CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,769 in all, 3 added in the last 7 days.
- CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftGoogle Chrome
- CVE-2021-21220Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heGoogle Chrome
- CVE-2021-21206Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-21193Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2021-21166Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMGoogle Chrome
- CVE-2021-21148Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2021-20090A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3
- CVE-2021-20023SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thSonicWall Email Security
- CVE-2021-20022SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to SonicWall Email Security
- CVE-2021-20021A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a craftedSonicWall Email Security
- CVE-2021-20016A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to accessSonicWall SMA100
- CVE-2021-1906Improper handling of address deregistration on failure can lead to new GPU address allocation failure.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1879This issue was addressed by improved management of object lifetimes.Apple iOS and iPadOS · Apple iOS +1
- CVE-2021-1871A logic issue was addressed with improved restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2021-1870A logic issue was addressed with improved restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2021-1782A race condition was addressed with improved locking.Apple iOS and iPadOS · Apple macOS
- CVE-2021-1732Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1675Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1647Microsoft Defender Remote Code Execution VulnerabilityMicrosoft System Center Endpoint Protection · Microsoft… +3
- CVE-2021-1498Cisco HyperFlex HX Command Injection VulnerabilitiesCisco HyperFlex HX Data Platform
- CVE-2021-1497Cisco HyperFlex HX Command Injection VulnerabilitiesCisco HyperFlex HX Data Platform
- CVE-2020-15999Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome · CefSharp.Common +3
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,769 vulnerabilities as of 2026-11-06. 3 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (96) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.