17621The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec
- CVE-2023-32439A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-32435A memory corruption issue was addressed with improved state management.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32434An integer overflow was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS +1
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 6 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.