CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 5 added in the last 7 days.
- CVE-2015-5122Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0
- CVE-2015-3113Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11
- CVE-2015-2502Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
- CVE-2015-0313Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before
- CVE-2015-0311Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu
- CVE-2014-9163Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.
- CVE-2021-34527Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +2
- CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack · Microsoft… +3
- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-22900A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administraPulse Secure Secure
- CVE-2021-22899A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote coPulse Connect Secure
- CVE-2021-22894A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary cPulse Connect Secure
- CVE-2021-22893Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share BrowsePulse Connect Secure
- CVE-2021-1905Possible use after free due to improper handling of memory mapping of multiple processes simultaneously.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-9859A memory consumption issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-9819A memory consumption issue was addressed with improved memory handling.Apple iOS · Apple iOS-1 +2
- CVE-2020-9818An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple iOS-1 +1
- CVE-2020-8657An issue was discovered in EyesOfNetwork 5.3.
- CVE-2020-8655An issue was discovered in EyesOfNetwork 5.3.
- CVE-2020-8644PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
- CVE-2020-8599Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary datTrend Micro OfficeScan, Trend Micro Apex One
- CVE-2020-8515DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code executi
- CVE-2020-8468Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escTrend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…
- CVE-2020-8467A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to eTrend Micro OfficeScan, Trend Micro Apex One
- CVE-2020-8260A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code ePulse Connect Secure / Pulse Policy Secure
- CVE-2020-8243A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template toPulse Connect Secre
- CVE-2020-8196Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and CCitrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
- CVE-2020-8195Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andCitrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 5 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.