CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2025-48543In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.Google Android
- CVE-2025-38352posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()Linux
- CVE-2025-9377Authenticated RCE via Parental Control command injectionTP-Link Systems Archer C7(EU) · TP-Link Systems TL-WR841N/N…
- CVE-2023-50224TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure VulnerabilityTP-Link TL-WR841N · TP-Link TL-WR841ND +20
- CVE-2025-55177Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25Facebook WhatsApp Desktop for Mac · Facebook WhatsApp Bu… +1
- CVE-2020-24363TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request
- CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEFreePBX endpoint
- CVE-2025-48384Git allows arbitrary code execution through broken config quotinggit
- CVE-2024-8069Limited remote code execution with privilege of a NetworkService Account accessCitrix Session Recording
- CVE-2024-8068Privilege escalation to NetworkService Account accessCitrix Session Recording
- CVE-2025-43300An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2025-54948A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious Trend Micro Apex One
- CVE-2025-8088Path traversal vulnerability in WinRARwin.rar WinRAR
- CVE-2013-3893Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote a
- CVE-2007-0671Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assist
- CVE-2025-7775Memory overflow vulnerability leading to Remote Code Execution and/or Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2022-40799Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the
- CVE-2020-25079An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
- CVE-2020-25078An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
- CVE-2025-8876Command Injection VulnerabilityN-able N-central
- CVE-2025-8875Insecure Deserialization VulnerabilityN-able N-central
- CVE-2025-20337Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2025-20281Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software
- CVE-2023-2533PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRFPaperCut NG/MF
- CVE-2025-6558Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiallGoogle Chrome
- CVE-2025-54309CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allowsCrushFTP
- CVE-2025-2776SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity InjectionSysAid On-Prem
- CVE-2025-2775SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity InjectionSysAid On-Prem
- CVE-2025-25257An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiWeb
- CVE-2025-47812In Wing FTP Server before 7.4.4.wftpserver Wing FTP Server
- CVE-2019-9621Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3
- CVE-2019-5418There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accephttps://github.com/rails/rails · actionview
- CVE-2016-10033The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail cphpmailer/phpmailer
- CVE-2014-3931fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corru
- CVE-2025-49706Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-49704Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-6554Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML paGoogle Chrome
- CVE-2025-48928The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" inTeleMessage service
- CVE-2025-48927The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploitTeleMessage service
- CVE-2025-53770Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-6543Memory overflow vulnerability leading to unintended control flow and Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2024-54085Redfish Authentication BypassAMI MegaRAC-SPx
- CVE-2024-0769D-Link DIR-859 HTTP POST Request hedwig.cgi path traversalD-Link DIR-859
- CVE-2019-6693Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to theFortinet FortiGate
- CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
- CVE-2023-0386A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the LinuxKernel
- CVE-2025-43200This issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2023-33538TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component
- CVE-2025-33053Internet Shortcut Files Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-24016Remote code execution in Wazuh serverwazuh · github.com/wazuh/wazuh
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.