CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Accesscheckpoint Quantum Security Gateway · checkpoint Spark Fire…
- CVE-2026-48027Compromised Nx Console version 18.95.0nrwl nx-console
- CVE-2026-45321Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys@tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82
- CVE-2026-45247Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object InjectionMirasvit Full Page Cache Warmer for Magento
- CVE-2025-48595In multiple locations, there is a possible way to achieve code execution due to an integer overflow.Google Android
- CVE-2022-0492A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.kernel
- CVE-2024-21182Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2026-34926A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key tableTrend Micro TrendAI Apex One
- CVE-2025-34291Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCELangflow
- CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2026-41091Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2010-0806Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote at
- CVE-2010-0249Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2
- CVE-2009-3459Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to exe
- CVE-2009-1537Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows
- CVE-2008-4250The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta a
- CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-8398A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)AVB Disc Soft DAEMON Tools Lite
- CVE-2026-48172LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.LiteSpeed Technologies cPanel Plugin · LiteSpeed Technologi…
- CVE-2026-42897Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004Drupal core · drupal +1
- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeLinux
- CVE-2026-32202Windows Shell Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-1708Improper limitation of a pathname to a restricted directory (“path traversal”)ConnectWise ScreenConnect
- CVE-2026-42208LiteLLM: SQL injection in Proxy API key verificationBerriAI litellm · litellm
- CVE-2026-6973An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with adminIvanti Endpoint Manager Mobile
- CVE-2026-0300PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-29635A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote
- CVE-2024-7399Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackSamsung Electronics MagicINFO 9 Server
- CVE-2024-57728SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a
- CVE-2024-57726SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce
- CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypassmarimo-team marimo · marimo
- CVE-2026-33825Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2025-32975Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341
- CVE-2025-2749Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEKentico Xperience
- CVE-2024-27199In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possibleJetBrains TeamCity
- CVE-2023-27351This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).PaperCut NG
- CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login FlowWebPros cPanel · WebPros WP Squared +1
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansApache Software Foundation Apache ActiveMQ Broker · Apac… +3
- CVE-2026-32201Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2009-0238Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word
- CVE-2026-34621Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36424Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-21529Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2020-9715Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier havAdobe Acrobat and Reader
- CVE-2012-1854Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basi
- CVE-2026-20133A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affectCisco Catalyst SD-WAN Manager
- CVE-2026-20128Cisco Catalyst SD-WAN Manager Information Disclosure VulnerabilityCisco Catalyst SD-WAN Manager
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.