Home › Exploited CVEs
CISA Known Exploited Vulnerabilities (KEV)
All 1,769 CVEs in CISA's KEV catalog, newest first, with EPSS exploit probability. RSS · JSON Feed
Most likely to be exploited next
The five KEV entries with the highest EPSS score today. Patch these first.
| CVE | Vendor / product | EPSS |
|---|---|---|
| CVE-2026-109619 | PHP Group PHP | 100.0% |
| CVE-2026-109618 | PHP Group PHP | 100.0% |
| CVE-2025-53770 | Microsoft SharePoint | 100.0% |
| CVE-2021-26086 | Atlassian Jira Server and Data Center | 100.0% |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager | 100.0% |
Need it fresh, filtered or via API?These pages are a free snapshot, last updated 2026-11-07.
Secure Stripe checkout (card, Apple Pay, Google Pay) · 14-day fix-or-refund if it doesn't work as described · terms
- Kevscope CVE priority API 200 free calls a day, $5 for 2,000 calls (no expiry), or $19/month for 10,000: returns a patch-priority verdict for up to 20 CVEs per call with the evidence (KEV, EPSS, CVSS, CISA SSVC), most urgent first, by API or MCP.
- Kevscope API $5 pack $5 for 2,000 calls, never expires: patch-priority verdicts for up to 20 CVEs per call from today's KEV, EPSS, CVSS and SSVC data, by REST API or MCP. Pay by card, your API key is on screen the moment checkout ends; no account, no subscription.
- Exploited Vulnerabilities Brief: Weekly Edition $9/month: a fresh KEV + EPSS brief every Monday (PDF + CSVs): new exploited CVEs, what to patch first, upcoming CISA deadlines.
- All Three Monday Briefs: Rates, Recalls + Exploited Vulns $25/month: all three weekly briefs (Treasury/BLS rates & macro, NHTSA recalls, CISA KEV/EPSS) for $25/month instead of $37.
Secure Stripe checkout (card, Apple Pay, Google Pay) · 14-day fix-or-refund if it doesn't work as described · terms
1,769exploited CVEs in KEV
30added in the last 30 days
361used in ransomware
907with EPSS of 50% or more
Browse and filter
200 shown on this page
No CVEs match. Clear the filter box or turn a chip off. Click a column heading to sort.
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 2026-11-06 | — | |
| CVE-2024-27834 | Apple Multiple Products | 2026-11-04 | 1.5% | |
| CVE-2026-119977 | WordPress WordPress Core | 2026-11-03 | 1.2% | |
| CVE-2026-118527 | Ivanti Connect Secure | 2026-10-30 | 0.8% | |
| CVE-2026-111357 | Ivanti Connect Secure | 2026-10-30 | 0.5% | |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | 2026-10-29 | 65.2% | |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | 2026-10-29 | 0.8% | |
| CVE-2026-46300 | Linux Kernel | 2026-10-28 | 16.1% | |
| CVE-2026-41709 | Broadcom VMware ESX | 2026-10-28 | 0.7% | |
| CVE-2026-48356 | Adobe Commerce and Magento | 2026-10-27 | 47.5% | |
| CVE-2026-111497 | Google Brotli | 2026-10-27 | 82.6% | |
| CVE-2026-109619 | PHP Group PHP | 2026-10-26 | 100.0% | |
| CVE-2026-109618 | PHP Group PHP | 2026-10-26 | 100.0% | |
| CVE-2026-114625 | Arista VeloCloud Orchestrator | 2026-10-23 | 1.0% | |
| CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | 2026-10-23 | 73.3% | |
| CVE-2026-96656 | Plex Media Server | 2026-10-20 | 1.8% | |
| CVE-2026-96655 | Plex Media Server | 2026-10-20 | 10.7% | |
| CVE-2026-96654 | Plex Media Server | 2026-10-20 | 1.9% | |
| CVE-2026-96652 | Plex Media Server | 2026-10-20 | 11.9% | |
| CVE-2026-110936 | Siemens Software Center | 2026-10-20 | 1.0% | |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | 2026-10-20 | 2.5% | |
| CVE-2026-102764 | BeyondTrust Remote Support | 2026-10-16 | 78.0% | |
| CVE-2025-61624 | Fortinet Multiple Products | 2026-10-16 | 1.3% | |
| CVE-2026-21589 | Atlassian Multiple Products | 2026-10-15 | 99.7% | |
| CVE-2026-76519 | Cisco Secure Email Gateway | 2026-10-14 | 6.2% | |
| CVE-2026-105134 | Ahsay AhsayCBS | 2026-10-14 | 81.8% | |
| CVE-2026-105133 | Ahsay AhsayCBS | 2026-10-14 | 79.5% | |
| CVE-2026-0322 | Palo Alto Networks PAN-OS | 2026-10-14 | 1.7% | |
| CVE-2026-96951 | Microsoft Windows | 2026-10-13 | 9.8% | |
| CVE-2026-104935 | Ivanti Connect Secure | 2026-10-13 | 88.9% | |
| CVE-2023-22894 | Strapi Strapi | 2026-10-08 | 4.1% | |
| CVE-2021-3199 | ONLYOFFICE Docs | 2026-10-08 | 30.2% | |
| CVE-2016-3081 | Apache Struts | 2026-10-08 | 96.5% | |
| CVE-2015-5477 | ISC BIND | 2026-10-08 | 99.6% | |
| CVE-2015-3306 | ProFTPD ProFTPD | 2026-10-08 | 99.5% | |
| CVE-2026-88779 | Citrix NetScaler | 2026-10-04 | 11.4% | |
| CVE-2026-102490 | Zammad GmbH Zammad | 2026-10-02 | 10.9% | |
| CVE-2026-102489 | Zammad GmbH Zammad | 2026-10-02 | 22.5% | |
| CVE-2026-104286 | Fortinet FortiMail | 2026-10-01 | 4.6% | |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | 2026-09-30 | 38.9% | |
| CVE-2026-86950 | Apple Multiple Products | 2026-09-29 | 26.2% | |
| CVE-2026-88772 | Citrix NetScaler | 2026-09-27 | 76.6% | |
| CVE-2026-88771 | Citrix NetScaler | 2026-09-27 | 81.9% | |
| CVE-2026-87902 | WordPress Core | 2026-09-25 | 95.8% | |
| CVE-2026-67279 | MikroTik RouterOS | 2026-09-25 | 2.3% | |
| CVE-2026-65660 | Microsoft SharePoint | 2026-09-25 | 8.2% | |
| CVE-2026-71362 | Adobe Commerce and Magento | 2026-09-24 | 90.5% | |
| CVE-2026-5430 | WSO2 Multiple Products | 2026-09-24 | 22.4% | |
| CVE-2026-94127 | F5 BIG-IP APM | 2026-09-22 | 26.6% | |
| CVE-2026-93952 | Arista VeloCloud Orchestrator | 2026-09-22 | 1.4% | |
| CVE-2026-93616 | Check Point Multiple Products | 2026-09-22 | 91.6% | |
| CVE-2026-85102 | Check Point Multiple Products | 2026-09-22 | 54.1% | |
| CVE-2026-7273 | Zyxel GS1900 Series Switches | 2026-09-21 | 2.7% | |
| CVE-2026-53266 | Linux Kernel | 2026-09-18 | 0.9% | |
| CVE-2025-39964 | Linux Kernel | 2026-09-18 | 1.6% | |
| CVE-2025-39682 | Linux Kernel | 2026-09-18 | 3.2% | |
| CVE-2026-87886 | Acronis Backup | 2026-09-16 | 0.2% | |
| CVE-2026-76460 | Cisco Identity Services Engine | 2026-09-16 | 75.6% | |
| CVE-2026-58704 | Google Pixel | 2026-09-16 | 0.6% | |
| CVE-2026-76461 | Cisco Secure Email Gateway | 2026-09-14 | 40.2% | |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | 2026-09-11 | 97.4% | |
| CVE-2026-84869 | ConnectWise ScreenConnect | 2026-09-11 | 0.9% | |
| CVE-2026-42018 | JFrog Artifactory | 2026-09-11 | 10.0% | |
| CVE-2026-42016 | JFrog Artifactory | 2026-09-11 | 8.6% | |
| CVE-2026-86060 | MikroTik RouterOS | 2026-09-10 | 6.4% | |
| CVE-2026-67277 | MikroTik RouterOS | 2026-09-10 | 1.6% | |
| CVE-2026-87491 | Google Chromium V8 | 2026-09-09 | 3.5% | |
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 2026-09-09 | 88.7% | |
| CVE-2026-19490 | Citrix NetScaler | 2026-09-09 | 32.7% | |
| CVE-2025-25249 | Fortinet Multiple Products | 2026-09-09 | 3.7% | |
| CVE-2026-86218 | N-able N-central | 2026-09-08 | 15.4% | |
| CVE-2026-85880 | Microsoft Windows | 2026-09-08 | 0.4% | |
| CVE-2026-81963 | Microsoft Windows | 2026-09-08 | 0.4% | |
| CVE-2026-75650 | Adobe Commerce and Magento | 2026-09-08 | 34.7% | |
| CVE-2026-85046 | Google Chromium V8 | 2026-09-04 | 1.8% | |
| CVE-2026-9586 | Sangoma Switchvox | 2026-09-02 | 19.0% | |
| CVE-2026-83549 | SonicWall SMA1000 Appliances | 2026-09-02 | 9.9% | |
| CVE-2026-83548 | SonicWall SMA1000 Appliances | 2026-09-02 | 8.0% | |
| CVE-2026-82329 | JFrog Artifactory | 2026-09-02 | 14.4% | |
| CVE-2026-59822 | BerriAI LiteLLM | 2026-09-02 | 0.8% | |
| CVE-2026-49869 | Kestra Kestra OSS | 2026-09-02 | 2.1% | |
| CVE-2026-48710 | Kludex Starlette | 2026-09-02 | 70.3% | |
| CVE-2026-82078 | PaperCut NG/MF | 2026-08-31 | 63.0% | |
| CVE-2026-81578 | PaperCut NG/MF | 2026-08-31 | 84.7% | |
| CVE-2026-66384 | JFrog Artifactory | 2026-08-27 | 0.7% | |
| CVE-2026-53362 | Linux Kernel | 2026-08-27 | 0.7% | |
| CVE-2023-49105 | ownCloud ownCloud | 2026-08-27 | 43.2% | |
| CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway | 2026-08-26 | 1.0% | |
| CVE-2022-0995 | Linux Kernel | 2026-08-26 | 8.9% | |
| CVE-2021-23758 | Ajax.NET Professional Ajax.NET Professional | 2026-08-26 | 82.6% | |
| CVE-2019-1068 | Microsoft SQL Server | 2026-08-26 | 57.3% | |
| CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool | 2026-08-26 | 5.0% | |
| CVE-2015-3246 | Red Hat Libuser | 2026-08-26 | 8.5% | |
| CVE-2026-60004 | Gitea Gitea | 2026-08-25 | 24.0% | |
| CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | 2026-08-24 | 73.2% | |
| CVE-2026-73570 | Synacor Zimbra Collaboration Suite (ZCS) | 2026-08-21 | 71.7% | |
| CVE-2026-72530 | TrueConf Server | 2026-08-20 | 1.7% | |
| CVE-2026-72529 | TrueConf Server | 2026-08-20 | 1.5% | |
| CVE-2026-64849 | MLflow MLflow | 2026-08-19 | 10.0% | |
| CVE-2026-65400 | Apple macOS | 2026-08-18 | 1.7% | |
| CVE-2026-59310 | Broadcom VMware vCenter | 2026-08-18 | 2.6% | known |
| CVE-2026-55040 | Microsoft SharePoint | 2026-08-18 | 69.5% | |
| CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions | 2026-08-18 | 77.1% | |
| CVE-2025-62593 | Ray-Project Ray | 2026-08-17 | 60.2% | |
| CVE-2026-72898 | Metabase Metabase | 2026-08-11 | 98.8% | |
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock | 2026-08-11 | 8.6% | |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 2026-08-11 | 1.0% | |
| CVE-2026-8037 | Progress LoadMaster | 2026-08-07 | 99.8% | |
| CVE-2026-63077 | JetBrains TeamCity | 2026-08-05 | 94.9% | known |
| CVE-2026-9198 | IBM Langflow | 2026-08-04 | 28.7% | |
| CVE-2026-34486 | Apache Tomcat | 2026-08-04 | 98.5% | |
| CVE-2026-18556 | N-able N-central | 2026-08-04 | 7.9% | |
| CVE-2026-18577 | N-able N-central | 2026-08-03 | 14.6% | |
| CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | 2026-07-29 | 35.1% | known |
| CVE-2026-16812 | Arista VeloCloud Orchestrator | 2026-07-27 | 1.8% | |
| CVE-2025-68686 | Fortinet FortiOS | 2026-07-27 | 29.5% | |
| CVE-2026-50522 | Microsoft SharePoint | 2026-07-22 | 3.0% | |
| CVE-2026-16232 | Check Point SmartConsole | 2026-07-22 | 3.5% | |
| CVE-2026-63030 | WordPress Core | 2026-07-21 | 10.6% | |
| CVE-2026-60137 | WordPress Core | 2026-07-21 | 5.3% | |
| CVE-2026-0770 | Langflow Langflow | 2026-07-21 | 62.6% | |
| CVE-2021-27137 | DD-WRT DD-WRT | 2026-07-21 | 4.0% | |
| CVE-2026-58644 | Microsoft SharePoint | 2026-07-16 | 15.9% | |
| CVE-2026-39808 | Fortinet FortiSandbox | 2026-07-16 | 93.2% | |
| CVE-2026-25089 | Fortinet FortiSandbox | 2026-07-16 | 76.1% | |
| CVE-2026-46817 | Oracle E-Business Suite | 2026-07-15 | 12.3% | |
| CVE-2023-4346 | KNX Association KNX Protocol Connection Authorization Option 1 | 2026-07-15 | 1.4% | |
| CVE-2026-56164 | Microsoft SharePoint Server | 2026-07-14 | 1.0% | |
| CVE-2026-56155 | Microsoft Active Directory Federation Services | 2026-07-14 | 0.3% | |
| CVE-2026-15410 | SonicWall SMA1000 Appliances | 2026-07-14 | 11.8% | known |
| CVE-2026-15409 | SonicWall SMA1000 Appliances | 2026-07-14 | 6.8% | known |
| CVE-2008-4128 | Cisco IOS | 2026-07-13 | 33.9% | |
| CVE-2026-56291 | Balbooa Forms | 2026-07-10 | 14.9% | |
| CVE-2026-48939 | iCagenda iCagenda | 2026-07-10 | 20.1% | |
| CVE-2026-56290 | Joomlack Page Builder | 2026-07-07 | 30.9% | |
| CVE-2026-55255 | Langflow Langflow | 2026-07-07 | 0.9% | |
| CVE-2026-48908 | JoomShaper SP Page Builder | 2026-07-07 | 88.5% | |
| CVE-2026-48282 | Adobe ColdFusion | 2026-07-07 | 42.4% | |
| CVE-2026-45659 | Microsoft SharePoint Server | 2026-07-01 | 80.2% | known |
| CVE-2026-48558 | SimpleHelp SimpleHelp | 2026-06-29 | 80.8% | |
| CVE-2026-20230 | Cisco Unified Communications Manager | 2026-06-25 | 88.5% | |
| CVE-2026-12569 | PTC Windchill and FlexPLM | 2026-06-25 | 46.0% | known |
| CVE-2026-34910 | Ubiquiti UniFi OS | 2026-06-23 | 90.0% | |
| CVE-2026-34909 | Ubiquiti UniFi OS | 2026-06-23 | 69.2% | |
| CVE-2026-34908 | Ubiquiti UniFi OS | 2026-06-23 | 88.9% | |
| CVE-2025-67038 | Lantronix EDS5000 | 2026-06-23 | 21.1% | |
| CVE-2026-20253 | Splunk Enterprise | 2026-06-18 | 96.9% | |
| CVE-2026-48907 | Widget Factory Joomla Content Editor | 2026-06-16 | 85.4% | |
| CVE-2026-54420 | LiteSpeed cPanel Plugin | 2026-06-15 | 1.4% | |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager | 2026-06-15 | 29.1% | |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | 2026-06-12 | 96.7% | known |
| CVE-2026-10520 | Ivanti Sentry | 2026-06-11 | 99.9% | |
| CVE-2026-7473 | Arista Extensible Operating System | 2026-06-09 | 1.1% | |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager | 2026-06-09 | 25.3% | |
| CVE-2026-11645 | Google Chromium V8 | 2026-06-09 | 2.4% | |
| CVE-2026-50751 | Check Point Security Gateway | 2026-06-08 | 85.3% | known |
| CVE-2026-42271 | BerriAI LiteLLM | 2026-06-08 | 91.4% | |
| CVE-2026-28318 | SolarWinds Serv-U | 2026-06-05 | 43.7% | |
| CVE-2026-45247 | Mirasvit Mirasvit Full Page Cache Warmer | 2026-06-03 | 26.2% | |
| CVE-2025-48595 | Android Framework | 2026-06-02 | 1.9% | |
| CVE-2022-0492 | Linux Kernel | 2026-06-02 | 5.5% | |
| CVE-2024-21182 | Oracle WebLogic Server | 2026-06-01 | 74.2% | |
| CVE-2026-0257 | Palo Alto Networks PAN-OS | 2026-05-29 | 95.6% | known |
| CVE-2026-8398 | Daemon Daemon Tools Lite | 2026-05-27 | 1.5% | |
| CVE-2026-48027 | Nx Nx Console | 2026-05-27 | 1.8% | known |
| CVE-2026-45321 | TanStack TanStack | 2026-05-27 | 3.3% | known |
| CVE-2026-48172 | LiteSpeed cPanel Plugin | 2026-05-26 | 17.9% | |
| CVE-2026-9082 | Drupal Core | 2026-05-22 | 89.4% | |
| CVE-2026-34926 | Trend Micro Apex One | 2026-05-21 | 13.4% | |
| CVE-2025-34291 | Langflow Langflow | 2026-05-21 | 93.2% | |
| CVE-2026-45498 | Microsoft Defender | 2026-05-20 | 63.1% | |
| CVE-2026-41091 | Microsoft Defender | 2026-05-20 | 8.2% | |
| CVE-2010-0806 | Microsoft Internet Explorer | 2026-05-20 | 82.1% | |
| CVE-2010-0249 | Microsoft Internet Explorer | 2026-05-20 | 91.9% | |
| CVE-2009-3459 | Adobe Acrobat and Reader | 2026-05-20 | 86.5% | |
| CVE-2009-1537 | Microsoft DirectX | 2026-05-20 | 51.1% | |
| CVE-2008-4250 | Microsoft Windows | 2026-05-20 | 98.8% | |
| CVE-2026-42897 | Microsoft Microsoft | 2026-05-15 | 70.7% | |
| CVE-2026-20182 | Cisco Catalyst SD-WAN | 2026-05-14 | 91.8% | |
| CVE-2026-42208 | BerriAI LiteLLM | 2026-05-08 | 89.4% | |
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-05-07 | 34.5% | |
| CVE-2026-0300 | Palo Alto Networks PAN-OS | 2026-05-06 | 41.7% | |
| CVE-2026-31431 | Linux Kernel | 2026-05-01 | 98.1% | |
| CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) | 2026-04-30 | 98.5% | known |
| CVE-2026-32202 | Microsoft Windows | 2026-04-28 | 70.9% | |
| CVE-2024-1708 | ConnectWise ScreenConnect | 2026-04-28 | 95.4% | known |
| CVE-2025-29635 | D-Link DIR-823X | 2026-04-24 | 87.9% | |
| CVE-2024-7399 | Samsung MagicINFO 9 Server | 2026-04-24 | 91.9% | |
| CVE-2024-57728 | SimpleHelp SimpleHelp | 2026-04-24 | 64.5% | known |
| CVE-2024-57726 | SimpleHelp SimpleHelp | 2026-04-24 | 66.4% | known |
| CVE-2026-39987 | Marimo Marimo | 2026-04-23 | 99.7% | |
| CVE-2026-33825 | Microsoft Defender | 2026-04-22 | 6.7% | known |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager | 2026-04-20 | 35.3% | |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager | 2026-04-20 | 8.3% | |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manger | 2026-04-20 | 25.8% | |
| CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) | 2026-04-20 | 1.7% | |
| CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) | 2026-04-20 | 2.5% | |
| CVE-2025-2749 | Kentico Kentico Xperience | 2026-04-20 | 4.0% | |
| CVE-2024-27199 | JetBrains TeamCity | 2026-04-20 | 100.0% | known |
| CVE-2023-27351 | PaperCut NG/MF | 2026-04-20 | 78.1% | known |
1 · 2 · 3 · 4 · 5 · 6 · 7 · 8 · 9
Filters and the CSV cover the 200 rows on this page. The full catalog is free as a daily dataset.
🔔 Get a browser alert when CISA adds a new KEV entry (free, no email, one click to stop).
Kevscope: daily CISA KEV + EPSS datasetThe whole KEV catalog joined with daily EPSS and CVSS scores as CSV/Parquet, refreshed daily. Free to download.
Get the full file: Exploited Vulnerabilities Brief: Weekly Edition ($9/month): each week's KEV additions ranked by EPSS, ransomware use and due date, ready to hand to a patch team. Checkout by Polar.
Get the full file: Exploited Vulnerabilities Brief: Weekly Edition ($9/month): each week's KEV additions ranked by EPSS, ransomware use and due date, ready to hand to a patch team. Checkout by Polar.