CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2025-13223Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2025-9242WatchGuard Firebox iked Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2025-62215Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-12480Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages evenTrioFox
- CVE-2025-21042Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2025-58034An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiWeb
- CVE-2025-48703CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in tcentos-webpanel CentOS Web Panel
- CVE-2025-11371Gladinet CentreStack and TrioFox Local File Inclusion FlawGladinet CentreStack and TrioFox
- CVE-2025-64446A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9Fortinet FortiWeb
- CVE-2025-41244VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)VMware VCF operations · VMware tools +4
- CVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwikixwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2025-6205Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · magento/community-edition +1
- CVE-2025-61932Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, MOTEX Lanscope Endpoint Manager (On-Premises) (Client progr…
- CVE-2025-61884Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).Oracle Configurator
- CVE-2025-33073Windows SMB Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-2747Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication BypassKentico Xperience
- CVE-2025-2746Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassKentico Xperience
- CVE-2022-48503The issue was addressed with improved bounds checks.Apple macOS · Apple tvOS +3
- CVE-2025-54253Adobe Experience Manager | Incorrect Authorization (CWE-863)Adobe Experience Manager
- CVE-2025-59230Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-47827In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.
- CVE-2025-24990Windows Agere Modem Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2016-7836SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection withSky Co. SKYSEA Client View
- CVE-2021-43798Grafana path traversalgrafana · github.com/grafana/grafana
- CVE-2025-27915An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.
- CVE-2025-61882Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).Oracle Concurrent Processing
- CVE-2021-43226Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACELinux Kernel
- CVE-2013-3918The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V
- CVE-2011-3402Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3,
- CVE-2010-3962Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relate
- CVE-2010-3765Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x bef
- CVE-2025-4008Arbitrary Command Injection in Smartbedded MeteoBridgeSmartbedded MeteoBridge
- CVE-2025-21043Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2017-1000353Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.org.jenkins-ci.main:jenkins-core
- CVE-2015-7755Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before
- CVE-2014-6278GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att
- CVE-2025-59689Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment.Libraesva Email Security Gateway
- CVE-2025-32463Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the…Sudo project Sudo
- CVE-2025-20352A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the fCisco IOS
- CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License ServletFortra GoAnywhere MFT
- CVE-2021-21311SSRF in adminervrana adminer · vrana/adminer
- CVE-2025-10585Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2025-5086Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2025-20362Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2025-20333A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2025-53690Sitecore Products ViewState Deserialization VulnerabilitySitecore Experience Manager · Sitecore Experience Platform
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.