CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2010-0806 KEV |
[KEV] Vulnerability in Microsoft Internet Explorer (CVE-2010-0806)
Vulnerability in Microsoft Internet Explorer (CVE-2010-0806). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2009-3459 KEV |
[KEV] Buffer Overflow in Adobe Acrobat and Reader (CVE-2009-3459)
Vulnerability in Adobe Acrobat and Reader (CVE-2009-3459). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2009-1537 KEV |
[KEV] Vulnerability in Microsoft DirectX (CVE-2009-1537)
Vulnerability in Microsoft DirectX (CVE-2009-1537). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2008-4250 KEV |
[KEV] Code Injection in Microsoft Windows (CVE-2008-4250)
Code injection in Microsoft Windows (CVE-2008-4250). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-0249 KEV |
[KEV] Use-After-Free in Microsoft Internet Explorer (CVE-2010-0249)
Vulnerability in Microsoft Internet Explorer (CVE-2010-0249). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-45498 KEV |
[KEV] Vulnerability in Microsoft Defender (CVE-2026-45498)
Vulnerability in Microsoft Defender (CVE-2026-45498). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-41091 KEV |
[KEV] Vulnerability in Microsoft Defender (CVE-2026-41091)
Vulnerability in Microsoft Defender (CVE-2026-41091). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-42897 KEV |
[KEV] Cross-Site Scripting (XSS) in Microsoft (CVE-2026-42897)
Cross-site scripting in Microsoft (CVE-2026-42897). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-20182 KEV |
[KEV] Authentication Bypass in Cisco Catalyst SD-WAN (CVE-2026-20182)
Authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-42208 KEV |
[KEV] SQL Injection in Berriai litellm (CVE-2026-42208)
SQL injection in Berriai litellm (CVE-2026-42208). Successful exploitation can lead to full system takeover. Exploitable via POST /chat/completions. Listed in CISA KEV — actively exploited. Mitigation: upgrade to >=1.83.7 or later.
|
|
| CVE-2026-6973 KEV |
[KEV] Vulnerability in Ivanti endpoint-manager-mobile-epmm (CVE-2026-6973)
vulnerability in Ivanti endpoint-manager-mobile-epmm (CVE-2026-6973). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-0300 KEV |
[KEV] Out-of-Bounds Write in Palo alto networks palo-alto-networks (CVE-2026-0300)
out-of-bounds write in Palo alto networks palo-alto-networks (CVE-2026-0300). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-31431 KEV |
[KEV] Vulnerability in Linux redhat (CVE-2026-31431)
vulnerability in Linux redhat (CVE-2026-31431). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-41940 KEV |
[KEV] Vulnerability in Webpros cpanel-whm-and-wp2-wordpress-squared (CVE-2026-41940)
vulnerability in Webpros cpanel-whm-and-wp2-wordpress-squared (CVE-2026-41940). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-32202 KEV |
[KEV] Vulnerability in Microsoft windows (CVE-2026-32202)
vulnerability in Microsoft windows (CVE-2026-32202). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-1708 KEV |
[KEV] Path Traversal in Connectwise screenconnect (CVE-2024-1708)
path traversal in Connectwise screenconnect (CVE-2024-1708). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-57726 KEV |
[KEV] Vulnerability in Simplehelp auth (CVE-2024-57726)
vulnerability in Simplehelp auth (CVE-2024-57726). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-57728 KEV |
[KEV] Path Traversal in Simplehelp path-traversal (CVE-2024-57728)
path traversal in Simplehelp path-traversal (CVE-2024-57728). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-7399 KEV |
[KEV] Path Traversal in Samsung magicinfo-9-server (CVE-2024-7399)
path traversal in Samsung magicinfo-9-server (CVE-2024-7399). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-29635 KEV |
[KEV] Command Injection in D-link dir-823x (CVE-2025-29635)
command injection in D-link dir-823x (CVE-2025-29635). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-39987 KEV |
[KEV] Vulnerability in Marimo remote-attack (CVE-2026-39987)
vulnerability in Marimo remote-attack (CVE-2026-39987). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-33825 KEV |
[KEV] Vulnerability in Microsoft defender (CVE-2026-33825)
vulnerability in Microsoft defender (CVE-2026-33825). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-27199 KEV |
[KEV] Vulnerability in Jetbrains teamcity (CVE-2024-27199)
vulnerability in Jetbrains teamcity (CVE-2024-27199). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-32975 KEV |
[KEV] Authentication Bypass in Quest kace-systems-management-appliance-sma (CVE-2025-32975)
authentication bypass in Quest kace-systems-management-appliance-sma (CVE-2025-32975). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-20128 KEV |
[KEV] Vulnerability in Cisco catalyst-sd-wan-manager (CVE-2026-20128)
vulnerability in Cisco catalyst-sd-wan-manager (CVE-2026-20128). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-48700 KEV |
[KEV] Cross-Site Scripting (XSS) in Synacor zimbra-collaboration-suite-zcs (CVE-2025-48700)
cross-site scripting in Synacor zimbra-collaboration-suite-zcs (CVE-2025-48700). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-27351 KEV |
[KEV] Authentication Bypass in Papercut ngmf (CVE-2023-27351)
authentication bypass in Papercut ngmf (CVE-2023-27351). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-2749 KEV |
[KEV] Path Traversal in Kentico path-traversal (CVE-2025-2749)
path traversal in Kentico path-traversal (CVE-2025-2749). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-20133 KEV |
[KEV] Information Disclosure in Cisco catalyst-sd-wan-manager (CVE-2026-20133)
vulnerability in Cisco catalyst-sd-wan-manager (CVE-2026-20133). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-20122 KEV |
[KEV] Vulnerability in Cisco catalyst-sd-wan-manger (CVE-2026-20122)
vulnerability in Cisco catalyst-sd-wan-manger (CVE-2026-20122). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-34197 KEV |
[KEV] Vulnerability in Apache activemq (CVE-2026-34197)
vulnerability in Apache activemq (CVE-2026-34197). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-32201 KEV |
[KEV] Vulnerability in Microsoft sharepoint-server (CVE-2026-32201)
vulnerability in Microsoft sharepoint-server (CVE-2026-32201). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2009-0238 KEV |
[KEV] Code Injection in Microsoft office (CVE-2009-0238)
code injection in Microsoft office (CVE-2009-0238). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-34621 KEV |
[KEV] Vulnerability in Adobe acrobat-and-reader (CVE-2026-34621)
vulnerability in Adobe acrobat-and-reader (CVE-2026-34621). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-21643 KEV |
[KEV] SQL Injection in Fortinet forticlient-ems (CVE-2026-21643)
SQL injection in Fortinet forticlient-ems (CVE-2026-21643). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-9715 KEV |
[KEV] Use-After-Free in Adobe acrobat (CVE-2020-9715)
vulnerability in Adobe acrobat (CVE-2020-9715). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36424 KEV |
[KEV] Out-of-Bounds Read in Microsoft windows (CVE-2023-36424)
vulnerability in Microsoft windows (CVE-2023-36424). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21529 KEV |
[KEV] Unsafe Deserialization in Microsoft exchange-server (CVE-2023-21529)
vulnerability in Microsoft exchange-server (CVE-2023-21529). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-60710 KEV |
[KEV] Vulnerability in Microsoft windows (CVE-2025-60710)
vulnerability in Microsoft windows (CVE-2025-60710). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2012-1854 KEV |
[KEV] Vulnerability in Microsoft visual-basic-for-applications-vba (CVE-2012-1854)
vulnerability in Microsoft visual-basic-for-applications-vba (CVE-2012-1854). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-1340 KEV |
[KEV] Code Injection in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1340)
Code injection in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1340). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-35616 KEV |
[KEV] Vulnerability in Fortinet FortiClient EMS (CVE-2026-35616)
Vulnerability in Fortinet FortiClient EMS (CVE-2026-35616). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-3502 KEV |
[KEV] Vulnerability in TrueConf Client (CVE-2026-3502)
Vulnerability in TrueConf Client (CVE-2026-3502). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-5281 KEV |
[KEV] Use-After-Free in Google Dawn (CVE-2026-5281)
Vulnerability in Google Dawn (CVE-2026-5281). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-3055 KEV |
[KEV] Out-of-Bounds Read in Citrix NetScaler (CVE-2026-3055)
Vulnerability in Citrix NetScaler (CVE-2026-3055). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-53521 KEV |
[KEV] Vulnerability in F5 BIG-IP (CVE-2025-53521)
Vulnerability in F5 BIG-IP (CVE-2025-53521). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2026-33634 KEV |
[KEV] Vulnerability in Aquasecurity Trivy (CVE-2026-33634)
Vulnerability in Aquasecurity Trivy (CVE-2026-33634). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 0.35.0 or later.
|
|
| CVE-2026-33017 KEV |
[KEV] Code Injection in Langflow (CVE-2026-33017)
Code injection in Langflow (CVE-2026-33017). Successful exploitation can lead to full system takeover. Exploitable via POST /api/v1/build_public_tmp/{flow_id}/flow. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.9.0 or later.
|
|
| CVE-2025-31277 KEV |
[KEV] Buffer Overflow in Apple Multiple Products (CVE-2025-31277)
Vulnerability in Apple Multiple Products (CVE-2025-31277). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-43520 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2025-43520)
Vulnerability in Apple Multiple Products (CVE-2025-43520). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
