CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 3 added in the last 7 days.
- CVE-2010-3333Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office
- CVE-2010-0232The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windo
- CVE-2010-0188Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (a
- CVE-2009-3129Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offic
- CVE-2009-1123The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v
- CVE-2008-3431The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTL
- CVE-2008-2992Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file t
- CVE-2004-0210The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly b
- CVE-2002-0367smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which al
- CVE-2022-26486An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.Mozilla Firefox · Mozilla Thunderbird +1
- CVE-2022-26485Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.Mozilla Firefox · Mozilla Thunderbird +1
- CVE-2021-21973The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter ServVMware vCenter Server · VMware Cloud Foundation
- CVE-2022-20708Cisco Small Business RV Series Routers VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2022-20703Cisco Small Business RV Series Routers VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2022-20701Cisco Small Business RV Series Routers VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2022-20700Cisco Small Business RV Series Routers VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2022-20699Cisco Small Business RV Series Routers VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2021-41379Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-1938When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- CVE-2020-11899The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
- CVE-2019-16928Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846.
- CVE-2019-1652Cisco Small Business RV320 and RV325 Routers Command Injection VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2019-1297A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel · Microsoft Office
- CVE-2018-8581An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege VulnerabiMicrosoft Exchange Server
- CVE-2018-8298A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-0180Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attackCisco IOS
- CVE-2018-0179Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attackCisco IOS
- CVE-2018-0175Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOCisco IOS, IOS XE, and IOS XR
- CVE-2018-0174A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticCisco IOS and IOS XE
- CVE-2018-0173A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP VersioCisco IOS and IOS XE
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 3 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.