CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 3 added in the last 7 days.
- CVE-2018-0172A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticCisco IOS and IOS XE
- CVE-2018-0167Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software,Cisco IOS, IOS XE, and IOS XR
- CVE-2018-0161A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco CatalystCisco IOS
- CVE-2018-0159A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE SoftwaCisco IOS and IOS XE
- CVE-2018-0158A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unautheCisco IOS and IOS XE
- CVE-2018-0156A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attackerCisco IOS and IOS XE
- CVE-2018-0155A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco CataCisco IOS and IOS XE
- CVE-2018-0154A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unaCisco IOS
- CVE-2018-0151A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, reCisco IOS and IOS XE
- CVE-2022-24682An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the w
- CVE-2022-23134Possible view of the setup pages by unauthenticated users if config file already existsZabbix Frontend
- CVE-2022-23131Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAMLZabbix Frontend
- CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code executionAdobe Magento Commerce · magento/community-edition
- CVE-2022-0609Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome · CefSharp.Common +8
- CVE-2022-22620A use after free issue was addressed with improved memory management.Apple Safari · Apple macOS
- CVE-2021-36934Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21882Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-22587A memory corruption issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2021-20038A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticSonicWall SMA100
- CVE-2021-35247Improper Input Validation Vulnerability in Serv-USolarWinds Serv-U
- CVE-2021-40870An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922.
- CVE-2021-33766Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-32648Account Takeover in Octobercmsoctobercms october · october/system
- CVE-2021-25298Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-25297Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-25296Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-22991On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3,BIG-IP
- CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network accessVMware vRealize Operations
- CVE-2021-21315Command Injection Vulnerabilitysebhildebrandt systeminformation · systeminformation
- CVE-2021-36260A command injection vulnerability in the web server of some Hikvision product.
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 3 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.