Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,760 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2019-7192	QNAP Photo Station Improper Access Control Vulnerability	253.6	05.12.2019
Critical	CVE-2017-18362	Kaseya VSA SQL Injection Vulnerability	253.6	05.02.2019
Critical	CVE-2019-16057	D-Link DNS-320 Remote Code Execution Vulnerability	253.6	16.09.2019
Critical	CVE-2026-76461	Cisco Secure Email Gateway SQL Injection Vulnerability	253.5	14.09.2026
Critical	CVE-2020-3992	VMware ESXi OpenSLP Use-After-Free Vulnerability	253.5	20.10.2020
Critical	CVE-2019-7194	QNAP Photo Station Path Traversal Vulnerability	253.5	05.12.2019
Critical	CVE-2018-6789	Exim Buffer Overflow Vulnerability	253.4	08.02.2018
Critical	CVE-2023-27997	Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability	253.4	13.06.2023
Critical	CVE-2026-81578	PaperCut MF/NG: Authentication Bypass	253.4	28.08.2026
Critical	CVE-2022-42475	Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability	253.4	02.01.2023
Critical	CVE-2017-11357	Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability	253.3	23.08.2017
Critical	CVE-2024-24919	Information disclosure	253.3	28.05.2024
Critical	CVE-2022-31199	Netwrix Auditor Insecure Object Deserialization Vulnerability	253.2	08.11.2022
Critical	CVE-2022-29499	Mitel MiVoice Connect Data Validation Vulnerability	253.2	26.04.2022
Critical	CVE-2021-42258	BQE BillQuick Web Suite SQL Injection Vulnerability	253.2	22.10.2021
Critical	CVE-2021-22893	Ivanti Pulse Connect Secure Use-After-Free Vulnerability	253.1	23.04.2021
Critical	CVE-2020-12271	Sophos SFOS SQL Injection Vulnerability	252.9	27.04.2020
Critical	CVE-2026-72898	Metabase SQL injection via password reset endpoint	252.9	10.08.2026
Critical	CVE-2026-45321	Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys	252.8	12.05.2026
Critical	CVE-2026-110447	Collabora Online – Built-in CODE Server OS Command Injection Vulnerability	252.8	14.10.2026
Critical	CVE-2026-104935	Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability	252.6	13.10.2026
Critical	CVE-2021-27104	Accellion FTA OS Command Injection Vulnerability	252.5	16.02.2021
Critical	CVE-2021-22941	Citrix ShareFile Improper Access Control Vulnerability	252.4	23.09.2021
Critical	CVE-2020-12812	Fortinet FortiOS SSL VPN Improper Authentication Vulnerability	252.1	24.07.2020
Critical	CVE-2021-20016	SonicWall SSLVPN SMA100 SQL Injection Vulnerability	251.8	03.02.2021
Critical	CVE-2024-1708	Improper limitation of a pathname to a restricted directory (“path traversal”)	251.3	21.02.2024
Critical	CVE-2018-19949	QNAP NAS File Station Command Injection Vulnerability	251.2	28.10.2020
Critical	CVE-2021-20028	SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability	251.2	04.08.2021
Critical	CVE-2018-20753	Kaseya VSA Remote Code Execution Vulnerability	251.1	05.02.2019
Critical	CVE-2026-20316	Cisco Secure Firewall Management Center Software Static Credential Vulnerability	251.0	29.07.2026
Critical	CVE-2026-86218	pre-authentication remote code execution	250.9	06.09.2026
Critical	CVE-2026-33825	Microsoft Defender Elevation of Privilege Vulnerability	250.9	14.04.2026
Critical	CVE-2020-5135	SonicWall SonicOS Buffer Overflow Vulnerability	250.9	12.10.2020
Critical	CVE-2026-86950	Apple Multiple Products Out-of-Bounds Write Vulnerability	250.8	28.09.2026
Critical	CVE-2026-82078	PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector	250.6	28.08.2026
Critical	CVE-2021-34473	Microsoft Exchange Server Remote Code Execution Vulnerability	250.5	14.07.2021
Critical	CVE-2021-26855	Microsoft Exchange Server Remote Code Execution Vulnerability	250.5	02.03.2021
Critical	CVE-2018-13379	Fortinet FortiOS SSL VPN Path Traversal Vulnerability	250.5	04.06.2019
Critical	CVE-2022-41040	Microsoft Exchange Server Elevation of Privilege Vulnerability	250.5	03.10.2022
Critical	CVE-2024-49039	Windows Task Scheduler Elevation of Privilege Vulnerability	250.4	12.11.2024
Critical	CVE-2024-21893	Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability	250.4	31.01.2024
Critical	CVE-2016-1019	Adobe Flash Player Arbitrary Code Execution Vulnerability	250.3	07.04.2016
Critical	CVE-2026-87902	WordPress Core Remote File Inclusion Vulnerability	250.3	22.09.2026
Critical	CVE-2026-60004	Gitea: Remote Code Execution via diffpatch Git Hook Installation	250.3	26.08.2026
Critical	CVE-2026-19490	NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490	250.3	19.08.2026
Critical	CVE-2023-46805	Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability	250.2	12.01.2024
Critical	CVE-2021-45046	Apache Log4j2 Deserialization of Untrusted Data Vulnerability	250.2	14.12.2021
Critical	CVE-2021-40438	mod_proxy SSRF	250.0	16.09.2021
Critical	CVE-2021-34523	Microsoft Exchange Server Elevation of Privilege Vulnerability	250.0	14.07.2021
Critical	CVE-2022-41080	Microsoft Exchange Server Elevation of Privilege Vulnerability	250.0	09.11.2022