Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,762 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2023-35078	Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability	258.1	25.07.2023
Critical	CVE-2025-23006	SonicWall SMA1000 Appliances Deserialization Vulnerability	258.1	23.01.2025
Critical	CVE-2026-88771	Citrix NetScaler Improper Input Validation Vulnerability	258.1	27.09.2026
Critical	CVE-2024-21762	Fortinet FortiOS Out-of-Bound Write Vulnerability	258.0	09.02.2024
Critical	CVE-2023-47246	SysAid Server Path Traversal Vulnerability	257.7	10.11.2023
Critical	CVE-2023-46747	BIG-IP Configuration utility unauthenticated remote code execution vulnerability	257.5	26.10.2023
Critical	CVE-2023-42793	JetBrains TeamCity Authentication Bypass Vulnerability	257.4	19.09.2023
Critical	CVE-2025-0282	Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability	257.4	08.01.2025
Critical	CVE-2026-93616	Directory Traversal and File upload allows execution of arbitrary script on the Management Server	257.4	22.09.2026
Critical	CVE-2023-43208	NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability	257.3	26.10.2023
Critical	CVE-2023-38035	Ivanti Sentry Authentication Bypass Vulnerability	257.2	21.08.2023
Critical	CVE-2023-29300	Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution	257.0	12.07.2023
Critical	CVE-2023-3519	Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability	257.0	19.07.2023
Critical	CVE-2024-41713	Mitel MiCollab Path Traversal Vulnerability	257.0	21.10.2024
Critical	CVE-2024-9680	Mozilla Firefox Use-After-Free Vulnerability	257.0	09.10.2024
Critical	CVE-2023-38203	Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE	256.9	20.07.2023
Critical	CVE-2023-29357	Microsoft SharePoint Server Elevation of Privilege Vulnerability	256.8	13.06.2023
Critical	CVE-2026-76504	Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability	256.7	30.09.2026
Critical	CVE-2023-34362	Progress MOVEit Transfer SQL Injection Vulnerability	256.7	02.06.2023
Critical	CVE-2025-24813	Apache Tomcat Path Equivalence Vulnerability	256.7	10.03.2025
Critical	CVE-2026-76460	Cisco Identity Services Engine Authentication Bypass Vulnerability	256.7	16.09.2026
Critical	CVE-2026-85706	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab	256.5	12.09.2026
Critical	CVE-2023-27350	PaperCut MF/NG Improper Access Control Vulnerability	256.5	20.04.2023
Critical	CVE-2026-88772	Memory overflow vulnerability leading to Remote Code Execution or Denial of Service	256.4	27.09.2026
Critical	CVE-2026-21589	Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability	256.4	05.10.2026
Critical	CVE-2022-47986	IBM Aspera Faspex code execution	256.2	17.02.2023
Critical	CVE-2023-48788	Fortinet FortiClient EMS SQL Injection Vulnerability	256.1	12.03.2024
Critical	CVE-2026-109619	RCE via stale global state	256.0	21.10.2026
Critical	CVE-2022-27593	DeadBolt Ransomware	256.0	08.09.2022
Critical	CVE-2022-47966	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	256.0	18.01.2023
Critical	CVE-2023-41265	Qlik Sense HTTP Tunneling Vulnerability	256.0	29.08.2023
Critical	CVE-2024-40766	SonicWall SonicOS Improper Access Control Vulnerability	255.7	23.08.2024
Critical	CVE-2026-111497	Out-of-Bounds Write in Google Brotli Decoder	255.6	22.10.2026
Critical	CVE-2023-4966	Unauthenticated sensitive information disclosure	255.6	10.10.2023
Critical	CVE-2026-15410	SonicWall SMA1000 Appliances Code Injection Vulnerability	255.6	14.07.2026
Critical	CVE-2022-40684	Fortinet Multiple Products Authentication Bypass Vulnerability	255.5	18.10.2022
Critical	CVE-2022-21587	Oracle E-Business Suite Unspecified Vulnerability	255.4	18.10.2022
Critical	CVE-2023-28461	Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability	255.3	15.03.2023
Critical	CVE-2022-41352	Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability	255.3	26.09.2022
Critical	CVE-2021-44228	Apache Log4j2 Remote Code Execution Vulnerability	255.2	10.12.2021
Critical	CVE-2023-48365	Qlik Sense HTTP Tunneling Vulnerability	255.0	15.11.2023
Critical	CVE-2022-37042	Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability	255.0	11.08.2022
Critical	CVE-2020-0796	Microsoft SMBv3 Remote Code Execution Vulnerability	254.9	12.03.2020
Critical	CVE-2021-22205	GitLab Community and Enterprise Editions Remote Code Execution Vulnerability	254.9	23.04.2021
Critical	CVE-2022-26134	Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability	254.9	03.06.2022
Critical	CVE-2022-26352	dotCMS Unrestricted Upload of File Vulnerability	254.8	17.07.2022
Critical	CVE-2024-21887	Ivanti Connect Secure and Policy Secure Command Injection Vulnerability	254.7	12.01.2024
Critical	CVE-2022-1388	F5 BIG-IP Missing Authentication Vulnerability	254.7	05.05.2022
Critical	CVE-2026-102764	Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support	254.7	15.10.2026
Critical	CVE-2022-29464	WSO2 Multiple Products Unrestrictive Upload of File Vulnerability	254.7	18.04.2022