CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2024-57727SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re
- CVE-2020-29574An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s
- CVE-2025-23006Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) andSonicWall SMA1000
- CVE-2024-55591An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-48365Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.
- CVE-2025-0282A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti NeuIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2024-55550Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insu
- CVE-2024-41713A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenti
- CVE-2024-55956In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit
- CVE-2024-50623In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download th
- CVE-2024-51378getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat
- CVE-2024-11667A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seriZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2023-28461Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.
- CVE-2024-9474PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-0012PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-49039Windows Task Scheduler Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-51567upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
- CVE-2024-38094Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-40711A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).Veeam Backup and Recovery
- CVE-2024-9680An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-30088Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-0618A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'MicrMicrosoft SQL Server
- CVE-2024-6670WhatsUp Gold HasErrors SQL Injection Authentication Bypass VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-40766An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorizedSonicWall SonicOS
- CVE-2017-1000253Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86
- CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-37085VMware ESXi contains an authentication bypass vulnerability.VMware ESXi · VMware Cloud Foundation
- CVE-2024-23692Rejetto HTTP File Server 2.3m Unauthenticated RCERejetto HTTP File Server
- CVE-2024-26169Windows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-4577Argument Injection in PHP-CGIPHP Group PHP
- CVE-2024-24919Information disclosurecheckpoint Check Point Quantum Gateway, Spark Gateway and C…
- CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2023-43208NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.
- CVE-2024-30051Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2023-48788A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.Fortinet FortiClientEMS
- CVE-2021-44529A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code witIvanti EPM
- CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possibleJetBrains TeamCity
- CVE-2024-21338Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-1709Authentication bypass using an alternate path or channelConnectWise ScreenConnect
- CVE-2020-3259Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2024-21412Internet Shortcut Files Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortFortinet FortiOS · Fortinet FortiProxy
- CVE-2024-21893A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) Ivanti ICS · Ivanti IPS
- CVE-2023-22527A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resouIvanti EPMM
- CVE-2024-21887A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autIvanti ICS · Ivanti IPS
- CVE-2023-46805An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accIvanti ICS · Ivanti IPS
- CVE-2023-29357Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft SharePoint Server
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.