CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 3 added in the last 7 days.
- CVE-2021-36948Windows Update Medic Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36942Windows LSA Spoofing VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-36742A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.Trend Micro Apex One · Trend Micro OfficeScan +1
- CVE-2021-36741An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1Trend Micro Apex One · Trend Micro OfficeScan +1
- CVE-2021-35464ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.
- CVE-2021-35395Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the
- CVE-2021-35211Serv-U Remote Memory Escape VulnerabilitySolarWinds Serv-U Managed File Transfer Server and Serv-U S…
- CVE-2021-34523Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-34448Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows
- CVE-2021-33771Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-33742Windows MSHTML Platform Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-33739Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31979Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31956Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31955Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-31755An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.
- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-31201Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31199Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-30869A type confusion issue was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS
- CVE-2021-30860An integer overflow was addressed with improved input validation.Apple macOS · Apple watchOS +1
- CVE-2021-30858A use after free issue was addressed with improved memory management.Apple macOS · Apple iOS
- CVE-2021-30807A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2021-30762A use after free issue was addressed with improved memory management.Apple iOS
- CVE-2021-30761A memory corruption issue was addressed with improved state management.Apple iOS
- CVE-2021-30713A permissions issue was addressed with improved validation.Apple macOS
- CVE-2021-30666A buffer overflow issue was addressed with improved memory handling.Apple iOS
- CVE-2021-30665A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2021-30663An integer overflow was addressed with improved input validation.Apple macOS
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 3 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.