CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2026-81963 KEV |
[KEV] Vulnerability in Microsoft Windows Update Stack (CVE-2026-81963)
Vulnerability in Microsoft Windows Update Stack (CVE-2026-81963). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-75650 KEV |
[KEV] Vulnerability in Adobe Commerce (CVE-2026-75650)
Vulnerability in Adobe Commerce (CVE-2026-75650). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-86218 KEV |
[KEV] Vulnerability in N-able N Central (CVE-2026-86218)
Vulnerability in N-able N Central (CVE-2026-86218). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-85046 KEV |
[KEV] Vulnerability in Google Chrome (CVE-2026-85046)
Vulnerability in Google Chrome (CVE-2026-85046). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-83549 KEV |
[KEV] OS Command Injection in Sonicwall Sma8200V (CVE-2026-83549)
OS command injection in Sonicwall Sma8200V (CVE-2026-83549). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-83548 KEV |
[KEV] Vulnerability in Sonicwall SMA1000 Appliance Work Place interface (CVE-2026-83548)
Vulnerability in Sonicwall SMA1000 Appliance Work Place interface (CVE-2026-83548). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-82329 KEV |
[KEV] Authentication Bypass in JFrog Artifactory (CVE-2026-82329)
Authentication bypass in JFrog Artifactory (CVE-2026-82329). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-9586 KEV |
[KEV] SQL Injection in Sangoma Switchvox SMB Edition (CVE-2026-9586)
SQL injection in Sangoma Switchvox SMB Edition (CVE-2026-9586). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-59822 KEV |
[KEV] Authentication Bypass in Berriai litellm (CVE-2026-59822)
Authentication bypass in Berriai litellm (CVE-2026-59822). Confidential information can be exposed externally. Exploitable via Authorization. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.84.0 or later.
|
|
| CVE-2026-49869 KEV |
[KEV] OS Command Injection in Kestra OSS (CVE-2026-49869)
OS command injection in Kestra OSS (CVE-2026-49869). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.0.45 or later.
|
|
| CVE-2026-48710 KEV |
[KEV] Vulnerability in Kludex Starlette (CVE-2026-48710)
Vulnerability in Kludex Starlette (CVE-2026-48710). Risk of unauthorized operations or information disclosure. Exploitable via GET /foo. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.0.1 or later.
|
|
| CVE-2026-82078 KEV |
[KEV] Vulnerability in PaperCut MF (CVE-2026-82078)
Vulnerability in PaperCut MF (CVE-2026-82078). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-81578 KEV |
[KEV] Vulnerability in PaperCut MF (CVE-2026-81578)
Vulnerability in PaperCut MF (CVE-2026-81578). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-49105 KEV |
[KEV] Authentication Bypass in ownCloud (CVE-2023-49105)
Authentication bypass in ownCloud (CVE-2023-49105). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-66384 KEV |
[KEV] Path Traversal in JFrog Artifactory (CVE-2026-66384)
Path traversal in JFrog Artifactory (CVE-2026-66384). Data can be tampered with by attackers. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-53362 KEV |
[KEV] Out-of-Bounds Write in Linux kernel (CVE-2026-53362)
Out-of-bounds write in Linux kernel (CVE-2026-53362). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-0995 KEV |
[KEV] Out-of-Bounds Write in Linux Kernel (CVE-2022-0995)
Out-of-bounds write in Linux Kernel (CVE-2022-0995). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-5287 KEV |
[KEV] Vulnerability in Red Hat Automatic Bug Reporting Tool (CVE-2015-5287)
Vulnerability in Red Hat Automatic Bug Reporting Tool (CVE-2015-5287). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-3246 KEV |
[KEV] Vulnerability in Red Hat Libuser (CVE-2015-3246)
Vulnerability in Red Hat Libuser (CVE-2015-3246). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-23758 KEV |
[KEV] Unsafe Deserialization in Ajax.net professional AjaxNetProfessional (CVE-2021-23758)
Vulnerability in Ajax.net professional AjaxNetProfessional (CVE-2021-23758). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 21.11.29.1 or later.
|
|
| CVE-2019-1068 KEV |
[KEV] Vulnerability in Microsoft SQL Server (CVE-2019-1068)
Vulnerability in Microsoft SQL Server (CVE-2019-1068). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-8452 KEV |
[KEV] Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-8452)
Vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-8452). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-60004 KEV |
[KEV] Code Injection in gitea.dev (CVE-2026-60004)
Code injection in gitea.dev (CVE-2026-60004). Successful exploitation can lead to full system takeover. Exploitable via diffpatch. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.27.1 or later.
|
|
| CVE-2026-21962 KEV |
[KEV] Vulnerability in HTTP Server and Oracle Weblogic Server Proxy Plug-in (CVE-2026-21962)
Vulnerability in HTTP Server and Oracle Weblogic Server Proxy Plug-in (CVE-2026-21962). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-69836 KEV |
[KEV] Unsafe Deserialization in Microsoft Entra ID (CVE-2026-69836)
Vulnerability in Microsoft Entra ID (CVE-2026-69836). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-73570 KEV |
[KEV] OS Command Injection in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2026-73570)
OS command injection in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2026-73570). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-72530 KEV |
[KEV] Code Injection in TrueConf Server (CVE-2026-72530)
Code injection in TrueConf Server (CVE-2026-72530). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-72529 KEV |
[KEV] Vulnerability in TrueConf Server (CVE-2026-72529)
Vulnerability in TrueConf Server (CVE-2026-72529). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-64849 KEV |
[KEV] SSRF (Server-Side Request Forgery) in mlflow (CVE-2026-64849)
SSRF in mlflow (CVE-2026-64849). Confidential information can be exposed externally. Exploitable via POST /api/2.0/mlflow/webhooks/{id}/test. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 3.15.0 or later.
|
|
| CVE-2026-65400 KEV |
[KEV] Authentication Bypass in Apple macOS (CVE-2026-65400)
Authentication bypass in Apple macOS (CVE-2026-65400). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-59310 KEV |
[KEV] Path Traversal in Broadcom VMware vCenter (CVE-2026-59310)
Path traversal in Broadcom VMware vCenter (CVE-2026-59310). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-33824 KEV |
[KEV] Vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions (CVE-2026-33824)
Vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions (CVE-2026-33824). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-55040 KEV |
[KEV] Vulnerability in Microsoft SharePoint (CVE-2026-55040)
Vulnerability in Microsoft SharePoint (CVE-2026-55040). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-62593 KEV |
[KEV] Code Injection in Ray-Project Ray (CVE-2025-62593)
Code injection in Ray-Project Ray (CVE-2025-62593). Successful exploitation can lead to full system takeover. Exploitable via fetch. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2.52.0 or later.
|
|
| CVE-2026-68820 KEV |
[KEV] Use-After-Free in Microsoft Windows Ancillary Function Driver for WinSock (CVE-2026-68820)
Vulnerability in Microsoft Windows Ancillary Function Driver for WinSock (CVE-2026-68820). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-20349 KEV |
[KEV] Vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) (CVE-2026-20349)
Vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) (CVE-2026-20349). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-72898 KEV |
[KEV] SQL Injection in Metabase (CVE-2026-72898)
SQL injection in Metabase (CVE-2026-72898). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-8037 KEV |
[KEV] Command Injection in Progress LoadMaster (CVE-2026-8037)
Command injection in Progress LoadMaster (CVE-2026-8037). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-63077 KEV |
[KEV] Unsafe Deserialization in JetBrains TeamCity (CVE-2026-63077)
Vulnerability in JetBrains TeamCity (CVE-2026-63077). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-18556 KEV |
[KEV] Vulnerability in N-able N-central (CVE-2026-18556)
Vulnerability in N-able N-central (CVE-2026-18556). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-9198 KEV |
[KEV] Code Injection in IBM Langflow (CVE-2026-9198)
Code injection in IBM Langflow (CVE-2026-9198). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-34486 KEV |
[KEV] Vulnerability in Apache Tomcat (CVE-2026-34486)
Vulnerability in Apache Tomcat (CVE-2026-34486). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 9.0.117, 10.1.54, 11.0.21 or later.
|
|
| CVE-2026-18577 KEV |
[KEV] Vulnerability in N-able N-central (CVE-2026-18577)
Vulnerability in N-able N-central (CVE-2026-18577). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-20316 KEV |
[KEV] Vulnerability in Cisco Secure Firewall Management Center (FMC) (CVE-2026-20316)
Vulnerability in Cisco Secure Firewall Management Center (FMC) (CVE-2026-20316). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-16812 KEV |
[KEV] OS Command Injection in Arista VeloCloud Orchestrator (CVE-2026-16812)
OS command injection in Arista VeloCloud Orchestrator (CVE-2026-16812). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-68686 KEV |
[KEV] Information Disclosure in Fortinet FortiOS (CVE-2025-68686)
Vulnerability in Fortinet FortiOS (CVE-2025-68686). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-16232 KEV |
[KEV] Authentication Bypass in Check Point SmartConsole (CVE-2026-16232)
Authentication bypass in Check Point SmartConsole (CVE-2026-16232). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-50522 KEV |
[KEV] Unsafe Deserialization in Microsoft SharePoint (CVE-2026-50522)
Vulnerability in Microsoft SharePoint (CVE-2026-50522). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-0770 KEV |
[KEV] Vulnerability in Langflow (CVE-2026-0770)
Vulnerability in Langflow (CVE-2026-0770). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-63030 KEV |
[KEV] Vulnerability in WordPress Core (CVE-2026-63030)
Vulnerability in WordPress Core (CVE-2026-63030). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
