KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

KEV / Index

CISA Known Exploited Vulnerabilities: full index

Every vulnerability CISA has confirmed as exploited in the wild, newest first, with filters across the whole catalog.

Catalog
2026.10.30
Entries
1,766
First added
2021-11-03
Latest added
2026-10-30

Answer CISA's KEV catalog lists 1,766 vulnerabilities as of catalog 2026.10.30. 36 were added in the 30 days to 2026-10-30, and 361 (20.4%) are flagged as used in ransomware campaigns.

Entries
1,766all time
Last 7 days
+10added
Last 30 days
+36added
Last 90 days
+110added
Ransomware: known
20.4%361 entries
Open deadlines
11federal due date ahead

QFilter the catalog

Filters all 1,766 entries in your browser. Without JavaScript, use the year archives below.

YYear archives

Ransomware-linked entries
KEV additions by year
YearAddedRansomware: knownShareMedian days to due
2026282279.6%3
20252453112.7%21
20241864423.7%21
20231874323%21
202255513223.8%21
20213118427%181

DOpen federal deadlines

due date on or after 2026-10-30
KEV entries whose federal due date is on or after 2026-10-30
CVEVendorProductDueTime left
CVE-2026-46300LinuxKernel1 days
CVE-2026-97229GitLabCommunity Edition and Enterprise Edition2 days
CVE-2026-76418CiscoSecure Firewall ASA Software and Cisco Secure FTD Software2 days
CVE-2026-111357IvantiConnect Secure3 days
CVE-2026-96655PlexMedia Server4 days
CVE-2026-96652PlexMedia Server4 days
CVE-2026-110936SiemensSoftware Center4 days
CVE-2026-48356AdobeCommerce and Magento11 days
CVE-2026-111497GoogleBrotli11 days
CVE-2026-41709BroadcomVMware ESX12 days
CVE-2026-118527IvantiConnect Secure14 days

LLatest 100 additions

RSS
The 100 most recent KEV additions
CVEVendorProductVulnerabilityAddedDueRansomwareCWE
CVE-2026-118527IvantiConnect SecureIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability New OpenUnknownCWE-340
CVE-2026-111357IvantiConnect SecureIvanti Connect Secure Missing Authentication for Critical Function Vulnerability New OpenUnknownCWE-306, CWE-862, CWE-345
CVE-2026-97229GitLabCommunity Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability New OpenUnknownCWE-190
CVE-2026-76418CiscoSecure Firewall ASA Software and Cisco Secure FTD SoftwareCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability New OpenUnknownCWE-690
CVE-2026-46300LinuxKernelLinux Kernel Missing Initialization of a Variable Vulnerability New OpenUnknownCWE-456
CVE-2026-41709BroadcomVMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability New OpenUnknownCWE-778
CVE-2026-48356AdobeCommerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability New OpenUnknownCWE-434
CVE-2026-111497GoogleBrotliGoogle Brotli Unchecked Return Value Vulnerability New OpenUnknownCWE-252, CWE-787
CVE-2026-109619PHP GroupPHPPHP Stale Internal Request-State Vulnerability NewUnknownCWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
CVE-2026-109618PHP GroupPHPPHP Memory Corruption Vulnerability NewUnknownCWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
CVE-2026-114625AristaVeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection VulnerabilityUnknownCWE-89
CVE-2026-110447CollaboraCollabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection VulnerabilityUnknownCWE-78
CVE-2026-96656PlexMedia ServerPlex Media Server External Control of File Name or Path VulnerabilityUnknownCWE-73
CVE-2026-96655PlexMedia ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability OpenUnknownCWE-918
CVE-2026-96654PlexMedia ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityUnknownCWE-84
CVE-2026-96652PlexMedia ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability OpenUnknownCWE-918
CVE-2026-110936SiemensSoftware CenterSiemens Software Center Uncontrolled Search Path Element Vulnerability OpenUnknownCWE-427
CVE-2026-106931EG Secure SolutionsSiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityUnknownCWE-78
CVE-2026-102764BeyondTrustRemote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityUnknownCWE-290
CVE-2025-61624FortinetMultiple ProductsFortinet Multiple Products Path Traversal VulnerabilityUnknownCWE-22
CVE-2026-21589AtlassianMultiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityUnknownCWE-552
CVE-2026-76519CiscoSecure Email GatewayCisco Secure Email Gateway Relative Path Traversal VulnerabilityUnknownCWE-23
CVE-2026-105134AhsayAhsayCBSAhsay AhsayCBS Command Injection VulnerabilityUnknownCWE-77, CWE-78
CVE-2026-105133AhsayAhsayCBSAhsay AhsayCBS Improper Authentication VulnerabilityUnknownCWE-287
CVE-2026-0322Palo Alto NetworksPAN-OSPalo Alto Networks PAN-OS Code Injection VulnerabilityUnknownCWE-94
CVE-2026-96951MicrosoftWindowsMicrosoft Windows Command Injection VulnerabilityUnknownCWE-77
CVE-2026-104935IvantiConnect SecureIvanti Connect Secure Authentication Bypass by Spoofing VulnerabilityUnknownCWE-290
CVE-2023-22894StrapiStrapiStrapi Cleartext Storage of Sensitive Information VulnerabilityUnknownCWE-312
CVE-2021-3199ONLYOFFICEDocsONLYOFFICE Docs Server Path Traversal VulnerabilityUnknownCWE-22
CVE-2016-3081ApacheStrutsApache Struts Command Injection VulnerabilityUnknownCWE-77
CVE-2015-5477ISCBIND ISC BIND Data Processing Errors VulnerabilityUnknownCWE-19
CVE-2015-3306ProFTPDProFTPDProFTPD Improper Access Control VulnerabilityUnknownCWE-284
CVE-2026-88779CitrixNetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityUnknownCWE-119
CVE-2026-102490Zammad GmbHZammadZammad GmbH Zammad Improper Privilege Management VulnerabilityUnknownCWE-269
CVE-2026-102489Zammad GmbHZammadZammad GmbH Zammad Session Fixation VulnerabilityUnknownCWE-384
CVE-2026-104286FortinetFortiMailFortinet FortiMail Path Traversal VulnerabilityUnknownCWE-22, CWE-158
CVE-2026-76504CiscoCatalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityUnknownCWE-177
CVE-2026-86950AppleMultiple ProductsApple Multiple Products Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2026-88772CitrixNetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityUnknownCWE-119
CVE-2026-88771CitrixNetScalerCitrix NetScaler Improper Input Validation VulnerabilityUnknownCWE-119
CVE-2026-87902WordPressCoreWordPress Core Remote File Inclusion VulnerabilityUnknownCWE-98
CVE-2026-67279MikroTikRouterOSMikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityUnknownCWE-841
CVE-2026-65660MicrosoftSharePointMicrosoft SharePoint Code Injection VulnerabilityUnknownCWE-94
CVE-2026-71362AdobeCommerce and Magento Adobe Commerce and Magento Incorrect Authorization Vulnerability UnknownCWE-863
CVE-2026-5430WSO2Multiple ProductsWSO2 Multiple Products Path Traversal Vulnerability UnknownCWE-347
CVE-2026-94127F5BIG-IP APMF5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityUnknownCWE-122
CVE-2026-93952AristaVeloCloud OrchestratorArista VeloCloud Orchestrator Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2026-93616Check PointMultiple ProductsCheck Point Multiple Products Path Traversal VulnerabilityUnknownCWE-22
CVE-2026-85102Check PointMultiple ProductsCheck Point Multiple Products Improper Certificate Validation VulnerabilityUnknownCWE-295
CVE-2026-7273ZyxelGS1900 Series SwitchesZyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityUnknownCWE-121
CVE-2026-53266LinuxKernelLinux Kernel Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2025-39964LinuxKernelLinux Kernel Race Condition VulnerabilityUnknownCWE-362
CVE-2025-39682LinuxKernelLinux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityUnknownCWE-754
CVE-2026-87886AcronisBackupAcronis Backup Incorrect Default Permissions VulnerabilityUnknownCWE-276
CVE-2026-76460CiscoIdentity Services EngineCisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityUnknownCWE-648
CVE-2026-58704GooglePixelGoogle Pixel Improper Authorization VulnerabilityUnknownCWE-693
CVE-2026-76461CiscoSecure Email GatewayCisco Secure Email Gateway SQL Injection VulnerabilityUnknownCWE-89
CVE-2026-85706GitLabCommunity Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityUnknownCWE-35
CVE-2026-84869ConnectWiseScreenConnectConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityUnknownCWE-269, CWE-862
CVE-2026-42018JFrogArtifactoryJFrog Artifactory Improper Authentication VulnerabilityUnknownCWE-287
CVE-2026-42016JFrogArtifactoryJFrog Artifactory Incorrect Authorization VulnerabilityUnknownCWE-863
CVE-2026-86060MikroTikRouterOSMikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityUnknownCWE-88
CVE-2026-67277MikroTikRouterOSMikroTik RouterOS Missing Authentication for Critical Function VulnerabilityUnknownCWE-306
CVE-2026-87491GoogleChromium V8Google Chromium V8 Out of Bounds Write VulnerabilityUnknownCWE-787
CVE-2026-20079CiscoSecure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementCisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityUnknownCWE-288
CVE-2026-19490CitrixNetScalerCitrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityUnknownCWE-288
CVE-2025-25249FortinetMultiple ProductsFortinet Multiple Products Heap-based Buffer Overflow VulnerabilityUnknownCWE-122, CWE-787
CVE-2026-86218N-ableN-centralN-able N-central Static Code Injection VulnerabilityUnknownCWE-96
CVE-2026-85880MicrosoftWindowsMicrosoft Windows Heap-Based Buffer Overflow VulnerabilityUnknownCWE-122, CWE-908
CVE-2026-81963MicrosoftWindowsMicrosoft Windows Link Following VulnerabilityUnknownCWE-59, CWE-284
CVE-2026-75650AdobeCommerce and MagentoAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityUnknownCWE-1336
CVE-2026-85046GoogleChromium V8Google Chromium V8 Type Confusion VulnerabilityUnknownCWE-843
CVE-2026-9586SangomaSwitchvoxSangoma Switchvox SQL Injection VulnerabilityUnknownCWE-89
CVE-2026-83549SonicWallSMA1000 AppliancesSonicWall SMA1000 Appliances OS Command Injection VulnerabilityUnknownCWE-78
CVE-2026-83548SonicWallSMA1000 AppliancesSonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityUnknownCWE-918, CWE-441
CVE-2026-82329JFrogArtifactoryJFrog Artifactory Improper Authentication VulnerabilityUnknownCWE-287
CVE-2026-59822BerriAILiteLLMBerriAI LiteLLM Improper Authentication VulnerabilityUnknownCWE-287, CWE-306
CVE-2026-49869KestraKestra OSSKestra OSS OS Command Injection VulnerabilityUnknownCWE-78, CWE-184, CWE-287, CWE-918
CVE-2026-48710KludexStarletteKludex Starlette HTTP Request/Response Smuggling VulnerabilityUnknownCWE-444
CVE-2026-82078PaperCutNG/MFPaperCut NG/MF Unsafe Reflection VulnerabilityUnknownCWE-470
CVE-2026-81578PaperCutNG/MFPaperCut NG/MF Missing Authentication for Critical Function VulnerabilityUnknownCWE-306
CVE-2026-66384JFrogArtifactoryJFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityUnknownCWE-22
CVE-2026-53362LinuxKernelLinux Kernel Unspecified VulnerabilityUnknownnone listed
CVE-2023-49105ownCloudownCloudownCloud Improper Authentication VulnerabilityUnknownCWE-287
CVE-2026-8452CitrixNetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityUnknownCWE-119
CVE-2022-0995LinuxKernelLinux Kernel Out-of-Bounds Write VulnerabilityUnknownCWE-787
CVE-2021-23758Ajax.NET ProfessionalAjax.NET ProfessionalAjax.NET Professional Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2019-1068MicrosoftSQL ServerMicrosoft SQL Server Remote Code Execution VulnerabilityUnknownnone listed
CVE-2015-5287Red HatAutomatic Bug Reporting ToolRed Hat Automatic Bug Reporting Tool Privilege Escalation VulnerabilityUnknownnone listed
CVE-2015-3246Red HatLibuserRed Hat Libuser Race Condition VulnerabilityUnknownnone listed
CVE-2026-60004GiteaGiteaGitea Code Injection VulnerabilityUnknownCWE-94
CVE-2026-21962OracleHTTP Server and Oracle Weblogic Server Proxy Plug-inOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityUnknownCWE-284
CVE-2026-73570SynacorZimbra Collaboration Suite (ZCS)Zimbra Collaboration Suite (ZCS) OS Command Injection VulnerabilityUnknownCWE-78
CVE-2026-72530TrueConfServerTrueConf Server Code Injection VulnerabilityUnknownCWE-94
CVE-2026-72529TrueConfServerTrueConf Server Missing Authentication for Critical Function VulnerabilityUnknownCWE-306
CVE-2026-64849MLflowMLflowMLflow Server-Side Request Forgery VulnerabilityUnknownCWE-918
CVE-2026-65400ApplemacOSApple macOS Improper Authentication VulnerabilityUnknownCWE-287
CVE-2026-59310BroadcomVMware vCenterBroadcom VMware vCenter Path Traversal VulnerabilityKnownCWE-22
CVE-2026-55040MicrosoftSharePointMicrosoft SharePoint Weak Authentication VulnerabilityUnknownCWE-1390
CVE-2026-33824MicrosoftInternet Key Exchange (IKE) Service ExtensionsMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityUnknownCWE-415

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings