Actively exploited vulnerabilities

    Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

    1,767 CVEs in the CISA KEV catalog · How we calculate priority

    Export (max. 1,000 rows):CSVJSON

    Entries in the CISA KEV catalog
    SeverityCVETitlePriority (0–325)Published (CVE)
    CriticalCVE-2025-8110File overwrite in file update API in Gogs236.1
    CriticalCVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20)236.0
    CriticalCVE-2024-56145RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms236.0
    CriticalCVE-2021-38646Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability235.8
    CriticalCVE-2024-9463Palo Alto Networks Expedition OS Command Injection Vulnerability235.8
    CriticalCVE-2025-48703CWP Control Web Panel OS Command Injection Vulnerability235.8
    CriticalCVE-2022-24521Windows Common Log File System Driver Elevation of Privilege Vulnerability235.8
    CriticalCVE-2024-12356Command Injection Vulnerability in Remote Support (RS) & Privileged Remote Access (PRA)235.8
    CriticalCVE-2025-14847Zlib compressed protocol header length confusion may allow memory read235.7
    CriticalCVE-2024-11680ProjectSend Unauthenticated Configuration Modification235.6
    CriticalCVE-2025-7775Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service235.6
    CriticalCVE-2024-47575Fortinet FortiManager Missing Authentication Vulnerability235.4
    CriticalCVE-2026-31431Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability235.2
    CriticalCVE-2018-2380SAP Customer Relationship Management (CRM) Path Traversal Vulnerability235.1
    CriticalCVE-2025-14174Google Chromium Out of Bounds Memory Access Vulnerability235.1
    CriticalCVE-2020-3580Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability235.1
    CriticalCVE-2025-68645Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability235.0
    CriticalCVE-2024-20439Cisco Smart Licensing Utility Static Credential Vulnerability234.9
    CriticalCVE-2024-7593Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability234.9
    CriticalCVE-2024-43468Microsoft Configuration Manager Remote Code Execution Vulnerability234.8
    CriticalCVE-2019-1064Windows Elevation of Privilege Vulnerability234.8
    CriticalCVE-2025-6205Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025234.8
    CriticalCVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code234.7
    CriticalCVE-2025-54309CrushFTP Unprotected Alternate Channel Vulnerability234.6
    CriticalCVE-2024-4879Jelly Template Injection Vulnerability in ServiceNow UI Macros234.6
    CriticalCVE-2025-32463Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability234.6
    CriticalCVE-2024-5217Incomplete Input Validation in GlideExpression Script234.5
    CriticalCVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability234.5
    CriticalCVE-2025-4632Samsung MagicINFO 9 Server Path Traversal Vulnerability234.5
    CriticalCVE-2024-57968Advantive VeraCore Unrestricted File Upload Vulnerability234.5
    CriticalCVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver234.5
    CriticalCVE-2025-34026Versa Concerto Actuator Authentication Bypass Information Leak234.5
    CriticalCVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability234.4
    CriticalCVE-2026-18556Unauthenticated administrative account takeover234.4
    CriticalCVE-2024-4885WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability234.4
    CriticalCVE-2024-34102XXE can expose crypt key and other secrets granting full admin access234.4
    CriticalCVE-2021-43890Windows AppX Installer Spoofing Vulnerability234.4
    CriticalCVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command Injection234.4
    CriticalCVE-2016-3351Microsoft Internet Explorer and Edge Information Disclosure Vulnerability234.4
    CriticalCVE-2024-5910Expedition: Missing Authentication Leads to Admin Account Takeover234.3
    CriticalCVE-2025-53690Sitecore Products ViewState Deserialization Vulnerability234.3
    CriticalCVE-2024-26169Windows Error Reporting Service Elevation of Privilege Vulnerability234.3
    CriticalCVE-2024-1212LoadMaster Pre-Authenticated OS Command Injection234.3
    CriticalCVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability234.2
    CriticalCVE-2022-41223Mitel MiVoice Connect Code Injection Vulnerability234.1
    CriticalCVE-2025-2776SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection234.1
    CriticalCVE-2022-40765Mitel MiVoice Connect Command Injection Vulnerability234.1
    CriticalCVE-2024-4358Registration Authentication Bypass Vulnerability234.1
    CriticalCVE-2026-5281Google Dawn Use-After-Free Vulnerability234.1
    CriticalCVE-2024-32113Apache OFBiz: Path traversal leading to RCE234.0