CISA KEV — Known Exploited Vulnerabilities

Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.

ID	Title	Severity	Tags	Detected
CVE-2026-60137 KEV	[KEV] SQL Injection in WordPress Core (CVE-2026-60137) SQL injection in WordPress Core (CVE-2026-60137). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	Medium	WordPress SQL Injection Cwe 89	2 months ago
CVE-2021-27137 KEV	[KEV] Vulnerability in DD-WRT (CVE-2021-27137) Vulnerability in DD-WRT (CVE-2021-27137). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	C Cwe 121 Dd Wrt	3 months ago
CVE-2026-39808 KEV	[KEV] OS Command Injection in Fortinet FortiSandbox (CVE-2026-39808) OS command injection in Fortinet FortiSandbox (CVE-2026-39808). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 78 Fortinet Fortisandbox	3 months ago
CVE-2026-58644 KEV	[KEV] Unsafe Deserialization in Microsoft SharePoint (CVE-2026-58644) Vulnerability in Microsoft SharePoint (CVE-2026-58644). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Insecure Deserialization Cwe 502 Microsoft Sharepoint Server	3 months ago
CVE-2026-25089 KEV	[KEV] OS Command Injection in Fortinet FortiSandbox (CVE-2026-25089) OS command injection in Fortinet FortiSandbox (CVE-2026-25089). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 78 Fortinet Fortisandbox Fortisandbox Cloud +1	4 months ago
CVE-2023-4346 KEV	[KEV] Vulnerability in KNX Association KNX Protocol Connection Authorization Option 1 (CVE-2023-4346) Vulnerability in KNX Association KNX Protocol Connection Authorization Option 1 (CVE-2023-4346). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Cwe 645 Knx Connection Authorization	3 months ago
CVE-2026-46817 KEV	[KEV] Privilege Escalation in Oracle E-Business Suite (CVE-2026-46817) Vulnerability in Oracle E-Business Suite (CVE-2026-46817). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	C Cwe 269 Cwe 287 Cwe 306 +2	4 months ago
CVE-2026-15410 KEV	[KEV] Code Injection in SonicWall SMA1000 Appliances (CVE-2026-15410) Code injection in SonicWall SMA1000 Appliances (CVE-2026-15410). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 94 Sonicwall Sma6210 Firmware Sma6210 +3	3 months ago
CVE-2026-15409 KEV	[KEV] SSRF (Server-Side Request Forgery) in SonicWall SMA1000 Appliances (CVE-2026-15409) SSRF in SonicWall SMA1000 Appliances (CVE-2026-15409). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Server-Side Request Forgery Cwe 918 Sonicwall Sma6210 Firmware +4	3 months ago
CVE-2026-56164 KEV	[KEV] Vulnerability in Microsoft SharePoint Server (CVE-2026-56164) Vulnerability in Microsoft SharePoint Server (CVE-2026-56164). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	Medium	Cwe 306 Microsoft Sharepoint Server	3 months ago
CVE-2026-56155 KEV	[KEV] Vulnerability in Microsoft Active Directory Federation Services (CVE-2026-56155) Vulnerability in Microsoft Active Directory Federation Services (CVE-2026-56155). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 1220 Microsoft Windows 10 1607 Windows 10 1809 +5	3 months ago
CVE-2008-4128 KEV	[KEV] Cross-Site Request Forgery (CSRF) in Cisco IOS (CVE-2008-4128) Vulnerability in Cisco IOS (CVE-2008-4128). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	High	Cross-Site Request Forgery Cwe 352 Cisco iOS +1	18 years ago
CVE-2026-56291 KEV	[KEV] Unrestricted File Upload in Balbooa Forms (CVE-2026-56291) Vulnerability in Balbooa Forms (CVE-2026-56291). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Remote Code Execution Cwe 434 Balbooa Forms	3 months ago
CVE-2026-48939 KEV	[KEV] Unrestricted File Upload in iCagenda (CVE-2026-48939) Vulnerability in iCagenda (CVE-2026-48939). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	PHP Cwe 284 Cwe 434 Joomlic +1	3 months ago
CVE-2026-48282 KEV	[KEV] Path Traversal in Adobe ColdFusion (CVE-2026-48282) Path traversal in Adobe ColdFusion (CVE-2026-48282). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Path Traversal Cwe 22 Adobe Coldfusion	3 months ago
CVE-2026-56290 KEV	[KEV] Unrestricted File Upload in Joomlack Page Builder (CVE-2026-56290) Vulnerability in Joomlack Page Builder (CVE-2026-56290). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Remote Code Execution Cwe 284 Cwe 434 Joomlack +1	3 months ago
CVE-2026-48908 KEV	[KEV] Unrestricted File Upload in JoomShaper SP Page Builder (CVE-2026-48908) Vulnerability in JoomShaper SP Page Builder (CVE-2026-48908). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	PHP Cwe 284 Cwe 434 Ollyo +1	3 months ago
CVE-2026-55255 KEV	[KEV] Vulnerability in Langflow (CVE-2026-55255) Vulnerability in Langflow (CVE-2026-55255). Confidential information can be exposed externally. Exploitable via get_flow_by_id_or_endpoint_name. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.9.1 or later.	High	Cwe 639 Langflow	3 months ago
CVE-2026-45659 KEV	[KEV] Unsafe Deserialization in Microsoft SharePoint Server (CVE-2026-45659) Vulnerability in Microsoft SharePoint Server (CVE-2026-45659). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Insecure Deserialization Cwe 502 Microsoft Sharepoint Server	4 months ago
CVE-2026-48558 KEV	[KEV] Vulnerability in SimpleHelp (CVE-2026-48558) Vulnerability in SimpleHelp (CVE-2026-48558). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Authentication Bypass Cwe 347 Simple Help Simplehelp	4 months ago
CVE-2026-12569 KEV	[KEV] Vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569) Vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Remote Code Execution Insecure Deserialization Cwe 20 Cwe 502 +3	3 months ago
CVE-2026-20230 KEV	[KEV] SSRF (Server-Side Request Forgery) in Cisco Unified Communications Manager (CVE-2026-20230) SSRF in Cisco Unified Communications Manager (CVE-2026-20230). Data can be tampered with by attackers. Listed in CISA KEV — actively exploited.	High	Cisco Network Server-Side Request Forgery Cwe 918 +1	4 months ago
CVE-2025-67038 KEV	[KEV] OS Command Injection in Lantronix EDS5000 (CVE-2025-67038) OS command injection in Lantronix EDS5000 (CVE-2025-67038). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 78 Cwe 94 Command Injection Lantronix +75	3 months ago
CVE-2026-34910 KEV	[KEV] Vulnerability in Ubiquiti UniFi OS (CVE-2026-34910) Vulnerability in Ubiquiti UniFi OS (CVE-2026-34910). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 20 Ui Unifi Os Server Unifi Cloud Gateway Industrial Firmware +59	4 months ago
CVE-2026-34909 KEV	[KEV] Path Traversal in Ubiquiti UniFi OS (CVE-2026-34909) Path traversal in Ubiquiti UniFi OS (CVE-2026-34909). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Path Traversal Cwe 22 Ui Unifi Os Server +62	4 months ago
CVE-2026-34908 KEV	[KEV] Vulnerability in Ubiquiti UniFi OS (CVE-2026-34908) Vulnerability in Ubiquiti UniFi OS (CVE-2026-34908). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 284 Ui Unifi Os Server Unifi Cloud Gateway Industrial Firmware +59	4 months ago
CVE-2026-20253 KEV	[KEV] Vulnerability in Splunk Enterprise (CVE-2026-20253) Vulnerability in Splunk Enterprise (CVE-2026-20253). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 306 Splunk	4 months ago
CVE-2026-48907 KEV	[KEV] Vulnerability in Widget factory JCE editor extension for Joomla (CVE-2026-48907) Vulnerability in Widget factory JCE editor extension for Joomla (CVE-2026-48907). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	PHP Cwe 284 Widgetfactorylimited Jce	4 months ago
CVE-2026-20262 KEV	[KEV] Path Traversal in Cisco Catalyst SD-WAN Manager (CVE-2026-20262) Path traversal in Cisco Catalyst SD-WAN Manager (CVE-2026-20262). Data can be tampered with by attackers. Listed in CISA KEV — actively exploited.	Medium	Cisco Network Cwe 22 Catalyst Sd Wan Manager	4 months ago
CVE-2026-54420 KEV	[KEV] Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-54420) Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-54420). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 61 Litespeedtech Litespeed Cpanel Plugin Litespeed Whm Plugin	4 months ago
CVE-2026-35273 KEV	[KEV] Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (CVE-2026-35273) Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (CVE-2026-35273). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	C Cwe 306 Oracle Peoplesoft Enterprise Peopletools	4 months ago
CVE-2026-10520 KEV	[KEV] OS Command Injection in Ivanti Sentry (CVE-2026-10520) OS command injection in Ivanti Sentry (CVE-2026-10520). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Remote Code Execution Cwe 78 Ivanti Standalone Sentry	4 months ago
CVE-2026-11645 KEV	[KEV] Out-of-Bounds Write in Google Chromium V8 (CVE-2026-11645) Out-of-bounds write in Google Chromium V8 (CVE-2026-11645). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 125 Cwe 787 Google Chrome +6	4 months ago
CVE-2026-7473 KEV	[KEV] Vulnerability in Arista Extensible Operating System (CVE-2026-7473) Vulnerability in Arista Extensible Operating System (CVE-2026-7473). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	Medium	Cwe 1023 Arista Eos 7020Sr 24C2 +100	4 months ago
CVE-2026-20245 KEV	[KEV] Vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) Vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 116 Cisco Catalyst Sd Wan Manager Sd Wan Vsmart Controller	4 months ago
CVE-2026-50751 KEV	[KEV] Authentication Bypass in Check Point Security Gateway (CVE-2026-50751) Authentication bypass in Check Point Security Gateway (CVE-2026-50751). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	Critical	Cwe 287 Checkpoint Gaia Os Gaia Embedded +20	4 months ago
CVE-2026-42271 KEV	[KEV] OS Command Injection in BerriAI LiteLLM (CVE-2026-42271) OS command injection in BerriAI LiteLLM (CVE-2026-42271). Successful exploitation can lead to full system takeover. Exploitable via POST /mcp-rest/test/connection. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.83.7 or later.	High	Cwe 77 Cwe 78 LiteLLM Redhat +1	5 months ago
CVE-2026-28318 KEV	[KEV] Vulnerability in SolarWinds Serv-U (CVE-2026-28318) Vulnerability in SolarWinds Serv-U (CVE-2026-28318). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Cwe 400 Solarwinds Serv U	4 months ago
CVE-2026-45247 KEV	[KEV] Unsafe Deserialization in Mirasvit Full Page Cache Warmer (CVE-2026-45247) Vulnerability in Mirasvit Full Page Cache Warmer (CVE-2026-45247). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	PHP Remote Code Execution Cwe 502 Mirasvit +1	4 months ago
CVE-2022-0492 KEV	[KEV] Authentication Bypass in Linux Kernel (CVE-2022-0492) Authentication bypass in Linux Kernel (CVE-2022-0492). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	C Cwe 287 Cwe 862 Linux +42	4 months ago
CVE-2025-48595 KEV	[KEV] Vulnerability in Android Framework (CVE-2025-48595) Vulnerability in Android Framework (CVE-2025-48595). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 190 Google Android	4 months ago
CVE-2024-21182 KEV	[KEV] Vulnerability in Oracle WebLogic Server (CVE-2024-21182) Vulnerability in Oracle WebLogic Server (CVE-2024-21182). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	High	Oracle Weblogic Remote Code Execution Cwe 94 C +2	4 months ago
CVE-2026-0257 KEV	[KEV] Vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0257) Vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0257). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	Critical	Authentication Bypass Cwe 565 Paloaltonetworks Pan Os +4	5 months ago
CVE-2026-48027 KEV	[KEV] Vulnerability in Nx Console (CVE-2026-48027) Vulnerability in Nx Console (CVE-2026-48027). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 506 Nx Nx Console	4 months ago
CVE-2026-8398 KEV	[KEV] Vulnerability in Daemon Tools Lite (CVE-2026-8398) Vulnerability in Daemon Tools Lite (CVE-2026-8398). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Cwe 506 Disc Soft Daemon Tools Microsoft +1	5 months ago
CVE-2026-45321 KEV	[KEV] Vulnerability in TanStack (CVE-2026-45321) Vulnerability in TanStack (CVE-2026-45321). Successful exploitation can lead to full system takeover. Exploitable via pull_request_target. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.166.16 or later.	Critical	Cwe 506 Tanstack Tanstackarktype Adapter Tanstackeslint Plugin Router +184	5 months ago
CVE-2026-48172 KEV	[KEV] Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-48172) Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-48172). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Privilege Escalation Cwe 266 Litespeedtech Litespeed Cpanel Plugin +1	4 months ago
CVE-2026-9082 KEV	[KEV] SQL Injection in Drupal Core (CVE-2026-9082) SQL injection in Drupal Core (CVE-2026-9082). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 11.3.10 or later.	Critical	Drupal SQL Injection Cwe 89	4 months ago
CVE-2026-34926 KEV	[KEV] Vulnerability in Trend Micro Apex One (CVE-2026-34926) Vulnerability in Trend Micro Apex One (CVE-2026-34926). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	Medium	Path Traversal Cwe 23 Jvn Japan +3	4 months ago
CVE-2025-34291 KEV	[KEV] Vulnerability in Langflow (CVE-2025-34291) Vulnerability in Langflow (CVE-2025-34291). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.7.0 or later.	High	Remote Code Execution Cwe 346 Langflow	10 months ago