Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,768 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2020-6287	SAP NetWeaver Missing Authentication for Critical Function Vulnerability	229.8	14.07.2020
Critical	CVE-2022-30525	Zyxel Multiple Firewalls OS Command Injection Vulnerability	229.7	12.05.2022
Critical	CVE-2022-29303	SolarView Compact Command Injection Vulnerability	229.7	12.05.2022
Critical	CVE-2026-68820	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	229.6	11.08.2026
Critical	CVE-2019-4716	IBM Planning Analytics Remote Code Execution Vulnerability	229.6	18.12.2019
Critical	CVE-2024-7399	Samsung MagicINFO 9 Server Path Traversal Vulnerability	229.6	09.08.2024
Critical	CVE-2022-22963	VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability	229.6	01.04.2022
Critical	CVE-2022-22965	Spring Framework JDK 9+ Remote Code Execution Vulnerability	229.5	01.04.2022
Critical	CVE-2022-1040	Sophos Firewall Authentication Bypass Vulnerability	229.5	25.03.2022
Critical	CVE-2022-20699	Cisco Small Business RV Series Routers Vulnerabilities	229.5	10.02.2022
Critical	CVE-2022-24706	Remote Code Execution Vulnerability in Packaging	229.4	26.04.2022
Critical	CVE-2020-14871	Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability	229.4	21.10.2020
Critical	CVE-2016-20017	D-Link DSL-2750B Devices Command Injection Vulnerability	229.4	19.10.2022
Critical	CVE-2025-6204	Dassault Systèmes DELMIA Apriso Code Injection Vulnerability	229.4	04.08.2025
Critical	CVE-2019-1003030	Jenkins Matrix Project Plugin Remote Code Execution Vulnerability	229.3	08.03.2019
Critical	CVE-2023-2868	Remote Code injection in Barracuda Email Security Gateway	229.3	24.05.2023
Critical	CVE-2022-24086	Adobe Commerce checkout improper input validation leads to remote code execution	229.3	16.02.2022
Critical	CVE-2022-26258	D-Link DIR-820L Remote Code Execution Vulnerability	229.3	27.03.2022
Critical	CVE-2021-45382	D-Link Multiple Routers Remote Code Execution Vulnerability	229.3	17.02.2022
Critical	CVE-2022-24112	apisix/batch-requests plugin allows overwriting the X-REAL-IP header	229.2	11.02.2022
Critical	CVE-2026-48710	Kludex Starlette HTTP Request/Response Smuggling Vulnerability	229.1	26.05.2026
Critical	CVE-2022-26143	MiCollab, MiVoice Business Express Access Control Vulnerability	229.1	09.03.2022
Critical	CVE-2021-35587	Oracle Fusion Middleware Unspecified Vulnerability	229.1	19.01.2022
Critical	CVE-2021-44515	Zoho Desktop Central Authentication Bypass Vulnerability	229.1	12.12.2021
Critical	CVE-2019-10758	MongoDB mongo-express Remote Code Execution Vulnerability	229.0	24.12.2019
Critical	CVE-2015-1635	Microsoft HTTP.sys Remote Code Execution Vulnerability	229.0	14.04.2015
Critical	CVE-2021-1498	Cisco HyperFlex HX Command Injection Vulnerabilities	229.0	06.05.2021
Critical	CVE-2020-14882	Oracle WebLogic Server Remote Code Execution Vulnerability	229.0	21.10.2020
Critical	CVE-2020-8515	Multiple DrayTek Vigor Routers Web Management Page Vulnerability	229.0	01.02.2020
Critical	CVE-2019-16920	D-Link Multiple Routers Command Injection Vulnerability	229.0	27.09.2019
Critical	CVE-2017-9841	PHPUnit Command Injection Vulnerability	229.0	27.06.2017
Critical	CVE-2017-7921	Hikvision Multiple Products Improper Authentication Vulnerability	229.0	06.05.2017
Critical	CVE-2014-6271	GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	229.0	24.09.2014
Critical	CVE-2013-2251	Apache Struts Improper Input Validation Vulnerability	229.0	18.07.2013
Critical	CVE-2012-1823	PHP-CGI Query String Parameter Vulnerability	229.0	11.05.2012
Critical	CVE-2021-33044	Dahua IP Camera Authentication Bypass Vulnerability	229.0	15.09.2021
Critical	CVE-2021-20090	Arcadyan Buffalo Firmware Path Traversal Vulnerability	229.0	29.04.2021
Critical	CVE-2020-25506	D-Link DNS-320 Device Command Injection Vulnerability	229.0	02.02.2021
Critical	CVE-2020-9054	Zyxel Multiple NAS Devices OS Command Injection Vulnerability	229.0	04.03.2020
Critical	CVE-2019-9670	Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference	229.0	29.05.2019
Critical	CVE-2018-2628	Oracle WebLogic Server Unspecified Vulnerability	229.0	19.04.2018
Critical	CVE-2014-8361	Realtek SDK Improper Input Validation Vulnerability	229.0	01.05.2015
Critical	CVE-2025-0994	Trimble Cityworks Deserialization Vulnerability	229.0	06.02.2025
Critical	CVE-2021-39226	Snapshot authentication bypass in grafana	229.0	05.10.2021
Critical	CVE-2021-1497	Cisco HyperFlex HX Command Injection Vulnerabilities	229.0	06.05.2021
Critical	CVE-2020-7961	Liferay Portal Deserialization of Untrusted Data Vulnerability	229.0	20.03.2020
Critical	CVE-2020-10189	Zoho ManageEngine Desktop Central File Upload Vulnerability	229.0	06.03.2020
Critical	CVE-2018-15961	Adobe ColdFusion Unrestricted File Upload Vulnerability	229.0	25.09.2018
Critical	CVE-2015-1427	Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability	229.0	17.02.2015
Critical	CVE-2014-7169	GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	229.0	25.09.2014