Actively exploited vulnerabilities

    Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

    1,766 CVEs in the CISA KEV catalog · How we calculate priority

    Export (max. 1,000 rows):CSVJSON

    Entries in the CISA KEV catalog
    SeverityCVETitlePriority (0–325)Published (CVE)
    CriticalCVE-2017-11882Microsoft Office Memory Corruption Vulnerability244.0
    CriticalCVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability243.9
    CriticalCVE-2008-2992Adobe Reader and Acrobat Input Validation Vulnerability243.9
    CriticalCVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability243.9
    CriticalCVE-2018-20250WinRAR Absolute Path Traversal Vulnerability243.8
    CriticalCVE-2021-26857Microsoft Exchange Server Remote Code Execution Vulnerability243.8
    CriticalCVE-2026-45247Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection243.8
    CriticalCVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability243.7
    CriticalCVE-2026-25089Fortinet FortiSandbox OS Command Injection Vulnerability243.7
    CriticalCVE-2018-0802Microsoft Office Memory Corruption Vulnerability243.7
    CriticalCVE-2018-4878Adobe Flash Player Use-After-Free Vulnerability243.7
    CriticalCVE-2018-15982Adobe Flash Player Use-After-Free Vulnerability243.7
    CriticalCVE-2021-27101Accellion FTA SQL Injection Vulnerability243.7
    CriticalCVE-2010-0188Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability243.6
    CriticalCVE-2022-36537ZK Framework AuUploader Unspecified Vulnerability243.6
    CriticalCVE-2021-1675Windows Print Spooler Remote Code Execution Vulnerability243.5
    CriticalCVE-2019-1579Palo Alto Networks PAN-OS Remote Code Execution Vulnerability243.5
    CriticalCVE-2026-64849MLflow Server-Side Request Forgery Vulnerability243.4
    CriticalCVE-2021-40449Win32k Elevation of Privilege Vulnerability243.4
    CriticalCVE-2016-7255Microsoft Win32k Privilege Escalation Vulnerability243.4
    CriticalCVE-2013-0074Microsoft Silverlight Double Dereference Vulnerability243.4
    CriticalCVE-2026-63030WordPress Core Interpretation Conflict Vulnerability243.3
    CriticalCVE-2021-1732Windows Win32k Elevation of Privilege Vulnerability243.3
    CriticalCVE-2026-48172LiteSpeed cPanel Plugin Privilege Escalation Vulnerability243.3
    CriticalCVE-2025-60710Host Process for Windows Tasks Elevation of Privilege Vulnerability243.2
    CriticalCVE-2022-30333RARLAB UnRAR Directory Traversal Vulnerability243.2
    CriticalCVE-2023-24955Microsoft SharePoint Server Remote Code Execution Vulnerability243.2
    CriticalCVE-2019-1458Microsoft Win32k Privilege Escalation Vulnerability243.2
    CriticalCVE-2023-0669Fortra GoAnywhere MFT License Response Servlet Command Injection243.1
    CriticalCVE-2018-8453Microsoft Win32k Privilege Escalation Vulnerability243.0
    CriticalCVE-2022-27924Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability243.0
    CriticalCVE-2015-7645Adobe Flash Player Arbitrary Code Execution Vulnerability242.8
    CriticalCVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability242.8
    CriticalCVE-2026-1340Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability242.7
    CriticalCVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability242.7
    CriticalCVE-2025-68613n8n Vulnerable to Remote Code Execution via Expression Injection242.7
    CriticalCVE-2016-0151Microsoft Windows CSRSS Security Feature Bypass Vulnerability242.7
    CriticalCVE-2026-24061GNU InetUtils Argument Injection Vulnerability242.6
    CriticalCVE-2017-0101Microsoft Windows Transaction Manager Privilege Escalation Vulnerability242.5
    CriticalCVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability242.5
    CriticalCVE-2025-37164Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability242.5
    CriticalCVE-2019-2725Oracle WebLogic Server, Injection242.5
    CriticalCVE-2015-1701Microsoft Win32k Privilege Escalation Vulnerability242.5
    CriticalCVE-2019-7481SonicWall SMA100 SQL Injection Vulnerability242.5
    CriticalCVE-2022-37969Windows Common Log File System Driver Elevation of Privilege Vulnerability242.4
    CriticalCVE-2017-0147Microsoft Windows SMBv1 Information Disclosure Vulnerability242.4
    CriticalCVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability242.4
    CriticalCVE-2022-21999Windows Print Spooler Elevation of Privilege Vulnerability242.3
    CriticalCVE-2016-0189Microsoft Internet Explorer Memory Corruption Vulnerability242.3
    CriticalCVE-2024-4761Google Chromium V8 Out-of-Bounds Memory Write Vulnerability242.2