Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,762 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2018-13382	Fortinet FortiOS and FortiProxy Improper Authorization	249.9	04.06.2019
Critical	CVE-2024-21412	Internet Shortcut Files Security Feature Bypass Vulnerability	249.9	13.02.2024
Critical	CVE-2024-57727	SimpleHelp Path Traversal Vulnerability	249.8	15.01.2025
Critical	CVE-2023-21529	Microsoft Exchange Server Remote Code Execution Vulnerability	249.8	14.02.2023
Critical	CVE-2021-35211	Serv-U Remote Memory Escape Vulnerability	249.7	14.07.2021
Critical	CVE-2022-2294	WebRTC Heap Buffer Overflow Vulnerability	249.2	28.07.2022
Critical	CVE-2026-82329	Potential authentication bypass leading to administrative access in Artifactory	249.1	28.08.2026
Critical	CVE-2020-0688	Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability	249.0	11.02.2020
Critical	CVE-2012-0158	Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability	249.0	10.04.2012
Critical	CVE-2021-34527	Windows Print Spooler Remote Code Execution Vulnerability	248.9	02.07.2021
Critical	CVE-2017-0144	Microsoft SMBv1 Remote Code Execution Vulnerability	248.9	17.03.2017
Critical	CVE-2020-0618	Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability	248.9	11.02.2020
Critical	CVE-2026-48908	JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability	248.9	20.06.2026
Critical	CVE-2023-41266	Qlik Sense Path Traversal Vulnerability	248.9	29.08.2023
Critical	CVE-2021-40444	Microsoft MSHTML Remote Code Execution Vulnerability	248.9	15.09.2021
Critical	CVE-2026-5430	Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover	248.8	06.08.2026
Critical	CVE-2017-9822	DotNetNuke (DNN) Remote Code Execution Vulnerability	248.8	20.07.2017
Critical	CVE-2017-0143	Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability	248.7	17.03.2017
Critical	CVE-2021-42321	Microsoft Exchange Server Remote Code Execution Vulnerability	248.7	10.11.2021
Critical	CVE-2026-48907	Widget Factory Joomla Content Editor Improper Access Control Vulnerability	248.7	05.06.2026
Critical	CVE-2017-0146	Microsoft Windows SMB Remote Code Execution Vulnerability	248.7	17.03.2017
Critical	CVE-2017-0145	Microsoft SMBv1 Remote Code Execution Vulnerability	248.7	17.03.2017
Critical	CVE-2019-7193	QNAP QTS Improper Input Validation Vulnerability	248.7	05.12.2019
Critical	CVE-2026-10520	Ivanti Sentry OS Command Injection Vulnerability	248.6	09.06.2026
Critical	CVE-2021-26411	Internet Explorer Memory Corruption Vulnerability	248.4	11.03.2021
Critical	CVE-2019-11043	Underflow in PHP-FPM can lead to RCE	248.4	28.10.2019
Critical	CVE-2025-29824	Windows Common Log File System Driver Elevation of Privilege Vulnerability	248.3	08.04.2025
Critical	CVE-2013-2551	Microsoft Internet Explorer Use-After-Free Vulnerability	248.2	11.03.2013
Critical	CVE-2026-71362	Adobe Commerce \| Incorrect Authorization (CWE-863)	248.2	11.08.2026
Critical	CVE-2026-48558	SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification	248.1	12.06.2026
Critical	CVE-2016-0034	Microsoft Silverlight Runtime Remote Code Execution Vulnerability	248.0	13.01.2016
Critical	CVE-2023-27351	PaperCut NG/MF Improper Authentication Vulnerability	247.9	20.04.2023
Critical	CVE-2014-1812	Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability	247.8	14.05.2014
Critical	CVE-2026-48282	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)	247.8	30.06.2026
Critical	CVE-2021-27103	Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability	247.7	16.02.2021
Critical	CVE-2024-9474	PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface	247.6	18.11.2024
Critical	CVE-2026-20253	Splunk Enterprise Missing Authentication for Critical Function Vulnerability	247.5	10.06.2026
Critical	CVE-2026-34910	Ubiquiti UniFi OS Improper Input Validation Vulnerability	247.4	22.05.2026
Critical	CVE-2026-34908	Ubiquiti UniFi OS Improper Access Control Vulnerability	247.4	22.05.2026
Critical	CVE-2024-57728	SimpleHelp Path Traversal Vulnerability	247.3	15.01.2025
Critical	CVE-2023-38831	RARLAB WinRAR Code Execution Vulnerability	247.2	23.08.2023
Critical	CVE-2026-88779	Memory overflow vulnerability leading to Denial of Service	247.2	04.10.2026
Critical	CVE-2025-49706	Microsoft SharePoint Server Spoofing Vulnerability	247.2	08.07.2025
Critical	CVE-2026-20182	Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability	247.1	14.05.2026
Critical	CVE-2026-83548	SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability	247.1	01.09.2026
Critical	CVE-2024-21338	Windows Kernel Elevation of Privilege Vulnerability	247.1	13.02.2024
Critical	CVE-2026-2441	Google Chromium CSS Use-After-Free Vulnerability	247.0	13.02.2026
Critical	CVE-2026-96951	Windows Shell Security Feature Bypass Vulnerability	247.0	13.10.2026
Critical	CVE-2026-56290	Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0	247.0	29.06.2026
Critical	CVE-2026-9198	Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation	247.0	17.07.2026