Actively exploited vulnerabilities

    Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

    1,762 CVEs in the CISA KEV catalog · How we calculate priority

    Export (max. 1,000 rows):CSVJSON

    Entries in the CISA KEV catalog
    SeverityCVETitlePriority (0–325)Published (CVE)
    CriticalCVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data Vulnerability276.8
    CriticalCVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability273.4
    CriticalCVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlink271.7
    CriticalCVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login Flow270.7
    CriticalCVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Access269.7
    CriticalCVE-2026-45659Microsoft SharePoint Remote Code Execution Vulnerability268.4
    CriticalCVE-2026-1731BeyondTrust Remote Support (RS) & Privileged Remote Access (PRA): OS Command Injection268.4
    CriticalCVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability267.9
    CriticalCVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities267.7
    CriticalCVE-2025-52691Upload Arbitrary Files267.7
    CriticalCVE-2026-23760SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API267.5
    CriticalCVE-2025-55182Meta React Server Components Remote Code Execution Vulnerability267.5
    CriticalCVE-2026-24423SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API267.4
    CriticalCVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability266.5
    CriticalCVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License Servlet266.0
    CriticalCVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability265.2
    CriticalCVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability264.8
    CriticalCVE-2025-14733WatchGuard Firebox iked Out of Bounds Write Vulnerability264.0
    CriticalCVE-2025-53770Microsoft SharePoint Server Remote Code Execution Vulnerability264.0
    CriticalCVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)263.7
    CriticalCVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code262.5
    CriticalCVE-2025-31161CrushFTP Authentication Bypass Vulnerability262.4
    CriticalCVE-2024-51378CyberPanel Incorrect Default Permissions Vulnerability261.5
    CriticalCVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication Vulnerability261.3
    CriticalCVE-2024-51567CyberPanel Incorrect Default Permissions Vulnerability261.2
    CriticalCVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread261.0
    CriticalCVE-2024-55956Cleo Multiple Products Unauthenticated File Upload Vulnerability260.9
    CriticalCVE-2024-57726SimpleHelp Missing Authorization Vulnerability260.9
    CriticalCVE-2024-0012PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)260.9
    CriticalCVE-2024-50623Cleo Multiple Products Unrestricted File Upload Vulnerability260.6
    CriticalCVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability260.3
    CriticalCVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect259.9
    CriticalCVE-2024-40711Veeam Backup and Replication Deserialization Vulnerability259.9
    CriticalCVE-2024-6670WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability259.9
    CriticalCVE-2024-1709Authentication bypass using an alternate path or channel259.5
    CriticalCVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection259.4
    CriticalCVE-2024-4577Argument Injection in PHP-CGI259.4
    CriticalCVE-2023-22527Atlassian Confluence Data Center and Server Template Injection Vulnerability259.3
    CriticalCVE-2024-23692Rejetto HTTP File Server 2.3m Unauthenticated RCE259.2
    CriticalCVE-2025-8088Path traversal vulnerability in WinRAR259.1
    CriticalCVE-2026-109618RCE via OOM corruption259.0
    CriticalCVE-2025-49704Microsoft SharePoint Remote Code Execution Vulnerability258.8
    CriticalCVE-2023-22518Atlassian Confluence Data Center and Server Improper Authorization Vulnerability258.8
    CriticalCVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data Vulnerability258.7
    CriticalCVE-2024-27198JetBrains TeamCity Authentication Bypass Vulnerability258.6
    CriticalCVE-2023-22515Atlassian Confluence Data Center and Server Broken Access Control Vulnerability258.5
    CriticalCVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability258.4
    CriticalCVE-2024-23897Jenkins Command Line Interface (CLI) Path Traversal Vulnerability258.3
    CriticalCVE-2026-88771Citrix NetScaler Improper Input Validation Vulnerability258.3
    CriticalCVE-2023-35082Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability258.3