CISA KEV / NVD

Exploited vulnerabilities, at a glance

From CISA's Known Exploited Vulnerabilities (KEV) and high-severity CVEs in the NVD (NVD), major vulnerabilities organized with sources. This site is not an official U.S. government source.

Security: this page is a general organization of public information, not advice or a warranty. Judge applicability and priority against official vendor information and your own environment.

Browse all collected data (list, filter, search) →

Featured

High-severity, actively exploited vulnerabilities explained with key points, FAQs, and sources.

Critical Ransomware use CVE-2026-35273 2026/06/12

Missing authentication in Oracle PeopleSoft (PeopleTools) (CVE-2026-35273) — unauthenticated takeover, used in ransomware

Oracle PeopleSoft Enterprise PeopleTools — the platform under the PeopleSoft ERP (HR, finance) — has a missing-authentication-for-critical-function flaw (CWE-306). A remote, unauthenticated attacker can take over PeopleTools. CISA listed it as known-exploited (KEV) and confirmed ransomware use (CVSS 9.8 Critical, per NVD).

Missing authentication for a critical function (CWE-306) in PeopleTools, the platform under PeopleSoft
A remote, unauthenticated attacker can take over PeopleTools
Listed in CISA KEV = exploitation confirmed; also confirmed used in ransomware

Critical Ransomware use CVE-2026-48027 2026/05/27

Malware in the Nx Console extension (CVE-2026-48027) — a supply-chain attack that steals developer credentials

A malicious version of "Nx Console," a popular IDE extension for the Nx build system, was published; it fetches an obfuscated payload and harvests credentials (tokens and keys) from disk and memory. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 9.8 Critical).

A tampered build of Nx Console (an IDE extension for the Nx build system) fetched and ran an obfuscated payload
It stole credentials from disk and memory (GitHub/npm tokens, SSH keys, cloud credentials, etc.)
Listed in CISA KEV = exploitation confirmed; ransomware use also confirmed (CVSS 9.8 Critical)

Critical Ransomware use CVE-2026-45321 2026/05/27

Malicious versions of TanStack npm packages (CVE-2026-45321) — credential-stealing malware shipped under a trusted name

Malicious versions of the widely used TanStack (a family of React libraries) were published to the npm registry, distributing credential-stealing malware under a trusted publisher identity. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 9.6 Critical).

Malicious versions of TanStack (popular React libraries) were published to npm
A trusted publisher (maintainer identity) was abused to distribute credential-stealing malware
Listed in CISA KEV = exploitation confirmed; ransomware use also confirmed (CVSS 9.6 Critical)

Critical CVE-2026-10520 2026/06/11

OS command injection in Ivanti Sentry (CVE-2026-10520) — unauthenticated root-level remote control

Ivanti Sentry (formerly MobileIron Sentry), a mobile-device management gateway, contains an OS command injection flaw that lets a remote, unauthenticated attacker execute code as root. CISA listed it as known-exploited (KEV) (CVSS 10.0 Critical, per NVD).

OS command injection (CWE-78) in Ivanti Sentry (formerly MobileIron Sentry; a mobile-management gateway)
In an unmanaged state, a remote, unauthenticated attacker can execute code as root
Listed in CISA KEV = exploitation confirmed; NVD base score is the maximum 10.0 Critical

High CVE-2026-11645 2026/06/09

Out-of-bounds read/write in Google Chromium V8 (CVE-2026-11645) — code execution via a crafted HTML page, affecting Chrome, Edge, and more

Google's JavaScript engine "Chromium V8" has an out-of-bounds read and write vulnerability that could let a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page. It can affect multiple Chromium-based browsers, including Chrome, Edge, and Opera. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).

Out-of-bounds read/write (CWE-787 / CWE-125) in V8, the core Chromium JavaScript engine
A crafted HTML page could lead to arbitrary code execution inside the sandbox
Affects multiple Chromium-based browsers (Chrome, Edge, Opera) — a shared engine ripples widely

Medium CVE-2026-7473 2026/06/09

Tunnel-decapsulation flaw in Arista EOS (CVE-2026-7473) — forwarding unexpected packets

Arista EOS, the OS for Arista network switches, has an incomplete-comparison flaw in tunnel decapsulation: the switch can wrongly decapsulate and forward unexpected tunneled packets whose destination matches its configured decapsulation IP. CISA listed it as known-exploited (KEV) (CVSS 5.8 Medium, per NVD).

Incomplete comparison (CWE-1023) during tunnel decapsulation in Arista EOS (switch OS)
Unexpected tunneled packets destined to the configured decapsulation IP can be wrongly decapsulated and forwarded
Can be abused to bypass network segmentation and slip past access controls

High CVE-2026-20245 2026/06/09

Arbitrary command execution in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) — root via a crafted file

An output-escaping flaw in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) lets an authenticated local attacker run arbitrary commands as root by supplying a crafted file. CISA listed it as known-exploited (KEV) (CVSS 7.8 High, per NVD).

Improper output encoding/escaping (CWE-116) in Cisco Catalyst SD-WAN Manager (formerly vManage)
An authenticated local attacker can run arbitrary commands as root via a crafted file
Compromise of the central network-management platform risks propagation to many downstream sites

High CVE-2026-42271 2026/06/08

Command injection in LiteLLM, an LLM proxy (CVE-2026-42271) — even low-privilege users can run arbitrary commands on the host

BerriAI LiteLLM, an open-source LLM proxy that unifies many LLM providers, has a command-injection vulnerability. Any authenticated user — including holders of low-privilege internal-user keys — can run arbitrary commands on the host. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).

Command injection (CWE-78 / CWE-77) in BerriAI LiteLLM (a popular OSS LLM proxy)
Any authenticated user, including low-privilege internal-user keys, can run arbitrary commands on the host
Host takeover can lead to theft of managed API keys/tokens and further intrusion

Critical CVE-2026-50751 2026/06/08

Authentication bypass in Check Point Security Gateway (CVE-2026-50751) — VPN access without a password, CVSS 9.3

Check Point's Security Gateway products have an improper-authentication vulnerability in IKEv1 key exchange that lets an unauthenticated remote attacker bypass user authentication and establish a remote-access VPN connection without a valid user password. CISA listed it as known-exploited (KEV) (CVSS 9.3 Critical).

IKEv1 authentication bypass (CWE-287) in Check Point Security Gateway
An unauthenticated remote attacker establishes a remote-access VPN connection without a valid password
Compromise of a perimeter VPN/firewall = a foothold for internal intrusion. CVSS 9.3 (Critical)

High CVE-2026-28318 2026/06/05

Denial-of-service flaw in SolarWinds Serv-U (CVE-2026-28318) — crashing file transfer without authentication

SolarWinds Serv-U, a file-transfer server, has an uncontrolled-resource-consumption (DoS) flaw: without authentication, a crafted POST request using a deflate Content-Encoding header can crash the Serv-U service. CISA listed it as known-exploited (KEV) (CVSS 7.5 High, per NVD).

Uncontrolled resource consumption (CWE-400) in SolarWinds Serv-U (a file-transfer server)
Without authentication, a crafted deflate-encoded POST can crash the service (DoS)
Impact is availability only (not data theft), but it can halt core file exchange

Critical Ransomware use CVE-2026-41940 2026/04/30

Missing authentication in cPanel & WHM (CVE-2026-41940) — control-panel takeover without authentication, ransomware use confirmed

cPanel & WHM and WP2, a widely used web-hosting control panel, have a missing-authentication flaw in the login flow that lets an unauthenticated remote attacker gain unauthorized access to the control panel. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 9.8 Critical).

Missing authentication (CWE-306) in the login flow of cPanel & WHM / WP2
An unauthenticated remote attacker gains unauthorized access to the control panel
cPanel/WHM is the most widely used hosting control panel = one compromise ripples to many sites

High Ransomware use CVE-2024-1708 2026/04/28

Path traversal in ConnectWise ScreenConnect (CVE-2024-1708) — remote code execution, ransomware use confirmed

ConnectWise ScreenConnect, a remote-management (RMM) / remote-support tool, has a path-traversal vulnerability that could let an attacker execute remote code or directly impact confidential data and critical systems. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 8.4 High).

Path traversal (CWE-22) in ConnectWise ScreenConnect (an RMM tool that remotely manages many endpoints)
Can lead to remote code execution (RCE) or direct impact on confidential data and critical systems
RMM compromise = a "lever" to push malware to many managed endpoints at once

High CVE-2022-0492 2026/06/02

Linux kernel cgroups vulnerability (CVE-2022-0492) — exploitable for privilege escalation and container escape

An improper-authentication vulnerability in the Linux kernel cgroups v1 "release_agent" feature leads to privilege escalation. Depending on configuration it can be abused for container escape. Disclosed in 2022, but CISA listed it as known-exploited (KEV) in 2026 (CVSS 7.8 High).

Missing privilege check in the cgroups v1 "release_agent" feature (CWE-287 / CWE-862)
Local privilege escalation; with weak configuration, exploitable for container-to-host escape
Disclosed in 2022 but entered KEV in 2026 = an old known vulnerability still being exploited

High CVE-2025-48595 2026/06/02

Integer overflow in the Android Framework (CVE-2025-48595) — local privilege escalation

An integer-overflow vulnerability in Android's core "Framework" component leads, via code execution, to local privilege escalation. Fixed in the June 2026 Android security update. CISA listed it as known-exploited (KEV) (CVSS 8.4 High).

Integer overflow (CWE-190) in the Android Framework (the OS foundation layer)
Leads to local privilege escalation via code execution
Fixed in the June 2026 Android security bulletin. Listed in CISA KEV (CVSS 8.4 High)

High CVE-2024-21182 2026/06/01

Oracle WebLogic Server vulnerability (CVE-2024-21182) — risk of data compromise without authentication

In Oracle WebLogic Server, an unauthenticated attacker with network access via the T3/IIOP protocols can compromise the server, leading to unauthorized access to critical data or to all accessible data. CISA listed it as known-exploited (KEV) (CVSS 7.5 High).

WebLogic Server can be compromised via T3/IIOP without authentication
Success leads to unauthorized access to critical data (in some cases all data)
Fixed in Oracle's July 2024 Critical Patch Update. Listed in CISA KEV (CVSS 7.5 High)

High CVE-2025-34291 2026/05/21

Critical vulnerability in Langflow, an AI app-building tool (CVE-2025-34291) — bad CORS plus stolen tokens can lead to code execution

Langflow, a popular tool for visually building LLM/AI workflows, has an origin-validation error (an overly permissive CORS configuration combined with a refresh-token cookie set to SameSite=None) that lets a malicious webpage make credentialed cross-origin requests, steal tokens, and ultimately achieve code execution and full system compromise. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).

Origin-validation error (CWE-346) in Langflow (a popular OSS tool for building LLM/AI workflows in a GUI)
Permissive CORS + a SameSite=None refresh-token cookie let a malicious page steal tokens
Stolen tokens reach authenticated endpoints → arbitrary code execution / full system compromise

Medium CVE-2026-34926 2026/05/21

Directory traversal in Trend Micro Apex One (CVE-2026-34926) — risk of deploying malicious code to agents

Trend Micro Apex One (on-premise), an endpoint-protection product, has a directory-traversal vulnerability that could let a pre-authenticated local attacker modify a key table on the server to inject malicious code and deploy it to agents. CISA listed it as known-exploited (KEV) (CVSS 6.7 Medium).

Directory traversal (CWE-23) in Trend Micro Apex One (on-premise EPP)
A pre-authenticated local attacker modifies a key table → risk of deploying malicious code to agents
CVSS is 6.7 (Medium; local/high complexity), but impact is large via management-server-to-endpoints spread

Critical CVE-2026-0257 2026/05/29

Authentication bypass in Palo Alto PAN-OS (CVE-2026-0257) — allows unauthorized VPN connections

An authentication-bypass vulnerability in Palo Alto Networks' firewall OS, PAN-OS, lets an attacker bypass security restrictions and establish an unauthorized VPN connection. CISA listed it as known-exploited (KEV) (CVSS 9.1 Critical).

Authentication-bypass vulnerability in PAN-OS (the OS for Palo Alto firewall products)
An attacker can bypass security restrictions and establish an unauthorized VPN connection
Compromise of a perimeter device = a foothold for internal intrusion. Listed in CISA KEV (CVSS 9.1 Critical)

Critical CVE-2026-48172 2026/05/26

Privilege escalation in the LiteSpeed cPanel plugin (CVE-2026-48172) — any cPanel user gains root

The cPanel plugin for the LiteSpeed web server has a privilege-escalation flaw: any cPanel user account can run arbitrary scripts as root. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical, per NVD).

Privilege escalation (CWE-266) in the LiteSpeed cPanel Plugin (LiteSpeed × cPanel integration)
Any cPanel user account can execute arbitrary scripts with root privileges
In shared hosting, one user's compromise leads directly to whole-server compromise

Critical CVE-2026-9082 2026/05/22

SQL injection in Drupal Core (CVE-2026-9082) — risk of privilege escalation and remote code execution

Drupal, a widely used open-source CMS, has a SQL injection vulnerability in its core via the database abstraction API; specially crafted requests can lead to privilege escalation and remote code execution (RCE). CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical).

SQL injection (CWE-89) in Drupal Core via the database abstraction API
Can lead to privilege escalation and remote code execution (RCE)
A flaw in CMS core functionality = widely deployed, broad blast radius

High CVE-2026-42897 2026/05/15

Cross-site scripting in Microsoft Exchange Server (CVE-2026-42897) — arbitrary JavaScript execution in OWA

Microsoft Exchange Server, a mail server, has a cross-site scripting (XSS) vulnerability where, during web page generation in Outlook Web Access (OWA) and under certain interaction conditions, arbitrary JavaScript can be executed in the browser context. CISA listed it as known-exploited (KEV) (CVSS 8.1 High).

Cross-site scripting (CWE-79) in Microsoft Exchange Server's Outlook Web Access (OWA)
Under certain conditions, arbitrary JavaScript can run in the browser context
Can lead to session hijacking, email theft, and impersonation

Critical CVE-2026-20182 2026/05/14

Authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182) — admin access without authentication, a perfect CVSS 10.0

Cisco's SD-WAN products, Catalyst SD-WAN Controller and Manager, have an authentication-bypass vulnerability that lets an unauthenticated remote attacker bypass authentication and obtain administrative privileges. CVSS is a perfect 10.0 (Critical). CISA listed it as known-exploited (KEV) and issued Emergency Directive 26-03.

Authentication bypass (CWE-287) in Cisco Catalyst SD-WAN Controller/Manager
An unauthenticated remote attacker obtains admin privileges = seizing the network control center
CVSS is a perfect 10.0 (Critical). Listed in CISA KEV = exploitation confirmed

Critical CVE-2026-42208 2026/05/08

SQL injection in LiteLLM, an LLM proxy (CVE-2026-42208) — the proxy's database and the credentials it manages are at risk

BerriAI LiteLLM, an open-source LLM proxy/gateway that unifies many LLM providers, has a SQL injection vulnerability. An attacker can read — and potentially modify — the proxy's database, leading to unauthorized access to the proxy and the credentials (API keys, etc.) it manages. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical).

SQL injection (CWE-89) in BerriAI LiteLLM (a popular OSS LLM proxy/gateway)
An attacker can read/modify the proxy's DB, reaching the proxy and the credentials it manages
An LLM proxy centrally manages many API keys/tokens = the "keyring" is exposed at once

High CVE-2026-6973 2026/05/07

Input-validation vulnerability in Ivanti EPMM (CVE-2026-6973) — remote code execution by an authenticated administrator

Ivanti Endpoint Manager Mobile (EPMM), a mobile-device management product, has an improper-input-validation vulnerability that lets a remotely authenticated user with administrative access achieve remote code execution (RCE). CISA listed it as known-exploited (KEV) (CVSS 7.2 High).

Improper input validation (CWE-20) in Ivanti EPMM (mobile-device management; formerly MobileIron)
A remotely authenticated user with admin access can achieve remote code execution (RCE)
Requires auth/admin so CVSS is 7.2 (High), but impact is large given it is a management platform

Critical CVE-2026-0300 2026/05/06

Out-of-bounds write in Palo Alto PAN-OS (CVE-2026-0300) — unauthenticated root code execution on the firewall

PAN-OS, the OS for Palo Alto Networks firewalls, has an out-of-bounds write flaw in the User-ID Authentication Portal (Captive Portal). A remote, unauthenticated attacker can execute code as root on PA-Series and VM-Series firewalls via crafted packets. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical, per NVD).

Out-of-bounds write in the User-ID Authentication Portal (Captive Portal) of PAN-OS
A remote, unauthenticated attacker can run code as root on PA/VM-Series via crafted packets
Listed in CISA KEV = exploitation confirmed; NVD base score near-maximum 9.8 Critical

High CVE-2026-31431 2026/05/01

Privilege escalation in the Linux kernel (CVE-2026-31431) — a local attacker gains higher privileges

The Linux kernel — the core of the Linux OS — has an incorrect-resource-transfer-between-spheres flaw (CWE-669). A local attacker already on the machine can achieve privilege escalation (gaining higher privileges). CISA listed it as known-exploited (KEV) (CVSS 7.8 High, per NVD).

Privilege escalation via incorrect resource transfer between spheres (CWE-669) in the Linux kernel
Local escalation (attacker already has some execution), not a standalone remote intrusion
Listed in CISA KEV = exploitation confirmed; NVD base score 7.8 High

New KEV (confirmed exploited)

Newly added exploited vulnerabilities

Vulnerabilities CISA has confirmed are exploited in the wild, newest first from the source feed.

Exploited Ransomware use Check Point Security Gateway — Check Point Security Gateway Improper Authentication Vulnerability CVE-2026-50751 ・ 2026/06/08
Exploited Mirasvit Mirasvit Full Page Cache Warmer — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability CVE-2026-45247 ・ 2026/06/03
Exploited Daemon Daemon Tools Lite — Daemon Tools Lite Embedded Malicious Code Vulnerability CVE-2026-8398 ・ 2026/05/27
Exploited Microsoft Defender — Microsoft Defender Denial of Service Vulnerability CVE-2026-45498 ・ 2026/05/20
Exploited Microsoft Defender — Microsoft Defender Link Following Vulnerability CVE-2026-41091 ・ 2026/05/20
Exploited Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability CVE-2010-0806 ・ 2026/05/20
Exploited Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability CVE-2010-0249 ・ 2026/05/20
Exploited Adobe Acrobat and Reader — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability CVE-2009-3459 ・ 2026/05/20
Exploited Microsoft DirectX — Microsoft DirectX NULL Byte Overwrite Vulnerability CVE-2009-1537 ・ 2026/05/20
Exploited Microsoft Windows — Microsoft Windows Buffer Overflow Vulnerability CVE-2008-4250 ・ 2026/05/20
Exploited Microsoft Windows — Microsoft Windows Protection Mechanism Failure Vulnerability CVE-2026-32202 ・ 2026/04/28
Exploited Ransomware use SimpleHelp SimpleHelp — SimpleHelp Missing Authorization Vulnerability CVE-2024-57726 ・ 2026/04/24
Exploited Ransomware use SimpleHelp SimpleHelp — SimpleHelp Path Traversal Vulnerability CVE-2024-57728 ・ 2026/04/24
Exploited Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability CVE-2024-7399 ・ 2026/04/24
Exploited D-Link DIR-823X — D-Link DIR-823X Command Injection Vulnerability CVE-2025-29635 ・ 2026/04/24
Exploited Marimo Marimo — Marimo Remote Code Execution Vulnerability CVE-2026-39987 ・ 2026/04/23
Exploited Microsoft Defender — Microsoft Defender Insufficient Granularity of Access Control Vulnerability CVE-2026-33825 ・ 2026/04/22
Exploited Ransomware use JetBrains TeamCity — JetBrains TeamCity Relative Path Traversal Vulnerability CVE-2024-27199 ・ 2026/04/20
Exploited Quest KACE Systems Management Appliance (SMA) — Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability CVE-2025-32975 ・ 2026/04/20
Exploited Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability CVE-2026-20128 ・ 2026/04/20
Exploited Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability CVE-2025-48700 ・ 2026/04/20
Exploited Ransomware use PaperCut NG/MF — PaperCut NG/MF Improper Authentication Vulnerability CVE-2023-27351 ・ 2026/04/20
Exploited Kentico Kentico Xperience — Kentico Xperience Path Traversal Vulnerability CVE-2025-2749 ・ 2026/04/20
Exploited Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability CVE-2026-20133 ・ 2026/04/20
Exploited Cisco Catalyst SD-WAN Manger — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability CVE-2026-20122 ・ 2026/04/20
Exploited Apache ActiveMQ — Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197 ・ 2026/04/16
Exploited Microsoft SharePoint Server — Microsoft SharePoint Server Improper Input Validation Vulnerability CVE-2026-32201 ・ 2026/04/14
Exploited Microsoft Office — Microsoft Office Remote Code Execution CVE-2009-0238 ・ 2026/04/14
Exploited Adobe Acrobat and Reader — Adobe Acrobat and Reader Prototype Pollution Vulnerability CVE-2026-34621 ・ 2026/04/13
Exploited Fortinet FortiClient EMS — Fortinet FortiClient EMS SQL Injection Vulnerability CVE-2026-21643 ・ 2026/04/13

This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.

High-severity CVEs (NVD)

High-severity CVEs from the NVD

Newly published high-severity (CVSS high to critical) CVEs from the U.S. NVD.

This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).