CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 5 added in the last 7 days.
- CVE-2020-8193Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and CCitrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
- CVE-2020-7961Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web sercom.liferay.portal:com.liferay.portal.kernel
- CVE-2020-6820Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6819Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6418Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2020-6287SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows anSAP SE SAP NetWeaver AS JAVA
- CVE-2020-6207SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication forSAP SE SAP Solution Manager
- CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User InteBIG-IP
- CVE-2020-5849Unraid 6.8.0 allows authentication bypass.
- CVE-2020-5847Unraid through 6.8.0 allows Remote Code Execution.
- CVE-2020-5735Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777.Amcrest
- CVE-2020-4430IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system.IBM Data Risk Manager
- CVE-2020-4428IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the systemIBM Data Risk Manager
- CVE-2020-4427IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configIBM Data Risk Manager
- CVE-2020-4006VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerabiliVMware Workspace One Access (Access), VMware Workspace One…
- CVE-2020-3992OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a VMware ESXi
- CVE-2020-3952Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller…VMware vCenter Server
- CVE-2020-3950VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior bVMware Fusion, VMware Remote Console for Mac and Horizon Cl…
- CVE-2020-3580Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2020-3569Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesCisco IOS XR Software
- CVE-2020-3566Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityCisco IOS XR Software
- CVE-2020-3452Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2020-3161Cisco IP Phones Web Server Remote Code Execution and Denial of Service VulnerabilityCisco IP phone
- CVE-2020-3118Cisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityCisco IOS XR Software
- CVE-2020-29583Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password.
- CVE-2020-29557An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20.
- CVE-2020-27950A memory initialization issue was addressed.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-27932A type confusion issue was addressed with improved state handling.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-27930A memory corruption issue was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-26919NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 5 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.