/// CISA KEV · UPDATED DAILY

Actively exploited vulnerabilities

15 new exploited flaws this week

1710in the catalog

45in the last 30 days

360used in ransomware

The CISA KEV catalog lists vulnerabilities that are being exploited in real attacks, not ones that might be. It is the list to start from when deciding what to patch first.

This week

CVE-2026-76461Critical9.8
Cisco · Secure Email Gateway
Cisco Secure Email Gateway SQL Injection Vulnerability
Added Sep 14, 2026Fix by Sep 17, 2026
CVE-2026-85706Critical10.0
GitLab · Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Added Sep 11, 2026Fix by Sep 14, 2026
CVE-2026-84869Critical9.9
ConnectWise · ScreenConnect
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
Added Sep 11, 2026Fix by Sep 14, 2026
CVE-2026-42018High7.5
JFrog · Artifactory
JFrog Artifactory Improper Authentication Vulnerability
Added Sep 11, 2026Fix by Sep 25, 2026
CVE-2026-42016High8.1
JFrog · Artifactory
JFrog Artifactory Incorrect Authorization Vulnerability
Added Sep 11, 2026Fix by Sep 25, 2026
CVE-2026-86060Critical9.8
MikroTik · RouterOS
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
Added Sep 10, 2026Fix by Sep 13, 2026
CVE-2026-67277High8.2
MikroTik · RouterOS
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
Added Sep 10, 2026Fix by Sep 13, 2026
CVE-2026-87491High8.8
Google · Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability
Added Sep 9, 2026Fix by Sep 23, 2026
CVE-2026-20079Critical10.0
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added Sep 9, 2026Fix by Sep 12, 2026
CVE-2026-19490Critical9.8
Citrix · NetScaler
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added Sep 9, 2026Fix by Sep 12, 2026
CVE-2025-25249High8.1
Fortinet · Multiple Products
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Added Sep 9, 2026Fix by Sep 12, 2026
CVE-2026-86218Critical9.8
N-able · N-central
N-able N-central Static Code Injection Vulnerability
Added Sep 8, 2026Fix by Sep 11, 2026
CVE-2026-85880High7.8
Microsoft · Windows
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Added Sep 8, 2026Fix by Sep 22, 2026
CVE-2026-81963High7.8
Microsoft · Windows
Microsoft Windows Link Following Vulnerability
Added Sep 8, 2026Fix by Sep 22, 2026
CVE-2026-75650Critical10.0
Adobe · Commerce and Magento
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Added Sep 8, 2026Fix by Sep 11, 2026

Added earlier

CVE-2026-85046High8.8
Google · Chromium V8
Google Chromium V8 Type Confusion Vulnerability
Added Sep 4, 2026Fix by Sep 18, 2026
CVE-2026-9586Critical9.8
Sangoma · Switchvox
Sangoma Switchvox SQL Injection Vulnerability
Added Sep 2, 2026Fix by Sep 5, 2026
CVE-2026-83549High7.8
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances OS Command Injection Vulnerability
Added Sep 2, 2026Fix by Sep 5, 2026
CVE-2026-83548Critical10.0
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Added Sep 2, 2026Fix by Sep 5, 2026
CVE-2026-82329Critical9.8
JFrog · Artifactory
JFrog Artifactory Improper Authentication Vulnerability
Added Sep 2, 2026Fix by Sep 5, 2026
CVE-2026-59822High8.2
BerriAI · LiteLLM
BerriAI LiteLLM Improper Authentication Vulnerability
56 days after exploitation was first evidenced
Added Sep 2, 2026Fix by Sep 16, 2026
CVE-2026-49869Critical10.0
Kestra · Kestra OSS
Kestra OSS OS Command Injection Vulnerability
7 days after exploitation was first evidenced
Added Sep 2, 2026Fix by Sep 5, 2026
CVE-2026-48710Medium6.5
Kludex · Starlette
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
99 days after exploitation was first evidenced
Added Sep 2, 2026Fix by Sep 16, 2026
CVE-2026-82078Critical9.1
PaperCut · NG/MF
PaperCut NG/MF Unsafe Reflection Vulnerability
Added Aug 31, 2026Fix by Sep 14, 2026
CVE-2026-81578Critical9.8
PaperCut · NG/MF
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
Added Aug 31, 2026Fix by Sep 14, 2026
CVE-2026-66384Medium5.3
JFrog · Artifactory
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
Added Aug 27, 2026Fix by Sep 10, 2026
CVE-2026-53362High7.8
Linux · Kernel
Linux Kernel Unspecified Vulnerability
Added Aug 27, 2026Fix by Aug 30, 2026
CVE-2023-49105Critical9.8
ownCloud · ownCloud
ownCloud Improper Authentication Vulnerability
Added Aug 27, 2026Fix by Aug 30, 2026
CVE-2026-8452Critical9.8
Citrix · NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
9 days after exploitation was first evidenced
Added Aug 26, 2026Fix by Aug 29, 2026
CVE-2022-0995High7.8
Linux · Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
Added Aug 26, 2026Fix by Sep 9, 2026
CVE-2021-23758High8.1
Ajax.NET Professional · Ajax.NET Professional
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Added Aug 26, 2026Fix by Sep 9, 2026
CVE-2019-1068High8.8
Microsoft · SQL Server
Microsoft SQL Server Remote Code Execution Vulnerability
721 days after exploitation was first evidenced
Added Aug 26, 2026Fix by Aug 29, 2026
CVE-2015-5287High7.8
Red Hat · Automatic Bug Reporting Tool
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Added Aug 26, 2026Fix by Sep 9, 2026
CVE-2015-3246Medium5.1
Red Hat · Libuser
Red Hat Libuser Race Condition Vulnerability
Added Aug 26, 2026Fix by Sep 9, 2026
CVE-2026-60004Critical9.8
Gitea · Gitea
Gitea Code Injection Vulnerability
Added Aug 25, 2026Fix by Aug 28, 2026
CVE-2026-21962Critical10.0
Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
195 days after exploitation was first evidenced
Added Aug 24, 2026Fix by Aug 27, 2026
CVE-2026-73570High8.9
Synacor · Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Added Aug 21, 2026Fix by Aug 24, 2026
CVE-2026-72530Critical9.0
TrueConf · Server
TrueConf Server Code Injection Vulnerability
8 days after exploitation was first evidenced
Added Aug 20, 2026Fix by Sep 3, 2026
CVE-2026-72529Critical9.8
TrueConf · Server
TrueConf Server Missing Authentication for Critical Function Vulnerability
8 days after exploitation was first evidenced
Added Aug 20, 2026Fix by Aug 23, 2026
CVE-2026-64849Critical9.3
MLflow · MLflow
MLflow Server-Side Request Forgery Vulnerability
Added Aug 19, 2026Fix by Sep 2, 2026
CVE-2026-65400Critical9.8
Apple · macOS
Apple macOS Improper Authentication Vulnerability
11 days after exploitation was first evidenced
Added Aug 18, 2026Fix by Aug 21, 2026
CVE-2026-59310Critical9.8Ransomware
Broadcom · VMware vCenter
Broadcom VMware vCenter Path Traversal Vulnerability
8 days after exploitation was first evidenced
Added Aug 18, 2026Fix by Aug 21, 2026
CVE-2026-55040Critical9.1
Microsoft · SharePoint
Microsoft SharePoint Weak Authentication Vulnerability
Added Aug 18, 2026Fix by Aug 21, 2026
CVE-2026-33824Critical9.8
Microsoft · Internet Key Exchange (IKE) Service Extensions
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
19 days after exploitation was first evidenced
Added Aug 18, 2026Fix by Aug 21, 2026
CVE-2025-62593High8.8
Ray-Project · Ray
Ray-Project Ray Code Injection Vulnerability
159 days after exploitation was first evidenced
Added Aug 17, 2026Fix by Aug 20, 2026
CVE-2026-72898Critical10.0
Metabase · Metabase
Metabase SQL Injection Vulnerability
Added Aug 11, 2026Fix by Aug 14, 2026
CVE-2026-68820High7.0
Microsoft · Windows Ancillary Function Driver for WinSock
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Added Aug 11, 2026Fix by Aug 25, 2026
CVE-2026-20349High8.6
Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Added Aug 11, 2026Fix by Aug 14, 2026
CVE-2026-8037Critical9.6
Progress · LoadMaster
Progress LoadMaster Command Injection Vulnerability
37 days after exploitation was first evidenced
Added Aug 7, 2026Fix by Aug 10, 2026
CVE-2026-63077Critical9.8
JetBrains · TeamCity
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Added Aug 5, 2026Fix by Aug 8, 2026
CVE-2026-9198Critical9.8
IBM · Langflow
IBM Langflow Code Injection Vulnerability
Added Aug 4, 2026Fix by Aug 7, 2026
CVE-2026-34486High7.5
Apache · Tomcat
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Added Aug 4, 2026Fix by Aug 7, 2026
CVE-2026-18556High7.4
N-able · N-central
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added Aug 4, 2026Fix by Aug 7, 2026
CVE-2026-18577High8.1
N-able · N-central
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added Aug 3, 2026Fix by Aug 6, 2026
CVE-2026-20316Medium5.3Ransomware
Cisco · Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Added Jul 29, 2026Fix by Aug 1, 2026
CVE-2026-16812Critical10.0
Arista · VeloCloud Orchestrator
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Added Jul 27, 2026Fix by Jul 30, 2026
CVE-2025-68686Medium5.9
Fortinet · FortiOS
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Added Jul 27, 2026Fix by Aug 10, 2026
CVE-2026-50522Critical9.8
Microsoft · SharePoint
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Added Jul 22, 2026Fix by Jul 25, 2026
CVE-2026-16232Critical9.8
Check Point · SmartConsole
Check Point SmartConsole Improper Authentication Vulnerability
Added Jul 22, 2026Fix by Jul 25, 2026
CVE-2026-63030Critical9.8
WordPress · Core
WordPress Core Interpretation Conflict Vulnerability
Added Jul 21, 2026Fix by Jul 24, 2026

What the KEV catalog is

Data from CISA’s Known Exploited Vulnerabilities catalog, a US Government work in the public domain. The deadlines shown are binding on US federal agencies (BOD 22-01); for everyone else they are a sound priority reference.

CVE database