CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCEerlang otp
- CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of
- CVE-2025-5419Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2025-27038Use After Free in GraphicsQualcomm Snapdragon
- CVE-2025-21480Incorrect Authorization in Graphics WindowsQualcomm Snapdragon
- CVE-2025-21479Incorrect Authorization in GraphicsQualcomm Snapdragon
- CVE-2025-3935ScreenConnect Exposure to ASP.NET ViewState Code InjectionConnectWise ScreenConnect
- CVE-2025-35939Craft CMS stores user-provided content in session filesCraft CMS · craftcms/cms
- CVE-2024-56145RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmscraftcms cms · craftcms/cms
- CVE-2023-39780On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm…ASUS RT-AX55
- CVE-2021-32030The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio
- CVE-2025-4632Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackSamsung Electronics MagicINFO 9 Server
- CVE-2025-4428Remote Code ExecutionIvanti Endpoint Manager Mobile
- CVE-2025-4427Authentication BypassIvanti Endpoint Manager Mobile
- CVE-2025-27920Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling.Srimax Output Messenger
- CVE-2024-27443An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.
- CVE-2024-11182Stored XSS vulnerability in MDaemon Email ServerMDaemon Email Server
- CVE-2023-38950A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via suppl
- CVE-2025-42999Insecure Deserialization in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2024-12987DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injectionDrayTek Vigor2960 · DrayTek Vigor300B
- CVE-2025-32756A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versionFortinet FortiNDR · Fortinet FortiCamera +3
- CVE-2025-32709Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-32706Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-32701Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-30400Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-30397Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows
- CVE-2025-47729The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which iTeleMessage archiving backend
- CVE-2024-6047GeoVision EOL device - OS Command InjectionGeoVision GV_DSP_LPR_V2 · GeoVision GV_IPCAMD_GV_BX1500 +17
- CVE-2024-11120GeoVision EOL devices - OS Command InjectionGeoVision GV-VS12 · GeoVision GV-VS11 +2
- CVE-2025-27363An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parseFreeType
- CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codelangflow-ai langflow · langflow +1
- CVE-2025-34028Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path TraversalCommvault Command Center Innovation Release
- CVE-2024-58136Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iyiiframework Yii · yiisoft/yii2
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.Apache Software Foundation Apache HTTP Server
- CVE-2023-44221Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrSonicWall SMA100
- CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2025-42599Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability.QUALITIA CO. Active! mail
- CVE-2025-3928Commvault Web Server unspecified vulnerabilityCommvault Web Server
- CVE-2025-1976Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6Brocade Fabric OS
- CVE-2025-31201This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-31200A memory corruption issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24054NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-20035Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary coSonicWall SMA100
- CVE-2024-53197ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesLinux
- CVE-2024-53150ALSA: usb-audio: Fix out of bounds reads when finding clock sourcesLinux
- CVE-2025-30406Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'Gladinet CentreStack
- CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-31161CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy…CrushFTP
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2024-20439A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by usCisco Smart License Utility
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.