Actively exploited vulnerabilities

    Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

    1,766 CVEs in the CISA KEV catalog · How we calculate priority

    Export (max. 1,000 rows):CSVJSON

    Entries in the CISA KEV catalog
    SeverityCVETitlePriority (0–325)Published (CVE)
    CriticalCVE-2025-9242WatchGuard Firebox iked Out of Bounds Write Vulnerability239.6
    CriticalCVE-2025-47812Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability239.5
    CriticalCVE-2026-20963Microsoft SharePoint Remote Code Execution Vulnerability239.5
    CriticalCVE-2025-20281Cisco ISE API Unauthenticated Remote Code Execution Vulnerability239.4
    CriticalCVE-2026-21643Fortinet FortiClient EMS SQL Injection Vulnerability239.3
    CriticalCVE-2025-43300Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability239.2
    CriticalCVE-2015-2546Microsoft Win32k Memory Corruption Vulnerability239.2
    CriticalCVE-2025-34291Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE239.2
    CriticalCVE-2018-8120Microsoft Win32k Privilege Escalation Vulnerability239.1
    CriticalCVE-2015-2291Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability239.1
    CriticalCVE-2025-20337Cisco ISE API Unauthenticated Remote Code Execution Vulnerability239.0
    CriticalCVE-2022-26500Veeam Backup & Replication Remote Code Execution Vulnerability239.0
    CriticalCVE-2018-8581Microsoft Exchange Server Privilege Escalation Vulnerability239.0
    CriticalCVE-2022-21882Win32k Elevation of Privilege Vulnerability238.9
    CriticalCVE-2026-22769Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability238.7
    CriticalCVE-2025-64446Fortinet FortiWeb Path Traversal Vulnerability238.7
    CriticalCVE-2025-54068Livewire vulnerable to remote command execution during property update hydration238.7
    CriticalCVE-2025-32432Craft CMS Allows Remote Code Execution238.6
    CriticalCVE-2025-49113RoundCube Webmail Deserialization of Untrusted Data Vulnerability238.6
    CriticalCVE-2026-65660Microsoft SharePoint Server Remote Code Execution Vulnerability238.6
    CriticalCVE-2025-34028Commvault Command Center Path Traversal Vulnerability238.5
    CriticalCVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCE238.5
    CriticalCVE-2024-30051Windows DWM Core Library Elevation of Privilege Vulnerability238.3
    CriticalCVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability237.9
    CriticalCVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack237.9
    CriticalCVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability237.8
    CriticalCVE-2019-1253Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability237.8
    CriticalCVE-2026-42016Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation237.7
    CriticalCVE-2026-18577Incomplete patch leads to administrative account takeover237.6
    CriticalCVE-2017-1000253Linux Kernel PIE Stack Buffer Corruption Vulnerability237.4
    CriticalCVE-2024-50603Aviatrix Controllers OS Command Injection Vulnerability237.3
    CriticalCVE-2025-12480Gladinet Triofox Improper Access Control Vulnerability237.2
    CriticalCVE-2009-3960Adobe BlazeDS Information Disclosure Vulnerability237.2
    CriticalCVE-2020-3433Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability237.2
    CriticalCVE-2025-2747Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass237.1
    CriticalCVE-2025-24016Remote code execution in Wazuh server237.0
    CriticalCVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability237.0
    CriticalCVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwiki236.9
    CriticalCVE-2026-83549SonicWall SMA1000 Appliances OS Command Injection Vulnerability236.8
    CriticalCVE-2024-54085Redfish Authentication Bypass236.8
    CriticalCVE-2026-21510Windows Shell Security Feature Bypass Vulnerability236.7
    CriticalCVE-2026-1603Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability236.7
    CriticalCVE-2025-2746Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass236.4
    CriticalCVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability236.4
    CriticalCVE-2024-45519Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability236.3
    CriticalCVE-2019-1388Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability236.3
    CriticalCVE-2021-20022SonicWall Email Security Unrestricted Upload of File Vulnerability236.3
    CriticalCVE-2025-1316Edimax IC-7100 IP Camera OS Command Injection236.2
    CriticalCVE-2024-13160Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability236.2
    CriticalCVE-2024-13161Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability236.1