Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,768 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2023-24489	Citrix Content Collaboration ShareFile Improper Access Control Vulnerability	231.8	10.07.2023
Critical	CVE-2024-42009	RoundCube Webmail Cross-Site Scripting Vulnerability	231.8	05.08.2024
Critical	CVE-2026-21509	Microsoft Office Security Feature Bypass Vulnerability	231.7	26.01.2026
Critical	CVE-2023-20887	Vmware Aria Operations for Networks Command Injection Vulnerability	231.7	07.06.2023
Critical	CVE-2023-33246	Apache RocketMQ Command Execution Vulnerability	231.5	24.05.2023
Critical	CVE-2023-52163	Digiever DS-2105 Pro Missing Authorization Vulnerability	231.5	03.02.2025
Critical	CVE-2021-26085	Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability	231.5	03.08.2021
Critical	CVE-2023-28771	Zyxel Multiple Firewalls OS Command Injection Vulnerability	231.4	25.04.2023
Critical	CVE-2019-0543	Microsoft Windows Privilege Escalation Vulnerability	231.4	08.01.2019
Critical	CVE-2023-1671	Sophos Web Appliance Command Injection Vulnerability	231.4	04.04.2023
Critical	CVE-2025-9377	Authenticated RCE via Parental Control command injection	231.4	29.08.2025
Critical	CVE-2023-27992	Zyxel Multiple NAS Devices Command Injection Vulnerability	231.3	19.06.2023
Critical	CVE-2024-28987	SolarWinds Web Help Desk Hardcoded Credential Vulnerability	231.2	21.08.2024
Critical	CVE-2018-19320	GIGABYTE Multiple Products Unspecified Vulnerability	231.2	21.12.2018
Critical	CVE-2023-25280	D-Link DIR-820 Router OS Command Injection Vulnerability	231.2	16.03.2023
Critical	CVE-2023-23397	Microsoft Outlook Elevation of Privilege Vulnerability	231.1	14.03.2023
Critical	CVE-2023-25717	Multiple Ruckus Wireless Products CSRF and RCE Vulnerability	231.0	13.02.2023
Critical	CVE-2024-38475	Apache HTTP Server Improper Escaping of Output Vulnerability	231.0	01.07.2024
Critical	CVE-2022-44877	CWP Control Web Panel OS Command Injection Vulnerability	230.9	05.01.2023
Critical	CVE-2023-49105	ownCloud Improper Authentication Vulnerability	230.8	21.11.2023
Critical	CVE-2024-48248	NAKIVO Backup and Replication Absolute Path Traversal Vulnerability	230.8	04.03.2025
Critical	CVE-2024-37079	Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability	230.8	18.06.2024
Critical	CVE-2022-46169	Unauthenticated Command Injection	230.7	05.12.2022
Critical	CVE-2010-0738	Red Hat JBoss Authentication Bypass Vulnerability	230.7	28.04.2010
Critical	CVE-2022-24816	Improper Control of Generation of Code in jai-ext	230.6	13.04.2022
Critical	CVE-2026-22719	VMware Aria Operations command injection vulnerability	230.6	25.02.2026
Critical	CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	230.6	14.07.2026
Critical	CVE-2022-22947	VMware Spring Cloud Gateway Code Injection Vulnerability	230.4	03.03.2022
Critical	CVE-2022-35914	Teclib GLPI Remote Code Execution Vulnerability	230.3	19.09.2022
Critical	CVE-2026-6973	Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability	230.3	07.05.2026
Critical	CVE-2022-0543	Debian-specific Redis Server Lua Sandbox Escape Vulnerability	230.3	18.02.2022
Critical	CVE-2024-8956	PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication	230.3	17.09.2024
Critical	CVE-2022-3236	Sophos Firewall Code Injection Vulnerability	230.3	23.09.2022
Critical	CVE-2024-11667	Zyxel Multiple Firewalls Path Traversal Vulnerability	230.3	27.11.2024
Critical	CVE-2022-22536	SAP Multiple Products HTTP Request Smuggling Vulnerability	230.3	09.02.2022
Critical	CVE-2026-106931	EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability	230.2	14.10.2026
Critical	CVE-2025-30066	tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability	230.2	15.03.2025
Critical	CVE-2023-20269	Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability	230.2	06.09.2023
Critical	CVE-2019-0859	Microsoft Win32k Privilege Escalation Vulnerability	230.2	09.04.2019
Critical	CVE-2024-7971	Google Chromium V8 Type Confusion Vulnerability	230.1	21.08.2024
Critical	CVE-2026-34621	Adobe Acrobat and Reader Prototype Pollution Vulnerability	230.1	11.04.2026
Critical	CVE-2022-35405	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	230.0	19.07.2022
Critical	CVE-2022-26138	Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability	230.0	20.07.2022
Critical	CVE-2015-3306	ProFTPD Improper Access Control Vulnerability	229.9	18.05.2015
Critical	CVE-2020-6207	SAP Solution Manager Missing Authentication for Critical Function Vulnerability	229.9	10.03.2020
Critical	CVE-2021-41277	GeoJSON URL validation can expose server files and environment variables to unauthorized users	229.8	17.11.2021
Critical	CVE-2020-25213	WordPress File Manager Plugin Remote Code Execution Vulnerability	229.8	09.09.2020
Critical	CVE-2021-36955	Windows Common Log File System Driver Elevation of Privilege Vulnerability	229.8	15.09.2021
Critical	CVE-2020-1350	Microsoft Windows DNS Server Remote Code Execution Vulnerability	229.8	14.07.2020
Critical	CVE-2019-7609	Kibana Arbitrary Code Execution	229.8	25.03.2019