CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-20127Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2022-20775Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco Catalyst SD-WAN · Cisco SD-WAN vContainer +2
- CVE-2026-24423SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APISmarterTools SmarterMail
- CVE-2025-11953Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests@react-native-community/cli-server-api · @react-native-comm…
- CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command InjectionFreePBX filestore
- CVE-2021-39935An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2019-19006Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
- CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.Dell RecoverPoint for Virtual Machines
- CVE-2026-1731Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)BeyondTrust Remote Support(RS) & Privileged Remote Access
- CVE-2026-24061telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.GNU Inetutils
- CVE-2026-23760SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APISmarterTools SmarterMail
- CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-52691Upload Arbitrary FilesSmarterTools SmarterMail
- CVE-2018-14634An integer overflow flaw was found in the Linux kernel's create_elf_tables() function.The Linux Foundation kernel
- CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass VulnerabilitySolarWinds Web Help Desk
- CVE-2024-37079vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2025-68645A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper
- CVE-2025-54313eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.eslint-config-prettier · eslint-plugin-prettier +4
- CVE-2025-34026Versa Concerto Actuator Authentication Bypass Information LeakVersa Concerto
- CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryvitejs vite · vite
- CVE-2026-20045Cisco Unified Communications Products Remote Code Execution VulnerabilityCisco Unified Communications Manager · Cisco Unity Connecti…
- CVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2026-20805Desktop Window Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-8110File overwrite in file update API in GogsGogs · gogs.io/gogs
- CVE-2026-1281A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.Ivanti Endpoint Manager Mobile
- CVE-2026-24858An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.Fortinet FortiWeb · Fortinet FortiNAC-F +4
- CVE-2025-37164A remote code execution issue exists in HPE OneView.Hewlett Packard Enterprise (HPE) HPE OneView
- CVE-2009-0556Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to ex
- CVE-2025-14847Zlib compressed protocol header length confusion may allow memory readMongoDB Server
- CVE-2023-52163Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection.
- CVE-2025-59374"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced throASUS live update
- CVE-2025-43529A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-14611Gladinet CentreStack and TrioFox Hard Coded AES KeysGladinet CentreStack and TrioFox
- CVE-2025-14174Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memoGoogle Chrome
- CVE-2018-4063An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.Sierra Wireless
- CVE-2025-58360GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featuregeoserver · org.geoserver.web:gs-web-app +1
- CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-6218RARLAB WinRAR Directory Traversal Remote Code Execution VulnerabilityRARLAB WinRAR
- CVE-2025-66644Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.Array Networks ArrayOS AG
- CVE-2022-37055D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
- CVE-2025-14733WatchGuard Firebox iked Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2025-40602A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).SonicWall SMA1000
- CVE-2025-20393Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityCisco Secure Email
- CVE-2021-26828OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP f
- CVE-2025-59718A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiFortinet FortiSwitchManager · Fortinet FortiOS +1
- CVE-2025-48633In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic Google Android
- CVE-2025-48572In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.Google Android
- CVE-2021-26829OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0…Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-61757Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).Oracle Identity Manager
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.