CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 5 added in the last 7 days.
- CVE-2020-1040A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-10221lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacte
- CVE-2020-1020A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyMicrosoft Windows
- CVE-2020-10199Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).org.sonatype.nexus:nexus-extdirect
- CVE-2020-10189Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage
- CVE-2020-10181goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (admini
- CVE-2020-10148SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commandsSolarWinds Orion Platform
- CVE-2020-0986An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows
- CVE-2020-0968A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2020-0938A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyMicrosoft Windows
- CVE-2020-0878Microsoft Browser Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2020-0688A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akMicrosoft Exchange Server
- CVE-2020-0683An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer EleMicrosoft Windows
- CVE-2020-0674A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2020-0646A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2… +4
- CVE-2020-0601A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacMicrosoft Windows · stdlib
- CVE-2020-0069In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization aAndroid
- CVE-2020-0041In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2019-9978The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter
- CVE-2019-9082ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app
- CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customizat
- CVE-2019-7481Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.SonicWall SMA100
- CVE-2019-6223A logic issue existed in the handling of Group FaceTime calls.Apple iOS · Apple macOS
- CVE-2019-5591A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive informationFortinet FortiOS
- CVE-2019-5544OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.ESXi and Horizon DaaS
- CVE-2019-4716IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "adminIBM Planning Analytics
- CVE-2019-3398Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource.Atlassian Confluence
- CVE-2019-3396The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.1Atlassian Confluence Server
- CVE-2019-2215A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.Android
- CVE-2019-20085TVT NVMS-1000 devices allow GET /..
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 5 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.