Skip to content
root@infosec:~$

Known Exploited Vulnerabilities tracker

The CISA KEV catalog lists vulnerabilities with evidence of active exploitation. Patch deadlines apply to US federal agencies; for everyone else it is a patch-first list. This mirror is rebuilt whenever the wire republishes the catalog.

catalog v2026.11.04 · released · source CISA ↗

┌─ stat total

1768

vulnerabilities

┌─ stat last 30d

34

added in 30 days

┌─ stat ransomware

361

ransomware-linked

┌─ stat vendors

53

vendor pages

$ tail -n 100 /etc/kev/catalog

The 100 most recent additions.

100 / 100 rows

┌─ filter
  1. CVE-2024-27834

    Apple / Multiple Products

    Apple Multiple Products Improper Authentication Vulnerability

  2. CVE-2026-119977

    WordPress / WordPress Core

    WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

  3. CVE-2026-111357

    Ivanti / Connect Secure

    Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

  4. CVE-2026-118527

    Ivanti / Connect Secure

    Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

  5. CVE-2026-76418

    Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software

    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

  6. CVE-2026-97229

    GitLab / Community Edition and Enterprise Edition

    GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

  7. CVE-2026-41709

    Broadcom / VMware ESX

    Broadcom VMWare ESX Insufficient Logging Vulnerability

  8. CVE-2026-46300

    Linux / Kernel

    Linux Kernel Missing Initialization of a Variable Vulnerability

  9. CVE-2026-111497

    Google / Brotli

    Google Brotli Unchecked Return Value Vulnerability

  10. CVE-2026-48356

    Adobe / Commerce and Magento

    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

  11. CVE-2026-109618

    PHP Group / PHP

    PHP Memory Corruption Vulnerability

  12. CVE-2026-109619

    PHP Group / PHP

    PHP Stale Internal Request-State Vulnerability

  13. CVE-2026-110447

    Collabora / Collabora Online – Built-in CODE Server

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

  14. CVE-2026-114625

    Arista / VeloCloud Orchestrator

    Arista VeloCloud Orchestrator SQL Injection Vulnerability

  15. CVE-2026-106931

    EG Secure Solutions / SiteGuard Server Edition

    EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

  16. CVE-2026-110936

    Siemens / Software Center

    Siemens Software Center Uncontrolled Search Path Element Vulnerability

  17. CVE-2026-96652

    Plex / Media Server

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

  18. CVE-2026-96654

    Plex / Media Server

    Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

  19. CVE-2026-96655

    Plex / Media Server

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

  20. CVE-2026-96656

    Plex / Media Server

    Plex Media Server External Control of File Name or Path Vulnerability

  21. CVE-2025-61624

    Fortinet / Multiple Products

    Fortinet Multiple Products Path Traversal Vulnerability

  22. CVE-2026-102764

    BeyondTrust / Remote Support

    BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

  23. CVE-2026-21589

    Atlassian / Multiple Products

    Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

  24. CVE-2026-0322

    Palo Alto Networks / PAN-OS

    Palo Alto Networks PAN-OS Code Injection Vulnerability

  25. CVE-2026-105133

    Ahsay / AhsayCBS

    Ahsay AhsayCBS Improper Authentication Vulnerability

  26. CVE-2026-105134

    Ahsay / AhsayCBS

    Ahsay AhsayCBS Command Injection Vulnerability

  27. CVE-2026-76519

    Cisco / Secure Email Gateway

    Cisco Secure Email Gateway Relative Path Traversal Vulnerability

  28. CVE-2026-104935

    Ivanti / Connect Secure

    Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

  29. CVE-2026-96951

    Microsoft / Windows

    Microsoft Windows Command Injection Vulnerability

  30. CVE-2015-3306

    ProFTPD / ProFTPD

    ProFTPD Improper Access Control Vulnerability

  31. CVE-2015-5477

    ISC / BIND

    ISC BIND Data Processing Errors Vulnerability

  32. CVE-2016-3081

    Apache / Struts

    Apache Struts Command Injection Vulnerability

  33. CVE-2021-3199

    ONLYOFFICE / Docs

    ONLYOFFICE Docs Server Path Traversal Vulnerability

  34. CVE-2023-22894

    Strapi / Strapi

    Strapi Cleartext Storage of Sensitive Information Vulnerability

  35. CVE-2026-88779

    Citrix / NetScaler

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  36. CVE-2026-102489

    Zammad GmbH / Zammad

    Zammad GmbH Zammad Session Fixation Vulnerability

  37. CVE-2026-102490

    Zammad GmbH / Zammad

    Zammad GmbH Zammad Improper Privilege Management Vulnerability

  38. CVE-2026-104286

    Fortinet / FortiMail

    Fortinet FortiMail Path Traversal Vulnerability

  39. CVE-2026-76504

    Cisco / Catalyst SD-WAN Manager

    Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

  40. CVE-2026-86950

    Apple / Multiple Products

    Apple Multiple Products Out-of-Bounds Write Vulnerability

  41. CVE-2026-88771

    Citrix / NetScaler

    Citrix NetScaler Improper Input Validation Vulnerability

  42. CVE-2026-88772

    Citrix / NetScaler

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  43. CVE-2026-65660

    Microsoft / SharePoint

    Microsoft SharePoint Code Injection Vulnerability

  44. CVE-2026-67279

    MikroTik / RouterOS

    Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

  45. CVE-2026-87902

    WordPress / Core

    WordPress Core Remote File Inclusion Vulnerability

  46. CVE-2026-5430

    WSO2 / Multiple Products

    WSO2 Multiple Products Path Traversal Vulnerability

  47. CVE-2026-71362

    Adobe / Commerce and Magento

    Adobe Commerce and Magento Incorrect Authorization Vulnerability

  48. CVE-2026-85102

    Check Point / Multiple Products

    Check Point Multiple Products Improper Certificate Validation Vulnerability

  49. CVE-2026-93616

    Check Point / Multiple Products

    Check Point Multiple Products Path Traversal Vulnerability

  50. CVE-2026-93952

    Arista / VeloCloud Orchestrator

    Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

  51. CVE-2026-94127

    F5 / BIG-IP APM

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

  52. CVE-2026-7273

    Zyxel / GS1900 Series Switches

    Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

  53. CVE-2025-39682

    Linux / Kernel

    Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

  54. CVE-2025-39964

    Linux / Kernel

    Linux Kernel Race Condition Vulnerability

  55. CVE-2026-53266

    Linux / Kernel

    Linux Kernel Out-of-Bounds Write Vulnerability

  56. CVE-2026-58704

    Google / Pixel

    Google Pixel Improper Authorization Vulnerability

  57. CVE-2026-76460

    Cisco / Identity Services Engine

    Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

  58. CVE-2026-87886

    Acronis / Backup

    Acronis Backup Incorrect Default Permissions Vulnerability

  59. CVE-2026-76461

    Cisco / Secure Email Gateway

    Cisco Secure Email Gateway SQL Injection Vulnerability

  60. CVE-2026-42016

    JFrog / Artifactory

    JFrog Artifactory Incorrect Authorization Vulnerability

  61. CVE-2026-42018

    JFrog / Artifactory

    JFrog Artifactory Improper Authentication Vulnerability

  62. CVE-2026-84869

    ConnectWise / ScreenConnect

    ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

  63. CVE-2026-85706

    GitLab / Community Edition and Enterprise Edition

    GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

  64. CVE-2026-67277

    MikroTik / RouterOS

    MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

  65. CVE-2026-86060

    MikroTik / RouterOS

    MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

  66. CVE-2025-25249

    Fortinet / Multiple Products

    Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

  67. CVE-2026-19490

    Citrix / NetScaler

    Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

  68. CVE-2026-20079

    Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management

    Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

  69. CVE-2026-87491

    Google / Chromium V8

    Google Chromium V8 Out of Bounds Write Vulnerability

  70. CVE-2026-75650

    Adobe / Commerce and Magento

    Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

  71. CVE-2026-81963

    Microsoft / Windows

    Microsoft Windows Link Following Vulnerability

  72. CVE-2026-85880

    Microsoft / Windows

    Microsoft Windows Heap-Based Buffer Overflow Vulnerability

  73. CVE-2026-86218

    N-able / N-central

    N-able N-central Static Code Injection Vulnerability

  74. CVE-2026-85046

    Google / Chromium V8

    Google Chromium V8 Type Confusion Vulnerability

  75. CVE-2026-48710

    Kludex / Starlette

    Kludex Starlette HTTP Request/Response Smuggling Vulnerability

  76. CVE-2026-49869

    Kestra / Kestra OSS

    Kestra OSS OS Command Injection Vulnerability

  77. CVE-2026-59822

    BerriAI / LiteLLM

    BerriAI LiteLLM Improper Authentication Vulnerability

  78. CVE-2026-82329

    JFrog / Artifactory

    JFrog Artifactory Improper Authentication Vulnerability

  79. CVE-2026-83548

    SonicWall / SMA1000 Appliances

    SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

  80. CVE-2026-83549

    SonicWall / SMA1000 Appliances

    SonicWall SMA1000 Appliances OS Command Injection Vulnerability

  81. CVE-2026-9586

    Sangoma / Switchvox

    Sangoma Switchvox SQL Injection Vulnerability

  82. CVE-2026-81578

    PaperCut / NG/MF

    PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

  83. CVE-2026-82078

    PaperCut / NG/MF

    PaperCut NG/MF Unsafe Reflection Vulnerability

  84. CVE-2023-49105

    ownCloud / ownCloud

    ownCloud Improper Authentication Vulnerability

  85. CVE-2026-53362

    Linux / Kernel

    Linux Kernel Unspecified Vulnerability

  86. CVE-2026-66384

    JFrog / Artifactory

    JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

  87. CVE-2015-3246

    Red Hat / Libuser

    Red Hat Libuser Race Condition Vulnerability

  88. CVE-2015-5287

    Red Hat / Automatic Bug Reporting Tool

    Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

  89. CVE-2019-1068

    Microsoft / SQL Server

    Microsoft SQL Server Remote Code Execution Vulnerability

  90. CVE-2021-23758

    Ajax.NET Professional / Ajax.NET Professional

    Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

  91. CVE-2022-0995

    Linux / Kernel

    Linux Kernel Out-of-Bounds Write Vulnerability

  92. CVE-2026-8452

    Citrix / NetScaler ADC and NetScaler Gateway

    Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  93. CVE-2026-60004

    Gitea / Gitea

    Gitea Code Injection Vulnerability

  94. CVE-2026-21962

    Oracle / HTTP Server and Oracle Weblogic Server Proxy Plug-in

    Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

  95. CVE-2026-73570

    Synacor / Zimbra Collaboration Suite (ZCS)

    Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

  96. CVE-2026-72529

    TrueConf / Server

    TrueConf Server Missing Authentication for Critical Function Vulnerability

  97. CVE-2026-72530

    TrueConf / Server

    TrueConf Server Code Injection Vulnerability

  98. CVE-2026-64849

    MLflow / MLflow

    MLflow Server-Side Request Forgery Vulnerability

  99. CVE-2026-33824

    Microsoft / Internet Key Exchange (IKE) Service Extensions

    Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

  100. CVE-2026-55040

    Microsoft / SharePoint

    Microsoft SharePoint Weak Authentication Vulnerability

$ ls /kev/vendor/ | sort

Vendors with five or more catalog entries get a page.

┌─ man kev

What is KEV? The Known Exploited Vulnerabilities catalog is maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). It lists vulnerabilities that have evidence of active exploitation, not just a theoretical flaw.

The due dates in the catalog are binding for US federal agencies under binding operational directives. For everyone else they are a practical patch-first ordering: a vulnerability in KEV has already been used by someone, so it deserves attention before the long tail of CVEs.

Ransomware flags mark vulnerabilities that CISA has linked to known ransomware campaigns. Source: CISA Known Exploited Vulnerabilities catalog ↗.