CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2022-41073Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-3433Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2018-19323The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,
- CVE-2018-19322The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE
- CVE-2018-19321The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE
- CVE-2018-19320The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,
- CVE-2022-41352An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.
- CVE-2022-40684An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.Fortinet FortiOS, FortiProxy, FortiSwitchManager
- CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2022-41040Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2022-37969Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-27593DeadBolt RansomwareQNAP Systems Photo Station
- CVE-2018-6530OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous
- CVE-2018-13374A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtFortinet FortiOS, fortiADC
- CVE-2022-26352An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02.
- CVE-2022-2294Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2022-37042Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.
- CVE-2022-27925Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.
- CVE-2022-30333RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonst
- CVE-2022-27924Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta
- CVE-2022-29499The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.
- CVE-2021-4034A local privilege escalation vulnerability was found on polkit's pkexec utility.polkit
- CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-7195This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2019-7194This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2019-7193This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.QNAP NAS devices
- CVE-2019-7192This improper access control vulnerability allows remote attackers to gain unauthorized access to the system.QNAP NAS devices running Photo Station
- CVE-2022-26134In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attackAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2016-0034Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary c
- CVE-2013-3993IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access un
- CVE-2013-0431Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-
- CVE-2013-0422Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBean
- CVE-2013-0074Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which
- CVE-2012-1710Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers t
- CVE-2010-1428The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09
- CVE-2010-0738The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 a
- CVE-2018-19953If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.QNAP Systems QTS
- CVE-2018-19949If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.QNAP Systems QTS
- CVE-2018-19943If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.QNAP Systems QTS
- CVE-2017-18362ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac
- CVE-2017-0147The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2016-3351Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, a
- CVE-2020-0638An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atMicrosoft Windows
- CVE-2019-1385An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiMicrosoft Windows
- CVE-2019-1130An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows Server · Microsoft Windows
- CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-29464Certain WSO2 products allow unrestricted file upload with resultant remote code execution.
- CVE-2018-6882Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7
- CVE-2019-16057The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.