CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 4 added in the last 7 days.
- CVE-2023-1389TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form oTP-Link Archer AX21
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2023-28432Minio Information Disclosure in Cluster Deploymentminio
- CVE-2023-27350This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).PaperCut NG
- CVE-2023-2136Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2017-6742A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to rCisco IOS XE Software · IntelliShield Universal Product
- CVE-2023-2033Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2019-8526A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2023-29492Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account.
- CVE-2023-20963In WorkSource, there is a possible parcel mismatch.Android
- CVE-2023-28252Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28206An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2023-28205A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-26083Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver a
- CVE-2021-27878An issue was discovered in Veritas Backup Exec before 21.2.
- CVE-2021-27877An issue was discovered in Veritas Backup Exec before 21.2.
- CVE-2021-27876An issue was discovered in Veritas Backup Exec before 21.2.
- CVE-2019-1388An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'WinMicrosoft Windows
- CVE-2022-27926A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo
- CVE-2023-0266Use after free in SNDRV_CTL_IOCTL_ELEM in Linux KernelLinux Kernel
- CVE-2022-42948Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components.
- CVE-2022-39197An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTM
- CVE-2022-38181The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled.
- CVE-2022-3038Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2022-22706Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages.
- CVE-2021-30900An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS
- CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious clisamba
- CVE-2013-3163Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
- CVE-2023-26360Adobe ColdFusion Improper Access Control Arbitrary code executionAdobe ColdFusion
- CVE-2023-24880Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 4 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.