Actively exploited vulnerabilities

    Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

    1,768 CVEs in the CISA KEV catalog · How we calculate priority

    Export (max. 1,000 rows):CSVJSON

    Entries in the CISA KEV catalog
    SeverityCVETitlePriority (0–325)Published (CVE)
    CriticalCVE-2025-5086Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability234.0
    CriticalCVE-2023-7028Weak Password Recovery Mechanism for Forgotten Password in GitLab234.0
    CriticalCVE-2019-1069Task Scheduler Elevation of Privilege Vulnerability234.0
    CriticalCVE-2026-20245Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability233.9
    CriticalCVE-2025-54948Trend Micro Apex One OS Command Injection Vulnerability233.9
    CriticalCVE-2024-4040Unauthenticated arbitrary file read and remote code execution in CrushFTP233.9
    CriticalCVE-2024-27348Apache HugeGraph-Server: Command execution in gremlin233.9
    CriticalCVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability233.7
    CriticalCVE-2025-31200Apple Multiple Products Memory Corruption Vulnerability233.7
    CriticalCVE-2024-38812Heap-overflow vulnerability233.7
    CriticalCVE-2024-3272D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials233.7
    CriticalCVE-2026-16232Authentication Bypass in the SmartConsole Login Process Using an Application Token233.6
    CriticalCVE-2023-20198Cisco IOS XE Web UI Privilege Escalation Vulnerability233.5
    CriticalCVE-2025-43529Apple Multiple Products Use-After-Free WebKit Vulnerability233.5
    CriticalCVE-2025-40536SolarWinds Web Help Desk Security Control Bypass Vulnerability233.3
    CriticalCVE-2025-2775SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection233.3
    CriticalCVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor233.3
    CriticalCVE-2024-29824Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability233.2
    CriticalCVE-2024-21413Microsoft Outlook Remote Code Execution Vulnerability233.2
    CriticalCVE-2026-87491Google Chromium V8 Out of Bounds Write Vulnerability233.2
    CriticalCVE-2019-5591Fortinet FortiOS Default Configuration Vulnerability233.2
    CriticalCVE-2016-0167Microsoft Win32k Privilege Escalation Vulnerability233.2
    CriticalCVE-2026-21513MSHTML Framework Security Feature Bypass Vulnerability233.2
    CriticalCVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability233.2
    CriticalCVE-2025-30406Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability233.1
    CriticalCVE-2023-49103ownCloud graphapi Information Disclosure Vulnerability233.1
    CriticalCVE-2025-0108PAN-OS: Authentication Bypass in the Management Web Interface233.1
    CriticalCVE-2024-8963Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability233.1
    CriticalCVE-2023-45249Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability233.1
    CriticalCVE-2025-24085Apple Multiple Products Use-After-Free Vulnerability233.1
    CriticalCVE-2026-42018Anonymous user token generation exposure in JFrog Artifactory233.1
    CriticalCVE-2024-58136Yiiframework Yii Improper Protection of Alternate Path Vulnerability233.1
    CriticalCVE-2026-76519Cisco Secure Email Gateway Arbitrary File Write Vulnerability233.1
    CriticalCVE-2022-44698Windows SmartScreen Security Feature Bypass Vulnerability233.0
    CriticalCVE-2025-33053Internet Shortcut Files Remote Code Execution Vulnerability232.9
    CriticalCVE-2024-11120GeoVision EOL devices - OS Command Injection232.8
    CriticalCVE-2025-4008Arbitrary Command Injection in Smartbedded MeteoBridge232.8
    CriticalCVE-2025-33073Windows SMB Client Elevation of Privilege Vulnerability232.8
    CriticalCVE-2018-19953QNAP NAS File Station Cross-Site Scripting Vulnerability232.7
    CriticalCVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability232.7
    CriticalCVE-2025-10585Google Chromium V8 Type Confusion Vulnerability232.6
    CriticalCVE-2023-34048VMware vCenter Server Out-of-Bounds Write Vulnerability232.6
    CriticalCVE-2020-1472Netlogon Elevation of Privilege Vulnerability232.4
    CriticalCVE-2024-9465Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure232.4
    CriticalCVE-2025-21042Samsung Mobile Devices Out-of-Bounds Write Vulnerability232.3
    CriticalCVE-2025-31201Apple Multiple Products Arbitrary Read and Write Vulnerability232.1
    CriticalCVE-2024-23113Fortinet Multiple Products Format String Vulnerability232.1
    CriticalCVE-2023-36845Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability232.0
    CriticalCVE-2025-58360OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability231.9
    CriticalCVE-2025-6543Memory overflow vulnerability leading to unintended control flow and Denial of Service231.8