Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,766 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2018-8174	Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability	242.1	09.05.2018
Critical	CVE-2026-20230	Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability	242.1	03.06.2026
Critical	CVE-2019-0803	Microsoft Win32k Privilege Escalation Vulnerability	242.1	09.04.2019
Critical	CVE-2026-48027	Compromised Nx Console version 18.95.0	242.0	27.05.2026
Critical	CVE-2020-0787	Microsoft Windows: Privilege Escalation	241.9	12.03.2020
Critical	CVE-2019-0752	Microsoft Internet Explorer Type Confusion Vulnerability	241.9	09.04.2019
Critical	CVE-2019-0841	Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability	241.9	09.04.2019
Critical	CVE-2021-21975	VMware Server Side Request Forgery in vRealize Operations Manager API	241.8	31.03.2021
Critical	CVE-2021-42287	Active Directory Domain Services Elevation of Privilege Vulnerability	241.8	10.11.2021
Critical	CVE-2021-42278	Active Directory Domain Services Elevation of Privilege Vulnerability	241.6	10.11.2021
Critical	CVE-2016-0099	Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability	241.6	09.03.2016
Critical	CVE-2022-27925	Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability	241.6	20.04.2022
Critical	CVE-2020-2021	PAN-OS: Authentication Bypass in SAML Authentication	241.6	29.06.2020
Critical	CVE-2020-3259	Cisco ASA and FTD Information Disclosure Vulnerability	241.6	06.05.2020
Critical	CVE-2026-0770	Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability	241.4	23.01.2026
Critical	CVE-2026-75650	Adobe Commerce \| Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)	241.4	07.09.2026
Critical	CVE-2024-37085	VMware ESXi Authentication Bypass Vulnerability	241.4	25.06.2024
Critical	CVE-2020-29574	CyberoamOS (CROS) SQL Injection Vulnerability	241.4	11.12.2020
Critical	CVE-2018-19943	QNAP NAS File Station Cross-Site Scripting Vulnerability	241.4	28.10.2020
Critical	CVE-2021-36942	Windows LSA Spoofing Vulnerability	241.3	12.08.2021
Critical	CVE-2019-1405	Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability	241.2	12.11.2019
Critical	CVE-2026-35616	Fortinet FortiClient EMS Improper Access Control Vulnerability	241.1	04.04.2026
Critical	CVE-2026-46817	Oracle E-Business Suite Improper Privilege Management Vulnerability	241.1	28.05.2026
Critical	CVE-2026-33634	Trivy ecosystem supply chain briefly compromised	241.1	23.03.2026
Critical	CVE-2017-0213	Microsoft Windows Privilege Escalation Vulnerability	241.0	12.05.2017
Critical	CVE-2010-1428	Red Hat JBoss Information Disclosure Vulnerability	240.9	28.04.2010
Critical	CVE-2026-42271	LiteLLM: Authenticated command execution via MCP stdio test endpoints	240.9	08.05.2026
Critical	CVE-2019-1367	Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	240.8	23.09.2019
Critical	CVE-2025-11953	React Native Community CLI OS Command Injection Vulnerability	240.6	03.11.2025
Critical	CVE-2025-59287	Windows Server Update Service (WSUS) Remote Code Execution Vulnerability	240.4	14.10.2025
Critical	CVE-2022-26501	Veeam Backup & Replication Remote Code Execution Vulnerability	240.4	17.03.2022
Critical	CVE-2026-24858	Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability	240.4	27.01.2026
Critical	CVE-2025-57819	FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE	240.4	28.08.2025
Critical	CVE-2018-8639	Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability	240.3	12.12.2018
Critical	CVE-2025-61757	Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability	240.2	21.10.2025
Critical	CVE-2025-6554	Google Chromium V8 Type Confusion Vulnerability	240.2	30.06.2025
Critical	CVE-2025-20393	Cisco Multiple Products Improper Input Validation Vulnerability	240.2	17.12.2025
Critical	CVE-2025-14611	Gladinet CentreStack and TrioFox Hard Coded AES Keys	240.1	12.12.2025
Critical	CVE-2016-3309	Microsoft Windows Kernel Privilege Escalation Vulnerability	240.1	09.08.2016
Critical	CVE-2025-67038	Lantronix EDS5000, G520, and X300 OS Command Injection	240.0	11.03.2026
Critical	CVE-2021-27876	Veritas Backup Exec Agent File Access Vulnerability	239.9	01.03.2021
Critical	CVE-2025-54253	Adobe Experience Manager \| Incorrect Authorization (CWE-863)	239.9	05.08.2025
Critical	CVE-2026-34197	Apache ActiveMQ Improper Input Validation Vulnerability	239.8	07.04.2026
Critical	CVE-2019-1215	Microsoft Windows Privilege Escalation Vulnerability	239.8	11.09.2019
Critical	CVE-2020-0968	Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	239.7	15.04.2020
Critical	CVE-2019-1322	Microsoft Windows Privilege Escalation Vulnerability	239.7	10.10.2019
Critical	CVE-2023-23376	Windows Common Log File System Driver Elevation of Privilege Vulnerability	239.7	14.02.2023
Critical	CVE-2025-9242	WatchGuard Firebox iked Out of Bounds Write Vulnerability	239.7	17.09.2025
Critical	CVE-2018-8440	Microsoft Windows Privilege Escalation Vulnerability	239.7	13.09.2018
Critical	CVE-2019-13608	Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability	239.7	29.08.2019