CISA KEV catalog: known exploited vulnerabilities
Every CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 1,767 in all, 7 added in the last 7 days. Subscribe by RSS.
- CVE-2026-59310vCenter directory-traversal vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +3
- CVE-2026-63077In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocolJetBrains TeamCity
- CVE-2026-20316Cisco Secure Firewall Management Center Software Static Credential VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-15410Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance ManSonicWall SMA1000
- CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.SonicWall SMA1000
- CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlinkPTC Windchill PDMLink · PTC FlexPLM
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Accesscheckpoint Quantum Security Gateway · checkpoint Spark Fire…
- CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-48027Compromised Nx Console version 18.95.0nrwl nx-console
- CVE-2026-45321Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys@tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82
- CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login FlowWebPros cPanel · WebPros WP Squared +1
- CVE-2024-1708Improper limitation of a pathname to a restricted directory (“path traversal”)ConnectWise ScreenConnect
- CVE-2024-57728SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a
- CVE-2024-57726SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce
- CVE-2026-33825Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2024-27199In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possibleJetBrains TeamCity
- CVE-2023-27351This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).PaperCut NG
- CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-21529Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityCisco Secure Firewall Management Center
- CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilitySolarWinds Web Help Desk
- CVE-2026-1731Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)BeyondTrust Remote Support(RS) & Privileged Remote Access
- CVE-2026-24423SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APISmarterTools SmarterMail
- CVE-2026-23760SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APISmarterTools SmarterMail
- CVE-2025-52691Upload Arbitrary FilesSmarterTools SmarterMail
- CVE-2025-14733WatchGuard Firebox iked Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0…Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-61884Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).Oracle Configurator
- CVE-2025-61882Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).Oracle Concurrent Processing
- CVE-2021-43226Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License ServletFortra GoAnywhere MFT
- CVE-2025-8088Path traversal vulnerability in WinRARwin.rar WinRAR
- CVE-2025-49706Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-49704Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-53770Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
- CVE-2019-6693Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to theFortinet FortiGate
- CVE-2025-42999Insecure Deserialization in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codelangflow-ai langflow · langflow +1
- CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-31161CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy…CrushFTP
- CVE-2025-22457A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTAIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2025-24472An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.Fortinet FortiOS · Fortinet FortiProxy
- CVE-2025-26633Microsoft Management Console Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability.VMware ESXi · VMware Cloud Foundation +2
- CVE-2018-8639An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2024-53704An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.SonicWall SonicOS
FAQ
CISA KEV questions.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of vulnerabilities with reliable evidence of active exploitation. A CVE is added only when it has a CVE id, is being exploited in the wild, and has clear remediation guidance. cve.now reads the catalog straight from CISA every few minutes and links each entry to its full record: severity, affected versions, fixes and public exploits.
How many vulnerabilities are in CISA KEV?
The catalog lists 1,767 vulnerabilities as of 2026-11-03. 7 were added in the last 7 days.
What does the KEV due date mean?
Binding Operational Directive 22-01 requires US federal civilian agencies to fix each KEV vulnerability by its due date, usually three weeks after it is added. Other organizations use the same list and deadlines to prioritize patching.
Which vendors have the most KEV entries?
Microsoft (390), Cisco (102), Apple (95) have the most entries. Each vendor with three or more entries has its own page on cve.now.
What does known ransomware use mean?
CISA marks a KEV entry "Known" when it has evidence that ransomware campaigns exploit it. 361 entries carry that mark.
How do I get alerts for new KEV entries?
Subscribe to https://cve.now/kev/feed in any RSS reader, or install Slack's RSS app and run /feed subscribe https://cve.now/kev/feed in a channel. New entries appear within minutes of CISA publishing them.