CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,768 in all, 4 added in the last 7 days.
- CVE-2023-23397Microsoft Outlook Elevation of Privilege VulnerabilityMicrosoft Office LTSC · Microsoft Outlook +2
- CVE-2022-41328A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 thFortinet FortiOS
- CVE-2021-39144XStream is vulnerable to a Remote Command Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2020-5741Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.Plex Media Server
- CVE-2022-35914/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UIApache Software Foundation Apache Spark · org.apache.spa… +1
- CVE-2022-28810Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS command
- CVE-2022-36537ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent org.zkoss.zk:zk
- CVE-2022-47986IBM Aspera Faspex code executionIBM Aspera Faspex
- CVE-2022-41223The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injec
- CVE-2022-40765A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker wit
- CVE-2022-46169Unauthenticated Command Injectioncacti
- CVE-2023-23529A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-23376Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-21823Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Office for Android · Microsoft Office for iOS +2
- CVE-2023-21715Microsoft Publisher Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2023-0669Fortra GoAnywhere MFT License Response Servlet Command InjectionFortra Goanywhere MFT
- CVE-2022-24990TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a
- CVE-2015-2291(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to c
- CVE-2023-22952In SugarCRM before 12.0.
- CVE-2022-21587Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).Oracle Web Applications Desktop Integrator
- CVE-2017-11357Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attacke
- CVE-2022-47966Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San
- CVE-2022-44877login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comma
- CVE-2023-21674Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-41080Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2018-5430TIBCO JasperReports Server Information Disclosure VulnerabilityTIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- CVE-2018-18809TIBCO JasperReports Library Directory Traversal VulnerabilityTIBCO Software TIBCO JasperReports Library · TIBCO Softw… +2
- CVE-2022-42856A type confusion issue was addressed with improved state handling.Apple tvOS
- CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,768 vulnerabilities as of 2026-11-04. 4 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.