CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-20122Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-48700An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1.
- CVE-2026-21643An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may aFortinet FortiClientEMS
- CVE-2026-3502TrueConf Client Update Integrity Verification BypassTrueConf Client
- CVE-2026-5281Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to executGoogle Chrome
- CVE-2026-1340A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.Ivanti Endpoint Manager Mobile
- CVE-2026-35616A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauFortinet FortiClientEMS
- CVE-2026-33634Trivy ecosystem supply chain briefly compromisedaquasecurity setup-trivy · aquasecurity trivy-action +6
- CVE-2026-33017Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpointlangflow-ai langflow · langflow
- CVE-2025-54068Livewire vulnerable to remote command execution during property update hydrationlivewire · livewire/livewire
- CVE-2025-43520A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43510A memory corruption issue was addressed with improved lock state checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-32432Craft CMS Allows Remote Code Executioncraftcms cms · craftcms/cms
- CVE-2025-31277The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-3055Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
- CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import dZimbra Collaboration
- CVE-2025-53521BigIP APM VulnerabilityF5 BIG-IP
- CVE-2025-47813loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UIwftpserver Wing FTP Server
- CVE-2026-3910Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-3909Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a cGoogle Chrome
- CVE-2023-43000A use-after-free issue was addressed with improved memory management.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-41974A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS
- CVE-2021-30952An integer overflow was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2021-22681Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix contRockwell Automation Studio 5000 Logix Designer, RSLogix 500…
- CVE-2017-7921An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Hikvision Cameras
- CVE-2025-68613n8n Vulnerable to Remote Code Execution via Expression Injectionn8n-io n8n · n8n
- CVE-2026-22719VMware Aria Operations command injection vulnerabilityVMware Aria Operations · VMware Cloud Foundation Operati… +2
- CVE-2026-21385Integer Overflow or Wraparound in GraphicsQualcomm Snapdragon
- CVE-2026-1603An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific storedIvanti Endpoint Manager
- CVE-2021-22054VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5VMware Workspace ONE UEM console
- CVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-20963Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-25108FileZen contains an OS command injection vulnerability.Soliton Systems K.K. FileZen
- CVE-2025-68461Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG dRoundcube Webmail
- CVE-2025-49113Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in aRoundcube Webmail · roundcube/roundcubemail
- CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilitySolarWinds Web Help Desk
- CVE-2021-22175When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versionsGitLab
- CVE-2026-2441Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2024-7694TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File UploadTeamT5 ThreatSonar Anti-Ransomware
- CVE-2020-7796Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
- CVE-2008-0015Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques
- CVE-2026-20700A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-15556Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verificationnotepad-plus-plus
- CVE-2024-43468Microsoft Configuration Manager Remote Code Execution VulnerabilityMicrosoft Configuration Manager
- CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21525Windows Remote Access Connection Manager Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-21519Desktop Window Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21514Microsoft Word Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityMicrosoft Windows
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.