Browse all
Known Exploited Vulnerabilities (CISA KEV) — all
The full CISA KEV catalog of vulnerabilities confirmed exploited in the wild — filter and search by year, ransomware use, and date added.
1,657 results
| Urgency | CVE | Name / product | Vendor | KEV added |
|---|---|---|---|---|
| Critical | CVE-2026-24423 ↗ | SmarterTools SmarterMail — SmarterTools SmarterMail Missing Authentication for... | SmarterTools | Feb 5, 2026 |
| High | CVE-2025-11953 ↗ | React Native Community CLI — React Native Community CLI OS Command Injection V... | React Native Community | Feb 5, 2026 |
| High | CVE-2025-40551 ↗ | SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrust... | SolarWinds | Feb 3, 2026 |
| High | CVE-2019-19006 ↗ | Sangoma FreePBX — Sangoma FreePBX Improper Authentication Vulnerability | Sangoma | Feb 3, 2026 |
| High | CVE-2025-64328 ↗ | Sangoma FreePBX — Sangoma FreePBX OS Command Injection Vulnerability | Sangoma | Feb 3, 2026 |
| High | CVE-2021-39935 ↗ | GitLab Community and Enterprise Editions — GitLab Community and Enterprise Edi... | GitLab | Feb 3, 2026 |
| High | CVE-2026-1281 ↗ | Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM)... | Ivanti | Jan 29, 2026 |
| High | CVE-2026-24858 ↗ | Fortinet Multiple Products — Fortinet Multiple Products Authentication Bypass... | Fortinet | Jan 27, 2026 |
| High | CVE-2026-21509 ↗ | Microsoft Office — Microsoft Office Security Feature Bypass Vulnerability | Microsoft | Jan 26, 2026 |
| High | CVE-2026-24061 ↗ | GNU InetUtils — GNU InetUtils Argument Injection Vulnerability | GNU | Jan 26, 2026 |
| Critical | CVE-2026-23760 ↗ | SmarterTools SmarterMail — SmarterTools SmarterMail Authentication Bypass Usin... | SmarterTools | Jan 26, 2026 |
| Critical | CVE-2025-52691 ↗ | SmarterTools SmarterMail — SmarterTools SmarterMail Unrestricted Upload of Fil... | SmarterTools | Jan 26, 2026 |
| High | CVE-2018-14634 ↗ | Linux Kernel — Linux Kernel Integer Overflow Vulnerability | Linux | Jan 26, 2026 |
| High | CVE-2024-37079 ↗ | Broadcom VMware vCenter Server — Broadcom VMware vCenter Server Out-of-bounds... | Broadcom | Jan 23, 2026 |
| High | CVE-2025-54313 ↗ | Prettier eslint-config-prettier — Prettier eslint-config-prettier Embedded Mal... | Prettier | Jan 22, 2026 |
| High | CVE-2025-31125 ↗ | Vite Vitejs — Vite Vitejs Improper Access Control Vulnerability | Vite | Jan 22, 2026 |
| High | CVE-2025-34026 ↗ | Versa Concerto — Versa Concerto Improper Authentication Vulnerability | Versa | Jan 22, 2026 |
| High | CVE-2025-68645 ↗ | Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite... | Synacor | Jan 22, 2026 |
| High | CVE-2026-20045 ↗ | Cisco Unified Communications Manager — Cisco Unified Communications Products C... | Cisco | Jan 21, 2026 |
| High | CVE-2026-20805 ↗ | Microsoft Windows — Microsoft Windows Information Disclosure Vulnerability | Microsoft | Jan 13, 2026 |
| High | CVE-2025-8110 ↗ | Gogs Gogs — Gogs Path Traversal Vulnerability | Gogs | Jan 12, 2026 |
| High | CVE-2025-37164 ↗ | Hewlett Packard Enterprise (HPE) OneView — Hewlett Packard Enterprise (HPE) On... | Hewlett Packard Enterprise... | Jan 7, 2026 |
| High | CVE-2009-0556 ↗ | Microsoft Office — Microsoft Office PowerPoint Code Injection Vulnerability | Microsoft | Jan 7, 2026 |
| High | CVE-2025-14847 ↗ | MongoDB MongoDB and MongoDB Server — MongoDB and MongoDB Server Improper Handl... | MongoDB | Dec 29, 2025 |
| High | CVE-2023-52163 ↗ | Digiever DS-2105 Pro — Digiever DS-2105 Pro Missing Authorization Vulnerabilit... | Digiever | Dec 22, 2025 |
| High | CVE-2025-14733 ↗ | WatchGuard Firebox — WatchGuard Firebox Out of Bounds Write Vulnerability | WatchGuard | Dec 19, 2025 |
| High | CVE-2025-20393 ↗ | Cisco Multiple Products — Cisco Multiple Products Improper Input Validation Vu... | Cisco | Dec 17, 2025 |
| High | CVE-2025-40602 ↗ | SonicWall SMA1000 appliance — SonicWall SMA1000 Missing Authorization Vulnerab... | SonicWall | Dec 17, 2025 |
| High | CVE-2025-59374 ↗ | ASUS Live Update — ASUS Live Update Embedded Malicious Code Vulnerability | ASUS | Dec 17, 2025 |
| High | CVE-2025-59718 ↗ | Fortinet Multiple Products — Fortinet Multiple Products Improper Verification... | Fortinet | Dec 16, 2025 |
| High | CVE-2025-43529 ↗ | Apple Multiple Products — Apple Multiple Products Use-After-Free WebKit Vulner... | Apple | Dec 15, 2025 |
| High | CVE-2025-14611 ↗ | Gladinet CentreStack and Triofox — Gladinet CentreStack and Triofox Hard Coded... | Gladinet | Dec 15, 2025 |
| High | CVE-2025-14174 ↗ | Google Chromium — Google Chromium Out of Bounds Memory Access Vulnerability | Dec 12, 2025 | |
| High | CVE-2018-4063 ↗ | Sierra Wireless AirLink ALEOS — Sierra Wireless AirLink ALEOS Unrestricted Upl... | Sierra Wireless | Dec 12, 2025 |
| High | CVE-2025-58360 ↗ | OSGeo GeoServer — OSGeo GeoServer Improper Restriction of XML External Entity... | OSGeo | Dec 11, 2025 |
| High | CVE-2025-62221 ↗ | Microsoft Windows — Microsoft Windows Use After Free Vulnerability | Microsoft | Dec 9, 2025 |
| High | CVE-2025-6218 ↗ | RARLAB WinRAR — RARLAB WinRAR Path Traversal Vulnerability | RARLAB | Dec 9, 2025 |
| High | CVE-2025-66644 ↗ | Array Networks ArrayOS AG — Array Networks ArrayOS AG OS Command Injection Vul... | Array Networks | Dec 8, 2025 |
| High | CVE-2022-37055 ↗ | D-Link Routers — D-Link Routers Buffer Overflow Vulnerability | D-Link | Dec 8, 2025 |
| Critical | CVE-2025-55182 ↗ | Meta React Server Components — Meta React Server Components Remote Code Execut... | Meta | Dec 5, 2025 |
| High | CVE-2021-26828 ↗ | OpenPLC ScadaBR — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous T... | OpenPLC | Dec 3, 2025 |
| High | CVE-2025-48572 ↗ | Android Framework — Android Framework Privilege Escalation Vulnerability | Android | Dec 2, 2025 |
| High | CVE-2025-48633 ↗ | Android Framework — Android Framework Information Disclosure Vulnerability | Android | Dec 2, 2025 |
| High | CVE-2021-26829 ↗ | OpenPLC ScadaBR — OpenPLC ScadaBR Cross-site Scripting Vulnerability | OpenPLC | Nov 28, 2025 |
| High | CVE-2025-61757 ↗ | Oracle Fusion Middleware — Oracle Fusion Middleware Missing Authentication for... | Oracle | Nov 21, 2025 |
| High | CVE-2025-13223 ↗ | Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability | Nov 19, 2025 | |
| High | CVE-2025-58034 ↗ | Fortinet FortiWeb — Fortinet FortiWeb OS Command Injection Vulnerability | Fortinet | Nov 18, 2025 |
| High | CVE-2025-64446 ↗ | Fortinet FortiWeb — Fortinet FortiWeb Path Traversal Vulnerability | Fortinet | Nov 14, 2025 |
| High | CVE-2025-9242 ↗ | WatchGuard Firebox — WatchGuard Firebox Out-of-Bounds Write Vulnerability | WatchGuard | Nov 12, 2025 |
| High | CVE-2025-62215 ↗ | Microsoft Windows — Microsoft Windows Race Condition Vulnerability | Microsoft | Nov 12, 2025 |
Source: official U.S. government open data. This is an organized index, not an official U.S. government site. "Explained" links to our summary page; otherwise links go to the official primary source.