CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFProgress Software LoadMaster · Progress Software ECS Con… +2
- CVE-2025-68686An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,Fortinet FortiOS
- CVE-2026-63077In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocolJetBrains TeamCity
- CVE-2026-9198Unauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationIBM Langflow OSS
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-18556Unauthenticated administrative account takeoverN-able N-central
- CVE-2026-18577Incomplete patch leads to administrative account takeoverN-able N-central
- CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryWordPress
- CVE-2026-20316Cisco Secure Firewall Management Center Software Static Credential VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-16812VeloCloud Orchestrator OS Command InjectionArista Networks VeloCloud Orchestrator On-Prem
- CVE-2023-4346 KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked andKNX Association KNX Protocol Connection Authorization Option
- CVE-2026-56155Active Directory Federation Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-50522Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-16232Authentication Bypass in the SmartConsole Login Process Using an Application Tokencheckpoint Quantum Security Management · checkpoint Multi-D…
- CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionWordPress
- CVE-2026-0770Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityLangflow
- CVE-2021-27137An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.DD-WRT
- CVE-2026-58644Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-39808A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thFortinet FortiSandbox
- CVE-2026-25089A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 thFortinet FortiSandbox
- CVE-2026-46817Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).Oracle Payments
- CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-15410Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance ManSonicWall SMA1000
- CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.SonicWall SMA1000
- CVE-2008-4128Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Serv
- CVE-2026-56291Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1balbooa.com Balbooa Forms extension for Joomla
- CVE-2026-48939Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15icagenda.com iCagenda extension for Joomla
- CVE-2026-56290Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0JoomlaCK.fr Page Builder CK extension for Joomla
- CVE-2026-55255Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flowlangflow-ai langflow · langflow
- CVE-2026-48908Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2joomshaper.net SP Page Builder extension for Joomla
- CVE-2026-48282ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-48558SimpleHelp Authentication Bypass via Missing OIDC JWT Signature VerificationSimpleHelp
- CVE-2026-20262Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery VulnerabilityCisco Unified Communications Manager
- CVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlinkPTC Windchill PDMLink · PTC FlexPLM
- CVE-2026-34910A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute aUbiquiti UniFi OS Server · Ubiquiti UDM +29
- CVE-2026-34909A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uUbiquiti UniFi OS Server · Ubiquiti Express +29
- CVE-2026-34908A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthUbiquiti UniFi OS Server · Ubiquiti UDM +29
- CVE-2025-67038Lantronix EDS5000, G520, and X300 OS Command InjectionLantronix EDS5000 series · Lantronix G520 series +3
- CVE-2026-7473Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassArista Networks EOS
- CVE-2026-20245Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation VulnerabilityCisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…
- CVE-2026-11645Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sanGoogle Chrome
- CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpointsBerriAI litellm · litellm
- CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseSplunk Enterprise
- CVE-2026-48907Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5joomlacontenteditor.net Joomla Content Editor (JCE) extensi…
- CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service VulnerabilitySolarWinds Serv-U
- CVE-2026-54420LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTPLiteSpeed Technologies cPanel Plugin
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated userivanti Sentry
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.