CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 5 added in the last 7 days.
- CVE-2020-0638An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atMicrosoft Windows
- CVE-2019-8720A vulnerability was found in WebKit.webkitgtk
- CVE-2019-7287A memory corruption issue was addressed with improved input validation.Apple iOS
- CVE-2019-7286A memory corruption issue was addressed with improved input validation.Apple iOS · Apple macOS
- CVE-2019-5786Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memoryGoogle Chrome · puppeteer
- CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-sFacebook WhatsApp Desktop
- CVE-2019-1385An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiMicrosoft Windows
- CVE-2019-13720Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2019-11708Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxeMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2019-11707A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2019-1130An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0880A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of PrivilegMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0703An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB InformationMicrosoft Windows
- CVE-2019-0676An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully explMicrosoft Internet Explorer
- CVE-2018-8589An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of PrivileMicrosoft Windows Server · Microsoft Windows
- CVE-2018-5002Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability.Adobe Flash Player 29.0.0.171 and earlier versions
- CVE-2020-8816Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
- CVE-2020-17463FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
- CVE-2019-7238Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
- CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cre
- CVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.mongo-express
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiApache Solr · org.apache.solr:solr-core
- CVE-2017-17562Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
- CVE-2017-12149In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnRed Hat jbossas
- CVE-2010-1871JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for
- CVE-2022-26134In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attackAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2022-30525A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 fZyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firm… +6
- CVE-2022-22947In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatSpring Cloud Gateway · org.springframework.cloud:spring-clo…
- CVE-2020-11261Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2018-14847MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write a
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 5 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.