Login Request a demo
CISA KEV

Known exploited

The government must-patch list, mapped to our product index so you can go straight to the product affected.

Updated Oct 28, 10:39 UTC
Added this week
6
▼ 33%vs last week
Ransomware-linked
361
known usein ransomware campaigns
Due in 14 days
7
federalremediation deadlines
Total on KEV
1,761
since 2021all entries
All KEVRansomware-linked
1,761 entries
CVEProductCVSSAddedDue dateSummary
CVE-2026-76461CS
Cisco Secure Email
Cisco
9.8Sep 14Sep 17Cisco Secure Email Gateway SQL Injection Vulnerability
CVE-2026-85706GI
GitLab
GitLab
10.0Sep 11Sep 14Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
CVE-2026-84869SC
ScreenConnect
ConnectWise
9.9Sep 11Sep 14ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
CVE-2026-42016AR
artifactory
jfrog
8.8Sep 11Sep 25Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
CVE-2026-42018AR
artifactory
jfrog
7.5Sep 11Sep 25Anonymous user token generation exposure in JFrog Artifactory
CVE-2026-86060RO
RouterOS
Mikrotik
9.8Sep 10Sep 13SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
CVE-2026-67277RO
RouterOS
Mikrotik
8.2Sep 10Sep 13Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
CVE-2026-20079CS
Cisco Secure Firewall Management Center (FMC)
Cisco
10.0Sep 9Sep 12Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
CVE-2026-19490NA
NetScaler ADC
Citrix
9.8Sep 9Sep 12NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
CVE-2025-25249FO
FortiOS
Fortinet
9.8Sep 9Sep 12Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
CVE-2026-87491CH
Chrome
Google
8.8Sep 9Sep 23Google Chromium V8 Out of Bounds Write Vulnerability
CVE-2026-75650CO
Commerce
Adobe
10.0Sep 8Sep 11Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
CVE-2026-86218NC
N-central
N-able
9.8Sep 8Sep 11pre-authentication remote code execution
CVE-2026-85880WI
Windows
Microsoft
7.8Sep 8Sep 22Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVE-2026-81963WI
Windows
Microsoft
7.8Sep 8Sep 22Windows Update Stack Elevation of Privilege Vulnerability
CVE-2026-85046CH
Chrome
Google
8.8Sep 4Sep 18Google Chromium V8 Type Confusion Vulnerability
CVE-2026-49869KE
kestra
kestra-io
10.0Sep 2Sep 5Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
CVE-2026-83548SM
SMA1000
SonicWall
10.0Sep 2Sep 5SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVE-2026-9586SS
Switchvox SMB Edition
Sangoma
9.8Sep 2Sep 5Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
CVE-2026-82329AR
artifactory
jfrog
9.8Sep 2Sep 5Potential authentication bypass leading to administrative access in Artifactory
CVE-2026-59822LI
litellm
BerriAI
8.2Sep 2Sep 16LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
CVE-2026-83549SM
SMA1000
SonicWall
7.8Sep 2Sep 5SonicWall SMA1000 Appliances OS Command Injection Vulnerability
CVE-2026-48710ST
starlette
Kludex
6.5Sep 2Sep 16Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
CVE-2026-81578PM
PaperCut MF/NG
PaperCut
9.8Aug 28Sep 14PaperCut MF/NG: Authentication Bypass
CVE-2026-82078PM
PaperCut MF/NG
PaperCut
9.1Aug 28Sep 14PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
CVE-2023-49105OS
Owncloud Server
Owncloud
9.8Aug 27Aug 30ownCloud Improper Authentication Vulnerability
CVE-2026-53362KE
Kernel
Linux
7.8Aug 27Aug 30ipv6: account for fraggap on the paged allocation path
CVE-2026-66384AR
artifactory
jfrog
5.3Aug 27Sep 10Authenticated users may write data outside the intended Docker cache path
CVE-2026-8452NA
NetScaler ADC
Citrix
9.8Aug 26Aug 29Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
CVE-2021-23758AJ
AjaxPro.2
9.8Aug 26Sep 9Deserialization of Untrusted Data
CVE-2019-1068MS
Microsoft SQL Server
Microsoft
8.8Aug 26Aug 29Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2022-0995KE
Kernel
Linux
7.8Aug 26Aug 29Linux Kernel Out-of-Bounds Write Vulnerability
CVE-2015-5287LI
Linux
Oracle
7.8Aug 26Sep 9Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
CVE-2015-3246LI
Libuser
Libuser Project
7.4Aug 26Sep 9Red Hat Libuser Race Condition Vulnerability
CVE-2026-60004GI
Gitea
Gitea
9.8Aug 25Aug 28Gitea Code Injection Vulnerability
CVE-2026-21962OH
Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
Oracle Corporation
10.0Aug 24Aug 27Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
CVE-2026-69836ME
Microsoft Entra
Microsoft
10.0Aug 21Aug 24Microsoft Entra ID Remote Code Execution Vulnerability
CVE-2026-73570CO
Collaboration
Zimbra
8.9Aug 21Aug 24Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
CVE-2026-72529TS
TrueConf Server
TrueConf
9.8Aug 20Aug 23TrueConf Server Missing Authentication for Critical Function Vulnerability
CVE-2026-72530TS
TrueConf Server
TrueConf
9.0Aug 20Sep 3TrueConf Server Code Injection Vulnerability
CVE-2026-64849ML
mlflow
mlflow
9.3Aug 19Sep 2MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
CVE-2026-59310
Ransomware
VS
vCenter Server
VMware
9.8Aug 18Aug 21vCenter directory-traversal vulnerability
CVE-2026-65400MA
macOS
Apple
9.8Aug 18Aug 21Apple macOS Improper Authentication Vulnerability
CVE-2026-33824W1
Windows 10 Version 1607
Microsoft
9.8Aug 18Aug 21Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
CVE-2026-55040SH
SharePoint
Microsoft
9.1Aug 18Aug 21Microsoft SharePoint Server Security Feature Bypass Vulnerability
CVE-2025-62593RA
ray
ray-project
8.8Aug 17Aug 20Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
CVE-2026-72898ME
Metabase
Metabase
10.0Aug 11Aug 14Metabase SQL injection via password reset endpoint
CVE-2026-20349CS
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco
8.6Aug 11Aug 14Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
CVE-2026-68820W1
Windows 10 Version 1607
Microsoft
7.0Aug 11Aug 25Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-8037EC
ECS Connections Manager
Progress Software
9.8Aug 7Aug 10OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Page 2 of 36 · 1,761 total
123…36