CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 3 added in the last 7 days.
- CVE-2014-6324The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wind
- CVE-2014-6287The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attacke
- CVE-2014-3120The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL exporg.elasticsearch:elasticsearch
- CVE-2014-0130Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails beforactionpack
- CVE-2013-5223Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev.
- CVE-2013-4810HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow rem
- CVE-2013-2251Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,org.apache.struts:struts2-core
- CVE-2012-1823sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle que
- CVE-2010-4345Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate confi
- CVE-2010-4344Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code
- CVE-2010-3035Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote atta
- CVE-2010-2861Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to re
- CVE-2009-2055Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an inval
- CVE-2009-1151Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inje
- CVE-2009-0927Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to e
- CVE-2005-2773HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1)
- CVE-2020-5135A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code SonicWall SonicOS
- CVE-2019-1405An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creationMicrosoft Windows
- CVE-2019-1322An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Microsoft Windows
- CVE-2019-1315An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error ReportMicrosoft Windows
- CVE-2019-1253An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerabMicrosoft Windows
- CVE-2019-1132An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1129An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
- CVE-2019-1069Task Scheduler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1064Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-0841An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
- CVE-2019-0543An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of
- CVE-2018-8120An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2017-0101The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, WMicrosoft Windows
- CVE-2016-3309The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 3 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.