Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,769 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2025-0994	Trimble Cityworks Deserialization Vulnerability	228.9	06.02.2025
Critical	CVE-2021-36260	Hikvision Improper Input Validation	228.9	22.09.2021
Critical	CVE-2021-37415	Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability	228.9	01.09.2021
Critical	CVE-2021-35394	Realtek Jungle SDK Remote Code Execution Vulnerability	228.9	16.08.2021
Critical	CVE-2021-31166	HTTP Protocol Stack Remote Code Execution Vulnerability	228.9	11.05.2021
Critical	CVE-2020-13927	Apache Airflow's Experimental API Authentication Bypass	228.9	10.11.2020
Critical	CVE-2017-7269	Microsoft Windows Server Buffer Overflow Vulnerability	228.9	27.03.2017
Critical	CVE-2015-3113	Adobe Flash Player Heap-Based Buffer Overflow Vulnerability	228.9	23.06.2015
Critical	CVE-2021-33045	Dahua IP Camera Authentication Bypass Vulnerability	228.9	15.09.2021
Critical	CVE-2020-16846	SaltStack Salt Shell Injection Vulnerability	228.9	06.11.2020
Critical	CVE-2020-15505	Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability	228.9	07.07.2020
Critical	CVE-2019-16759	vBulletin PHP Module Remote Code Execution Vulnerability	228.9	24.09.2019
Critical	CVE-2017-1000353	Jenkins Remote Code Execution Vulnerability	228.9	29.01.2018
Critical	CVE-2016-10033	PHPMailer Command Injection Vulnerability	228.9	30.12.2016
Critical	CVE-2021-32030	ASUS Routers Improper Authentication Vulnerability	228.9	06.05.2021
Critical	CVE-2020-14750	Oracle WebLogic Server Remote Code Execution Vulnerability	228.9	01.11.2020
Critical	CVE-2020-1938	Apache Tomcat Improper Privilege Management Vulnerability	228.9	24.02.2020
Critical	CVE-2018-20062	ThinkPHP "noneCms" Remote Code Execution Vulnerability	228.9	11.12.2018
Critical	CVE-2018-0171	Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability	228.9	28.03.2018
Critical	CVE-2014-6287	Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability	228.9	07.10.2014
Critical	CVE-2020-7247	OpenSMTPD Remote Code Execution Vulnerability	228.9	29.01.2020
Critical	CVE-2020-0646	Microsoft .NET Framework Remote Code Execution Vulnerability	228.9	14.01.2020
Critical	CVE-2019-16278	Nostromo nhttpd Directory Traversal Vulnerability	228.9	14.10.2019
Critical	CVE-2019-3929	Crestron Multiple Products Command Injection Vulnerability	228.9	30.04.2019
Critical	CVE-2017-9791	Apache Struts 1 Improper Input Validation Vulnerability	228.9	10.07.2017
Critical	CVE-2017-3881	Cisco IOS and IOS XE Remote Code Execution Vulnerability	228.9	17.03.2017
Critical	CVE-2018-1000861	Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability	228.9	10.12.2018
Critical	CVE-2017-15944	Palo Alto Networks PAN-OS Remote Code Execution Vulnerability	228.9	11.12.2017
Critical	CVE-2016-1555	NETGEAR Multiple WAP Devices Command Injection Vulnerability	228.9	21.04.2017
Critical	CVE-2016-3088	Apache ActiveMQ Improper Input Validation Vulnerability	228.9	01.06.2016
Critical	CVE-2015-5119	Adobe Flash Player Use-After-Free Vulnerability	228.9	08.07.2015
Critical	CVE-2008-4250	Microsoft Windows Buffer Overflow Vulnerability	228.9	23.10.2008
Critical	CVE-2021-35395	Realtek AP-Router SDK Buffer Overflow Vulnerability	228.9	16.08.2021
Critical	CVE-2021-36380	Sunhillo SureLine OS Command Injection Vulnerablity	228.9	13.08.2021
Critical	CVE-2018-18809	TIBCO JasperReports Library Directory Traversal Vulnerability	228.9	07.03.2019
Critical	CVE-2018-19410	Paessler PRTG Network Monitor Local File Inclusion Vulnerability	228.9	21.11.2018
Critical	CVE-2015-7450	IBM WebSphere Application Server and Server Hypervisor Edition: Code Injection	228.8	02.01.2016
Critical	CVE-2007-3010	Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability	228.8	18.09.2007
Critical	CVE-2021-22502	Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability	228.8	08.02.2021
Critical	CVE-2020-25223	Sophos SG UTM Remote Code Execution Vulnerability	228.8	25.09.2020
Critical	CVE-2020-2555	Oracle Multiple Products Remote Code Execution Vulnerability	228.8	15.01.2020
Critical	CVE-2019-7256	Nice Linear eMerge E3-Series OS Command Injection Vulnerability	228.8	02.07.2019
Critical	CVE-2022-26318	WatchGuard Firebox and XTM Appliances Arbitrary Code Execution	228.8	04.03.2022
Critical	CVE-2020-17530	Apache Struts Remote Code Execution Vulnerability	228.8	11.12.2020
Critical	CVE-2020-11651	SaltStack Salt Authentication Bypass Vulnerability	228.8	30.04.2020
Critical	CVE-2011-3544	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	228.8	19.10.2011
Critical	CVE-2010-0840	Oracle JRE Unspecified Vulnerability	228.8	01.04.2010
Critical	CVE-2009-1151	phpMyAdmin Remote Code Execution Vulnerability	228.8	26.03.2009
Critical	CVE-2020-5847	Unraid Remote Code Execution Vulnerability	228.8	16.03.2020
Critical	CVE-2015-0313	Adobe Flash Player Use-After-Free Vulnerability	228.8	02.02.2015