CISA's Known Exploited Vulnerabilities catalog lists 1,779 vulnerabilities confirmed as exploited in the wild, 295 of them added in 2026 (latest addition: November 10, 2026). For 2026 additions, the median time between the CVE record's publication and CISA's confirmation of exploitation is 13 days. Data comes from the official CISA catalog and the CVE Program records; it refreshes every six hours.
Catalog entries1,779Known exploited vulnerabilities listed by CISA
Added in 202629540 in the 30 days to 2026-11-10
Median confirmation lag13 daysCVE published → added to KEV (2026, 291 entries)
Confirmed within a day27%Lag of 0 or 1 day
Known ransomware use272026 additions flagged Known by CISA
Median fix window3 daysDue date minus date added (federal agencies)
Every vulnerability added in 2026
| Added | CVE | Vendor / product | Vulnerability | CVE published | Confirmation lag | CVSS | Fix window | Ransomware |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-20320 | CiscoBroadWorks | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | 2026-08-19 | 83 d | 7.5 | 14 d | Unknown | |
| CVE-2026-125350 | GoogleChromium | Google Chromium Use-After-Free Vulnerability | 2026-11-10 | 0 d | 8.8 | 14 d | Unknown | |
| CVE-2026-124194 | MicrosoftOffice | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | 2026-11-10 | 0 d | 6.5 | 14 d | Unknown | |
| CVE-2026-116606 | Barracuda NetworksBarracuda Email Security Gateway (ESG) | Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-11-02 | 8 d | 9.3 | 3 d | Unknown | |
| CVE-2026-111793 | Openwave Messaging LimitedWebtop Media Transcoder | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | 2026-10-16 | 25 d | 4.3 | 14 d | Unknown | |
| CVE-2026-111560 | Barracuda NetworksMultiple Products | Barracuda Networks Multiple Products OS Command Injection Vulnerability | 2026-11-02 | 8 d | 8.6 | 3 d | Unknown | |
| CVE-2026-123218 | IBMAspera Faspex | IBM Aspera Faspex Incorrect Authorization Vulnerability | 2026-11-07 | 2 d | 9.8 | 3 d | Unknown | |
| CVE-2026-123158 | OpenBSDOpenSSH | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | 2026-11-05 | 4 d | 8.1 | 3 d | Unknown | |
| CVE-2026-116779 | SignalWireFreeSwitch | SignalWire FreeSwitch Code Injection Vulnerability | 2026-11-05 | 4 d | 9.8 | 3 d | Unknown | |
| CVE-2026-102895 | GPUStackGPUStack | GPUStack Improper Authentication Vulnerability | 2026-11-04 | 5 d | 9.8 | 3 d | Unknown | |
| CVE-2026-19868 | SonicWallSonicOS SSLVPN | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | 2026-11-06 | 0 d | 7.5 | 14 d | Unknown | |
| CVE-2024-27834 | AppleMultiple Products | Apple Multiple Products Improper Authentication Vulnerability | 2024-05-13 | 905 d | 5.5 | 14 d | Unknown | |
| CVE-2026-119977 | WordPressWordPress Core | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | 2026-10-31 | 3 d | 8.1 | 3 d | Unknown | |
| CVE-2026-118527 | IvantiConnect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | 2026-11-03 | -4 d | 4.3 | 14 d | Unknown | |
| CVE-2026-111357 | IvantiConnect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | 2026-10-15 | 15 d | 7.0 | 3 d | Unknown | |
| CVE-2026-97229 | GitLabCommunity Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | 2026-10-13 | 16 d | 10.0 | 3 d | Unknown | |
| CVE-2026-76418 | CiscoSecure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | 2026-10-28 | 1 d | 8.6 | 3 d | Unknown | |
| CVE-2026-46300 | LinuxKernel | Linux Kernel Missing Initialization of a Variable Vulnerability | 2026-05-23 | 158 d | 7.8 | 3 d | Unknown | |
| CVE-2026-41709 | BroadcomVMware ESX | Broadcom VMWare ESX Insufficient Logging Vulnerability | 2026-07-30 | 90 d | 2.7 | 14 d | Unknown | |
| CVE-2026-48356 | AdobeCommerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-07-14 | 105 d | 9.3 | 14 d | Unknown | |
| CVE-2026-111497 | GoogleBrotli | Google Brotli Unchecked Return Value Vulnerability | 2026-10-22 | 5 d | 9.2 | 14 d | Unknown | |
| CVE-2026-109619 | PHP GroupPHP | PHP Stale Internal Request-State Vulnerability | 2026-10-21 | 5 d | 9.2 | 3 d | Unknown | |
| CVE-2026-109618 | PHP GroupPHP | PHP Memory Corruption Vulnerability | 2026-10-21 | 5 d | 9.2 | 3 d | Unknown | |
| CVE-2026-114625 | AristaVeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability | 2026-10-22 | 1 d | 9.9 | 3 d | Unknown | |
| CVE-2026-110447 | CollaboraCollabora Online – Built-in CODE Server | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | 2026-10-14 | 9 d | 9.2 | 3 d | Unknown | |
| CVE-2026-96656 | PlexMedia Server | Plex Media Server External Control of File Name or Path Vulnerability | 2026-09-23 | 27 d | 8.6 | 3 d | Unknown | |
| CVE-2026-96655 | PlexMedia Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-09-23 | 27 d | 4.3 | 14 d | Unknown | |
| CVE-2026-96654 | PlexMedia Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 2026-09-23 | 27 d | 6.9 | 3 d | Unknown | |
| CVE-2026-96652 | PlexMedia Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-09-23 | 27 d | 4.3 | 14 d | Unknown | |
| CVE-2026-110936 | SiemensSoftware Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability | 2026-10-15 | 5 d | 6.7 | 14 d | Unknown | |
| CVE-2026-106931 | EG Secure SolutionsSiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | 2026-10-14 | 6 d | 7.8 | 3 d | Unknown | |
| CVE-2026-102764 | BeyondTrustRemote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | 2026-10-15 | 1 d | 9.3 | 3 d | Unknown | |
| CVE-2025-61624 | FortinetMultiple Products | Fortinet Multiple Products Path Traversal Vulnerability | 2026-04-14 | 185 d | 5.4 | 3 d | Unknown | |
| CVE-2026-21589 | AtlassianMultiple Products | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 2026-10-05 | 10 d | 9.3 | 3 d | Unknown | |
| CVE-2026-76519 | CiscoSecure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 2026-10-14 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-105134 | AhsayAhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | 2026-10-04 | 10 d | 10.0 | 3 d | Unknown | |
| CVE-2026-105133 | AhsayAhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | 2026-10-04 | 10 d | 6.9 | 3 d | Unknown | |
| CVE-2026-0322 | Palo Alto NetworksPAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | 2026-10-14 | 0 d | 8.6 | 3 d | Unknown | |
| CVE-2026-96951 | MicrosoftWindows | Microsoft Windows Command Injection Vulnerability | 2026-10-13 | 0 d | 8.8 | 3 d | Unknown | |
| CVE-2026-104935 | IvantiConnect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | 2026-10-13 | 0 d | 8.6 | 3 d | Unknown | |
| CVE-2023-22894 | StrapiStrapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | 2023-04-19 | 1268 d | 7.2 | 3 d | Unknown | |
| CVE-2021-3199 | ONLYOFFICEDocs | ONLYOFFICE Docs Server Path Traversal Vulnerability | 2021-01-22 | 2085 d | 9.8 | 3 d | Unknown | |
| CVE-2016-3081 | ApacheStruts | Apache Struts Command Injection Vulnerability | 2016-04-26 | 3817 d | 8.1 | 3 d | Unknown | |
| CVE-2015-5477 | ISCBIND | ISC BIND Data Processing Errors Vulnerability | 2015-07-29 | 4089 d | 7.5 | 3 d | Unknown | |
| CVE-2015-3306 | ProFTPDProFTPD | ProFTPD Improper Access Control Vulnerability | 2015-05-18 | 4161 d | 10.0 | 3 d | Unknown | |
| CVE-2026-88779 | CitrixNetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-10-04 | 0 d | 8.7 | 3 d | Unknown | |
| CVE-2026-102490 | Zammad GmbHZammad | Zammad GmbH Zammad Improper Privilege Management Vulnerability | 2026-09-30 | 2 d | 8.5 | 3 d | Unknown | |
| CVE-2026-102489 | Zammad GmbHZammad | Zammad GmbH Zammad Session Fixation Vulnerability | 2026-09-30 | 2 d | 8.7 | 3 d | Unknown | |
| CVE-2026-104286 | FortinetFortiMail | Fortinet FortiMail Path Traversal Vulnerability | 2026-10-01 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-76504 | CiscoCatalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-86950 | AppleMultiple Products | Apple Multiple Products Out-of-Bounds Write Vulnerability | 2026-09-28 | 1 d | 8.8 | 14 d | Unknown | |
| CVE-2026-88772 | CitrixNetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-09-27 | 0 d | 9.5 | 3 d | Unknown | |
| CVE-2026-88771 | CitrixNetScaler | Citrix NetScaler Improper Input Validation Vulnerability | 2026-09-27 | 0 d | 9.5 | 3 d | Unknown | |
| CVE-2026-87902 | WordPressCore | WordPress Core Remote File Inclusion Vulnerability | 2026-09-22 | 3 d | 8.1 | 3 d | Unknown | |
| CVE-2026-67279 | MikroTikRouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 2026-09-05 | 20 d | 6.9 | 3 d | Unknown | |
| CVE-2026-65660 | MicrosoftSharePoint | Microsoft SharePoint Code Injection Vulnerability | 2026-08-11 | 45 d | 8.8 | 3 d | Unknown | |
| CVE-2026-71362 | AdobeCommerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-08-11 | 44 d | 9.1 | 3 d | Unknown | |
| CVE-2026-5430 | WSO2Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | 2026-08-06 | 49 d | 10.0 | 3 d | Unknown | |
| CVE-2026-94127 | F5BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 2026-09-22 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-93952 | AristaVeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 2026-09-22 | 0 d | 10.0 | 3 d | Unknown | |
| CVE-2026-93616 | Check PointMultiple Products | Check Point Multiple Products Path Traversal Vulnerability | 2026-09-22 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-85102 | Check PointMultiple Products | Check Point Multiple Products Improper Certificate Validation Vulnerability | 2026-09-09 | 13 d | 9.8 | 3 d | Unknown | |
| CVE-2026-7273 | ZyxelGS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 2026-06-16 | 97 d | 8.8 | 3 d | Unknown | |
| CVE-2026-53266 | LinuxKernel | Linux Kernel Out-of-Bounds Write Vulnerability | 2026-06-25 | 85 d | 8.8 | 3 d | Unknown | |
| CVE-2025-39964 | LinuxKernel | Linux Kernel Race Condition Vulnerability | 2025-10-13 | 340 d | 7.8 | 3 d | Unknown | |
| CVE-2025-39682 | LinuxKernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | 2025-09-05 | 378 d | 9.8 | 3 d | Unknown | |
| CVE-2026-87886 | AcronisBackup | Acronis Backup Incorrect Default Permissions Vulnerability | 2026-09-17 | -1 d | 7.8 | 3 d | Unknown | |
| CVE-2026-76460 | CiscoIdentity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | 0 d | 10.0 | 3 d | Unknown | |
| CVE-2026-58704 | GooglePixel | Google Pixel Improper Authorization Vulnerability | 2026-09-15 | 1 d | 8.8 | 3 d | Unknown | |
| CVE-2026-76461 | CiscoSecure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-85706 | GitLabCommunity Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 2026-09-12 | -1 d | 10.0 | 3 d | Unknown | |
| CVE-2026-84869 | ConnectWiseScreenConnect | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | 2026-09-08 | 3 d | 9.9 | 3 d | Unknown | |
| CVE-2026-42018 | JFrogArtifactory | JFrog Artifactory Improper Authentication Vulnerability | 2026-08-12 | 30 d | 7.5 | 14 d | Unknown | |
| CVE-2026-42016 | JFrogArtifactory | JFrog Artifactory Incorrect Authorization Vulnerability | 2026-07-27 | 46 d | 8.1 | 14 d | Unknown | |
| CVE-2026-86060 | MikroTikRouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 2026-09-05 | 5 d | 9.2 | 3 d | Unknown | |
| CVE-2026-67277 | MikroTikRouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | 2026-09-05 | 5 d | 8.8 | 3 d | Unknown | |
| CVE-2026-87491 | GoogleChromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | 2026-09-09 | 0 d | 8.8 | 14 d | Unknown | |
| CVE-2026-20079 | CiscoSecure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-03-04 | 189 d | 10.0 | 3 d | Unknown | |
| CVE-2026-19490 | CitrixNetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-08-19 | 21 d | 9.3 | 3 d | Unknown | |
| CVE-2025-25249 | FortinetMultiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | 2026-01-13 | 239 d | 7.4 | 3 d | Unknown | |
| CVE-2026-86218 | N-ableN-central | N-able N-central Static Code Injection Vulnerability | 2026-09-06 | 2 d | 10.0 | 3 d | Unknown | |
| CVE-2026-85880 | MicrosoftWindows | Microsoft Windows Heap-Based Buffer Overflow Vulnerability | 2026-09-08 | 0 d | 7.8 | 14 d | Unknown | |
| CVE-2026-81963 | MicrosoftWindows | Microsoft Windows Link Following Vulnerability | 2026-09-08 | 0 d | 7.8 | 14 d | Unknown | |
| CVE-2026-75650 | AdobeCommerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 2026-09-07 | 1 d | 10.0 | 3 d | Unknown | |
| CVE-2026-85046 | GoogleChromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2026-09-03 | 1 d | 8.8 | 14 d | Unknown | |
| CVE-2026-9586 | SangomaSwitchvox | Sangoma Switchvox SQL Injection Vulnerability | 2026-07-17 | 47 d | 9.3 | 3 d | Unknown | |
| CVE-2026-83549 | SonicWallSMA1000 Appliances | SonicWall SMA1000 Appliances OS Command Injection Vulnerability | 2026-09-01 | 1 d | 7.8 | 3 d | Unknown | |
| CVE-2026-83548 | SonicWallSMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | 2026-09-01 | 1 d | 10.0 | 3 d | Unknown | |
| CVE-2026-82329 | JFrogArtifactory | JFrog Artifactory Improper Authentication Vulnerability | 2026-08-28 | 5 d | 9.8 | 3 d | Unknown | |
| CVE-2026-59822 | BerriAILiteLLM | BerriAI LiteLLM Improper Authentication Vulnerability | 2026-07-08 | 56 d | 8.8 | 14 d | Unknown | |
| CVE-2026-49869 | KestraKestra OSS | Kestra OSS OS Command Injection Vulnerability | 2026-06-26 | 68 d | 10.0 | 3 d | Unknown | |
| CVE-2026-48710 | KludexStarlette | Kludex Starlette HTTP Request/Response Smuggling Vulnerability | 2026-05-26 | 99 d | 6.5 | 14 d | Unknown | |
| CVE-2026-82078 | PaperCutNG/MF | PaperCut NG/MF Unsafe Reflection Vulnerability | 2026-08-28 | 3 d | 9.4 | 14 d | Unknown | |
| CVE-2026-81578 | PaperCutNG/MF | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | 2026-08-28 | 3 d | 8.8 | 14 d | Unknown | |
| CVE-2026-66384 | JFrogArtifactory | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability | 2026-08-12 | 15 d | 5.3 | 14 d | Unknown | |
| CVE-2026-53362 | LinuxKernel | Linux Kernel Unspecified Vulnerability | 2026-07-04 | 54 d | 7.8 | 3 d | Unknown | |
| CVE-2023-49105 | ownCloudownCloud | ownCloud Improper Authentication Vulnerability | 2023-11-21 | 1010 d | 9.8 | 3 d | Unknown | |
| CVE-2026-8452 | CitrixNetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-06-30 | 57 d | 8.8 | 3 d | Unknown | |
| CVE-2022-0995 | LinuxKernel | Linux Kernel Out-of-Bounds Write Vulnerability | 2022-03-25 | 1615 d | 7.8 | 3 d | Unknown | |
| CVE-2021-23758 | Ajax.NET ProfessionalAjax.NET Professional | Ajax.NET Professional Deserialization of Untrusted Data Vulnerability | 2021-12-03 | 1727 d | 8.1 | 14 d | Unknown | |
| CVE-2019-1068 | MicrosoftSQL Server | Microsoft SQL Server Remote Code Execution Vulnerability | 2019-07-15 | 2599 d | 8.8 | 3 d | Unknown | |
| CVE-2015-5287 | Red HatAutomatic Bug Reporting Tool | Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | 2015-12-07 | 3915 d | 7.8 | 14 d | Unknown | |
| CVE-2015-3246 | Red HatLibuser | Red Hat Libuser Race Condition Vulnerability | 2015-08-11 | 4033 d | 7.4 | 14 d | Unknown | |
| CVE-2026-60004 | GiteaGitea | Gitea Code Injection Vulnerability | 2026-08-26 | -1 d | 9.8 | 3 d | Unknown | |
| CVE-2026-21962 | OracleHTTP Server and Oracle Weblogic Server Proxy Plug-in | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | 2026-01-20 | 216 d | 10.0 | 3 d | Unknown | |
| CVE-2026-73570 | SynacorZimbra Collaboration Suite (ZCS) | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | 2026-08-13 | 8 d | 8.9 | 3 d | Unknown | |
| CVE-2026-72530 | TrueConfServer | TrueConf Server Code Injection Vulnerability | 2026-08-19 | 1 d | 9.5 | 14 d | Unknown | |
| CVE-2026-72529 | TrueConfServer | TrueConf Server Missing Authentication for Critical Function Vulnerability | 2026-08-19 | 1 d | 9.3 | 3 d | Unknown | |
| CVE-2026-64849 | MLflowMLflow | MLflow Server-Side Request Forgery Vulnerability | 2026-08-17 | 2 d | 9.3 | 14 d | Unknown | |
| CVE-2026-65400 | ApplemacOS | Apple macOS Improper Authentication Vulnerability | 2026-08-06 | 12 d | 9.8 | 3 d | Unknown | |
| CVE-2026-59310 | BroadcomVMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability | 2026-07-30 | 19 d | 9.8 | 3 d | Known | |
| CVE-2026-55040 | MicrosoftSharePoint | Microsoft SharePoint Weak Authentication Vulnerability | 2026-07-14 | 35 d | 9.1 | 3 d | Unknown | |
| CVE-2026-33824 | MicrosoftInternet Key Exchange (IKE) Service Extensions | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | 2026-04-14 | 126 d | 9.8 | 3 d | Unknown | |
| CVE-2025-62593 | Ray-ProjectRay | Ray-Project Ray Code Injection Vulnerability | 2025-11-26 | 264 d | 9.4 | 3 d | Unknown | |
| CVE-2026-72898 | MetabaseMetabase | Metabase SQL Injection Vulnerability | 2026-08-10 | 1 d | 10.0 | 3 d | Unknown | |
| CVE-2026-68820 | MicrosoftWindows Ancillary Function Driver for WinSock | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | 2026-08-11 | 0 d | 7.0 | 14 d | Unknown | |
| CVE-2026-20349 | CiscoSecure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | 2026-08-11 | 0 d | 8.6 | 3 d | Unknown | |
| CVE-2026-8037 | ProgressLoadMaster | Progress LoadMaster Command Injection Vulnerability | 2026-06-04 | 64 d | 9.6 | 3 d | Unknown | |
| CVE-2026-63077 | JetBrainsTeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | 2026-07-27 | 9 d | 9.8 | 3 d | Known | |
| CVE-2026-9198 | IBMLangflow | IBM Langflow Code Injection Vulnerability | 2026-07-17 | 18 d | 9.8 | 3 d | Unknown | |
| CVE-2026-34486 | ApacheTomcat | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | 2026-04-09 | 117 d | 7.5 | 3 d | Unknown | |
| CVE-2026-18556 | N-ableN-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-08-01 | 3 d | 8.2 | 3 d | Unknown | |
| CVE-2026-18577 | N-ableN-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-08-02 | 1 d | 8.2 | 3 d | Unknown | |
| CVE-2026-20316 | CiscoSecure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | 2026-07-29 | 0 d | 5.3 | 3 d | Known | |
| CVE-2026-16812 | AristaVeloCloud Orchestrator | Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | 2026-07-27 | 0 d | 10.0 | 3 d | Unknown | |
| CVE-2025-68686 | FortinetFortiOS | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 2026-02-10 | 167 d | 5.3 | 14 d | Unknown | |
| CVE-2026-50522 | MicrosoftSharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-07-14 | 8 d | 9.8 | 3 d | Unknown | |
| CVE-2026-16232 | Check PointSmartConsole | Check Point SmartConsole Improper Authentication Vulnerability | 2026-07-22 | 0 d | 9.3 | 3 d | Unknown | |
| CVE-2026-63030 | WordPressCore | WordPress Core Interpretation Conflict Vulnerability | 2026-07-17 | 4 d | 9.8 | 3 d | Unknown | |
| CVE-2026-60137 | WordPressCore | WordPress Core SQL Injection Vulnerability | 2026-07-17 | 4 d | 5.9 | 14 d | Unknown | |
| CVE-2026-0770 | LangflowLangflow | Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability | 2026-01-23 | 179 d | 9.8 | 3 d | Unknown | |
| CVE-2021-27137 | DD-WRTDD-WRT | DD-WRT Stack-Based Buffer Overflow Vulnerability | 2026-07-16 | 5 d | 8.1 | 3 d | Unknown | |
| CVE-2026-58644 | MicrosoftSharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-07-14 | 2 d | 9.8 | 3 d | Unknown | |
| CVE-2026-39808 | FortinetFortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | 2026-04-14 | 93 d | 9.1 | 3 d | Unknown | |
| CVE-2026-25089 | FortinetFortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | 2026-06-09 | 37 d | 9.1 | 3 d | Unknown | |
| CVE-2026-46817 | OracleE-Business Suite | Oracle E-Business Suite Improper Privilege Management Vulnerability | 2026-05-28 | 48 d | 9.8 | 3 d | Unknown | |
| CVE-2023-4346 | KNX AssociationKNX Protocol Connection Authorization Option 1 | KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability | 2023-08-29 | 1051 d | 7.5 | 14 d | Unknown | |
| CVE-2026-56164 | MicrosoftSharePoint Server | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | 2026-07-14 | 0 d | 5.3 | 3 d | Unknown | |
| CVE-2026-56155 | MicrosoftActive Directory Federation Services | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | 2026-07-14 | 0 d | 7.8 | 14 d | Unknown | |
| CVE-2026-15410 | SonicWallSMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability | 2026-07-14 | 0 d | 7.2 | 3 d | Known | |
| CVE-2026-15409 | SonicWallSMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | 2026-07-14 | 0 d | 10.0 | 3 d | Known | |
| CVE-2008-4128 | CiscoIOS | Cisco IOS Cross-Site Request Forgery Vulnerability | 2008-09-18 | 6507 d | 8.1 | 3 d | Unknown | |
| CVE-2026-56291 | BalbooaForms | Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-07-09 | 1 d | 10.0 | 3 d | Unknown | |
| CVE-2026-48939 | iCagendaiCagenda | iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-06-20 | 20 d | 10.0 | 3 d | Unknown | |
| CVE-2026-56290 | JoomlackPage Builder | Joomlack Page Builder Improper Access Control Vulnerability | 2026-06-29 | 8 d | 10.0 | 3 d | Unknown | |
| CVE-2026-55255 | LangflowLangflow | Langflow Authorization Bypass Through User-Controlled Key Vulnerability | 2026-06-23 | 14 d | 8.4 | 3 d | Unknown | |
| CVE-2026-48908 | JoomShaperSP Page Builder | JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-06-20 | 17 d | 10.0 | 3 d | Unknown | |
| CVE-2026-48282 | AdobeColdFusion | Adobe ColdFusion Path Traversal Vulnerability | 2026-06-30 | 7 d | 10.0 | 3 d | Unknown | |
| CVE-2026-45659 | MicrosoftSharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | 2026-05-22 | 40 d | 8.8 | 3 d | Known | |
| CVE-2026-48558 | SimpleHelp SimpleHelp | SimpleHelp Authentication Bypass Vulnerability | 2026-06-12 | 17 d | 9.5 | 3 d | Unknown | |
| CVE-2026-20230 | CiscoUnified Communications Manager | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | 2026-06-03 | 22 d | 8.6 | 3 d | Unknown | |
| CVE-2026-12569 | PTCWindchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability | 2026-06-18 | 7 d | 9.3 | 3 d | Known | |
| CVE-2026-34910 | UbiquitiUniFi OS | Ubiquiti UniFi OS Improper Input Validation Vulnerability | 2026-05-22 | 32 d | 10.0 | 3 d | Unknown | |
| CVE-2026-34909 | UbiquitiUniFi OS | Ubiquiti UniFi OS Path Traversal Vulnerability | 2026-05-22 | 32 d | 10.0 | 3 d | Unknown | |
| CVE-2026-34908 | UbiquitiUniFi OS | Ubiquiti UniFi OS Improper Access Control Vulnerability | 2026-05-22 | 32 d | 10.0 | 3 d | Unknown | |
| CVE-2025-67038 | LantronixEDS5000 | Lantronix EDS5000 Code Injection Vulnerability | 2026-03-11 | 104 d | 9.8 | 3 d | Unknown | |
| CVE-2026-20253 | SplunkEnterprise | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | 2026-06-10 | 8 d | 9.8 | 3 d | Unknown | |
| CVE-2026-48907 | Widget FactoryJoomla Content Editor | Widget Factory Joomla Content Editor Improper Access Control Vulnerability | 2026-06-05 | 11 d | 10.0 | 3 d | Unknown | |
| CVE-2026-54420 | LiteSpeedcPanel Plugin | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | 2026-06-14 | 1 d | 8.5 | 3 d | Unknown | |
| CVE-2026-20262 | CiscoCatalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 2026-06-15 | 0 d | 6.5 | 14 d | Unknown | |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | 2026-06-11 | 1 d | 9.8 | 3 d | Known | |
| CVE-2026-10520 | IvantiSentry | Ivanti Sentry OS Command Injection Vulnerability | 2026-06-09 | 2 d | 10.0 | 3 d | Unknown | |
| CVE-2026-7473 | AristaExtensible Operating System | Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | 2026-06-05 | 4 d | 5.8 | 14 d | Unknown | |
| CVE-2026-20245 | CiscoCatalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | 2026-06-04 | 5 d | 7.8 | 14 d | Unknown | |
| CVE-2026-11645 | GoogleChromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2026-06-08 | 1 d | 8.8 | 14 d | Unknown | |
| CVE-2026-50751 | Check PointSecurity Gateway | Check Point Security Gateway Improper Authentication Vulnerability | 2026-06-08 | 0 d | 9.3 | 3 d | Known | |
| CVE-2026-42271 | BerriAILiteLLM | BerriAI LiteLLM Command Injection Vulnerability | 2026-05-08 | 31 d | 8.7 | 14 d | Unknown | |
| CVE-2026-28318 | SolarWindsServ-U | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | 2026-06-04 | 1 d | 7.5 | 14 d | Unknown | |
| CVE-2026-45247 | MirasvitMirasvit Full Page Cache Warmer | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | 2026-05-26 | 8 d | 9.3 | 3 d | Unknown | |
| CVE-2025-48595 | AndroidFramework | Android Framework Integer Overflow Vulnerability | 2026-06-01 | 1 d | 8.4 | 3 d | Unknown | |
| CVE-2022-0492 | LinuxKernel | Linux Kernel Improper Authentication Vulnerability | 2022-03-03 | 1552 d | 7.8 | 3 d | Unknown | |
| CVE-2024-21182 | OracleWebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2024-07-16 | 685 d | 7.5 | 3 d | Unknown | |
| CVE-2026-0257 | Palo Alto NetworksPAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 2026-05-13 | 16 d | 7.8 | 3 d | Known | |
| CVE-2026-8398 | DaemonDaemon Tools Lite | Daemon Tools Lite Embedded Malicious Code Vulnerability | 2026-05-15 | 12 d | 9.3 | 3 d | Unknown | |
| CVE-2026-48027 | NxNx Console | Nx Console Embedded Malicious Code Vulnerability | 2026-05-27 | 0 d | 9.3 | 14 d | Known | |
| CVE-2026-45321 | TanStackTanStack | TanStack Unspecified Vulnerability | 2026-05-12 | 15 d | 9.6 | 14 d | Known | |
| CVE-2026-48172 | LiteSpeedcPanel Plugin | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | 2026-05-21 | 5 d | 10.0 | 3 d | Unknown | |
| CVE-2026-9082 | DrupalCore | Drupal Core SQL Injection Vulnerability | 2026-05-20 | 2 d | 9.8 | 5 d | Unknown | |
| CVE-2026-34926 | Trend MicroApex One | Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | 2026-05-21 | 0 d | 6.7 | 14 d | Unknown | |
| CVE-2025-34291 | LangflowLangflow | Langflow Origin Validation Error Vulnerability | 2025-12-05 | 167 d | 9.4 | 14 d | Unknown | |
| CVE-2026-45498 | MicrosoftDefender | Microsoft Defender Denial of Service Vulnerability | 2026-05-20 | 0 d | 4.0 | 14 d | Unknown | |
| CVE-2026-41091 | MicrosoftDefender | Microsoft Defender Link Following Vulnerability | 2026-05-20 | 0 d | 7.8 | 14 d | Unknown | |
| CVE-2010-0806 | MicrosoftInternet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 2010-03-10 | 5915 d | 8.8 | 14 d | Unknown | |
| CVE-2010-0249 | MicrosoftInternet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 2010-01-15 | 5969 d | 8.8 | 14 d | Unknown | |
| CVE-2009-3459 | AdobeAcrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 2009-10-13 | 6063 d | 8.8 | 14 d | Unknown | |
| CVE-2009-1537 | MicrosoftDirectX | Microsoft DirectX NULL Byte Overwrite Vulnerability | 2009-05-29 | 6200 d | 8.8 | 14 d | Unknown | |
| CVE-2008-4250 | MicrosoftWindows | Microsoft Windows Buffer Overflow Vulnerability | 2008-10-23 | 6418 d | 9.8 | 14 d | Unknown | |
| CVE-2026-42897 | MicrosoftMicrosoft | Microsoft Exchange Server Cross-Site Scripting Vulnerability | 2026-05-14 | 1 d | 8.1 | 14 d | Unknown | |
| CVE-2026-20182 | CiscoCatalyst SD-WAN | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 2026-05-14 | 0 d | 10.0 | 3 d | Unknown | |
| CVE-2026-42208 | BerriAILiteLLM | BerriAI LiteLLM SQL Injection Vulnerability | 2026-05-08 | 0 d | 9.3 | 3 d | Unknown | |
| CVE-2026-6973 | IvantiEndpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | 2026-05-07 | 0 d | 7.2 | 3 d | Unknown | |
| CVE-2026-0300 | Palo Alto NetworksPAN-OS | Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | 2026-05-06 | 0 d | 9.3 | 3 d | Unknown | |
| CVE-2026-31431 | LinuxKernel | Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability | 2026-04-22 | 9 d | 7.8 | 14 d | Unknown | |
| CVE-2026-41940 | WebProscPanel & WHM and WP2 (WordPress Squared) | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | 2026-04-29 | 1 d | 9.3 | 3 d | Known | |
| CVE-2026-32202 | MicrosoftWindows | Microsoft Windows Protection Mechanism Failure Vulnerability | 2026-04-14 | 14 d | 4.3 | 14 d | Unknown | |
| CVE-2024-1708 | ConnectWiseScreenConnect | ConnectWise ScreenConnect Path Traversal Vulnerability | 2024-02-21 | 797 d | 8.4 | 14 d | Known | |
| CVE-2025-29635 | D-LinkDIR-823X | D-Link DIR-823X Command Injection Vulnerability | 2025-03-25 | 395 d | 7.2 | 14 d | Unknown | |
| CVE-2024-7399 | SamsungMagicINFO 9 Server | Samsung MagicINFO 9 Server Path Traversal Vulnerability | 2024-08-09 | 623 d | 8.8 | 14 d | Unknown | |
| CVE-2024-57728 | SimpleHelp SimpleHelp | SimpleHelp Path Traversal Vulnerability | 2025-01-15 | 464 d | 7.2 | 14 d | Known | |
| CVE-2024-57726 | SimpleHelp SimpleHelp | SimpleHelp Missing Authorization Vulnerability | 2025-01-15 | 464 d | 9.9 | 14 d | Known | |
| CVE-2026-39987 | MarimoMarimo | Marimo Remote Code Execution Vulnerability | 2026-04-09 | 14 d | 9.3 | 14 d | Unknown | |
| CVE-2026-33825 | MicrosoftDefender | Microsoft Defender Insufficient Granularity of Access Control Vulnerability | 2026-04-14 | 8 d | 7.8 | 14 d | Known | |
| CVE-2026-20133 | CiscoCatalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 2026-02-25 | 54 d | 6.5 | 3 d | Unknown | |
| CVE-2026-20128 | CiscoCatalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 2026-02-25 | 54 d | 7.5 | 3 d | Unknown | |
| CVE-2026-20122 | CiscoCatalyst SD-WAN Manger | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | 2026-02-25 | 54 d | 5.4 | 3 d | Unknown | |
| CVE-2025-48700 | SynacorZimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 2025-06-23 | 301 d | 6.1 | 3 d | Unknown | |
| CVE-2025-32975 | QuestKACE Systems Management Appliance (SMA) | Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability | 2025-06-24 | 300 d | 10.0 | 14 d | Unknown | |
| CVE-2025-2749 | KenticoKentico Xperience | Kentico Xperience Path Traversal Vulnerability | 2025-03-24 | 392 d | 7.2 | 14 d | Unknown | |
| CVE-2024-27199 | JetBrainsTeamCity | JetBrains TeamCity Relative Path Traversal Vulnerability | 2024-03-04 | 777 d | 7.3 | 14 d | Known | |
| CVE-2023-27351 | PaperCutNG/MF | PaperCut NG/MF Improper Authentication Vulnerability | 2023-04-20 | 1096 d | 8.2 | 14 d | Known | |
| CVE-2026-34197 | ApacheActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 2026-04-07 | 9 d | 8.8 | 14 d | Unknown | |
| CVE-2026-32201 | MicrosoftSharePoint Server | Microsoft SharePoint Server Improper Input Validation Vulnerability | 2026-04-14 | 0 d | 6.5 | 14 d | Unknown | |
| CVE-2009-0238 | MicrosoftOffice | Microsoft Office Remote Code Execution | 2009-02-25 | 6257 d | 8.8 | 14 d | Unknown | |
| CVE-2026-34621 | AdobeAcrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | 2026-04-11 | 2 d | 8.6 | 14 d | Unknown | |
| CVE-2026-21643 | FortinetFortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability | 2026-02-06 | 66 d | 9.1 | 3 d | Unknown | |
| CVE-2025-60710 | MicrosoftWindows | Microsoft Windows Link Following Vulnerability | 2025-11-11 | 153 d | 7.8 | 14 d | Known | |
| CVE-2023-36424 | MicrosoftWindows | Microsoft Windows Out-of-Bounds Read Vulnerability | 2023-11-14 | 881 d | 7.8 | 14 d | Unknown | |
| CVE-2023-21529 | MicrosoftExchange Server | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability | 2023-02-14 | 1154 d | 8.8 | 14 d | Known | |
| CVE-2020-9715 | AdobeAcrobat | Adobe Acrobat Use-After-Free Vulnerability | 2020-08-19 | 2063 d | 7.8 | 14 d | Unknown | |
| CVE-2012-1854 | MicrosoftVisual Basic for Applications (VBA) | Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | 2012-07-10 | 5025 d | 7.8 | 14 d | Unknown | |
| CVE-2026-1340 | IvantiEndpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2026-01-29 | 69 d | 9.8 | 3 d | Unknown | |
| CVE-2026-35616 | FortinetFortiClient EMS | Fortinet FortiClient EMS Improper Access Control Vulnerability | 2026-04-04 | 2 d | 9.1 | 3 d | Unknown | |
| CVE-2026-3502 | TrueConfClient | TrueConf Client Download of Code Without Integrity Check Vulnerability | 2026-03-30 | 3 d | 7.8 | 14 d | Unknown | |
| CVE-2026-5281 | GoogleDawn | Google Dawn Use-After-Free Vulnerability | 2026-04-01 | 0 d | 8.8 | 14 d | Unknown | |
| CVE-2026-3055 | CitrixNetScaler | Citrix NetScaler Out-of-Bounds Read Vulnerability | 2026-03-23 | 7 d | 9.3 | 3 d | Unknown | |
| CVE-2025-53521 | F5BIG-IP | F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | 2025-10-15 | 163 d | 9.8 | 3 d | Unknown | |
| CVE-2026-33634 | AquasecurityTrivy | Aquasecurity Trivy Embedded Malicious Code Vulnerability | 2026-03-23 | 3 d | 9.4 | 14 d | Unknown | |
| CVE-2026-33017 | LangflowLangflow | Langflow Code Injection Vulnerability | 2026-03-20 | 5 d | 9.3 | 14 d | Unknown | |
| CVE-2025-54068 | LaravelLivewire | Laravel Livewire Code Injection Vulnerability | 2025-07-17 | 246 d | 9.2 | 14 d | Unknown | |
| CVE-2025-43520 | AppleMultiple Products | Apple Multiple Products Classic Buffer Overflow Vulnerability | 2025-12-12 | 98 d | 5.5 | 14 d | Unknown | |
| CVE-2025-43510 | AppleMultiple Products | Apple Multiple Products Improper Locking Vulnerability | 2025-12-12 | 98 d | 7.8 | 14 d | Unknown | |
| CVE-2025-32432 | Craft CMSCraft CMS | Craft CMS Code Injection Vulnerability | 2025-04-25 | 329 d | 10.0 | 14 d | Unknown | |
| CVE-2025-31277 | AppleMultiple Products | Apple Multiple Products Buffer Overflow Vulnerability | 2025-07-29 | 234 d | 8.8 | 14 d | Unknown | |
| CVE-2026-20131 | CiscoSecure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | 2026-03-04 | 15 d | 10.0 | 3 d | Known | |
| CVE-2026-20963 | MicrosoftSharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-01-13 | 64 d | 9.8 | 3 d | Unknown | |
| CVE-2025-66376 | SynacorZimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | 2026-01-05 | 72 d | 7.2 | 14 d | Unknown | |
| CVE-2025-47813 | Wing FTP ServerWing FTP Server | Wing FTP Server Information Disclosure Vulnerability | 2025-07-10 | 249 d | 4.3 | 14 d | Unknown | |
| CVE-2026-3910 | GoogleChromium V8 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | 2026-03-12 | 1 d | 8.8 | 14 d | Unknown | |
| CVE-2026-3909 | GoogleSkia | Google Skia Out-of-Bounds Write Vulnerability | 2026-03-12 | 1 d | 8.8 | 14 d | Unknown | |
| CVE-2025-68613 | n8nn8n | n8n Improper Control of Dynamically-Managed Code Resources Vulnerability | 2025-12-19 | 82 d | 10.0 | 14 d | Unknown | |
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | 2026-02-10 | 27 d | 8.6 | 14 d | Unknown | |
| CVE-2025-26399 | SolarWindsWeb Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 2025-09-23 | 167 d | 9.8 | 3 d | Known | |
| CVE-2021-22054 | OmnissaWorkspace One UEM | Omnissa Workspace ONE Server-Side Request Forgery | 2021-12-17 | 1543 d | 7.5 | 14 d | Unknown | |
| CVE-2023-43000 | AppleMultiple Products | Apple Multiple products Use-After-Free Vulnerability | 2025-11-05 | 120 d | 8.8 | 21 d | Unknown | |
| CVE-2023-41974 | AppleiOS and iPadOS | Apple iOS and iPadOS Use-After-Free Vulnerability | 2024-01-10 | 785 d | 7.8 | 21 d | Unknown | |
| CVE-2021-30952 | AppleMultiple Products | Apple Multiple Products Integer Overflow or Wraparound Vulnerability | 2021-08-24 | 1654 d | 8.8 | 21 d | Unknown | |
| CVE-2021-22681 | RockwellMultiple Products | Rockwell Multiple Products Insufficient Protected Credentials Vulnerability | 2021-03-03 | 1828 d | 9.8 | 21 d | Unknown | |
| CVE-2017-7921 | HikvisionMultiple Products | Hikvision Multiple Products Improper Authentication Vulnerability | 2017-05-06 | 3225 d | 9.8 | 21 d | Unknown | |
| CVE-2026-22719 | BroadcomVMware Aria Operations | Broadcom VMware Aria Operations Command Injection Vulnerability | 2026-02-25 | 6 d | 8.1 | 21 d | Unknown | |
| CVE-2026-21385 | QualcommMultiple Chipsets | Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 2026-03-02 | 1 d | 7.8 | 21 d | Unknown | |
| CVE-2026-20127 | CiscoCatalyst SD-WAN Controller and Manager | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 2026-02-25 | 0 d | 10.0 | 2 d | Unknown | |
| CVE-2022-20775 | CiscoSD-WAN | Cisco SD-WAN Path Traversal Vulnerability | 2022-09-30 | 1244 d | 7.8 | 2 d | Unknown | |
| CVE-2026-25108 | Soliton Systems K.KFileZen | Soliton Systems K.K FileZen OS Command Injection Vulnerability | 2026-02-13 | 11 d | 8.8 | 21 d | Unknown | |
| CVE-2025-68461 | RoundcubeWebmail | RoundCube Webmail Cross-site Scripting Vulnerability | 2025-12-18 | 64 d | 7.2 | 21 d | Unknown | |
| CVE-2025-49113 | RoundcubeWebmail | RoundCube Webmail Deserialization of Untrusted Data Vulnerability | 2025-06-02 | 263 d | 9.9 | 21 d | Unknown | |
| CVE-2026-22769 | DellRecoverPoint for Virtual Machines (RP4VMs) | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability | 2026-02-17 | 1 d | 10.0 | 3 d | Unknown | |
| CVE-2021-22175 | GitLabGitLab | GitLab Server-Side Request Forgery (SSRF) Vulnerability | 2021-06-11 | 1713 d | 6.8 | 21 d | Unknown | |
| CVE-2026-2441 | GoogleChromium | Google Chromium CSS Use-After-Free Vulnerability | 2026-02-13 | 4 d | 8.8 | 21 d | Unknown | |
| CVE-2024-7694 | TeamT5ThreatSonar Anti-Ransomware | TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability | 2024-08-12 | 554 d | 7.2 | 21 d | Unknown | |
| CVE-2020-7796 | SynacorZimbra Collaboration Suite | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | 2020-02-18 | 2191 d | 9.8 | 21 d | Unknown | |
| CVE-2008-0015 | MicrosoftWindows | Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | 2009-07-07 | 6069 d | 8.8 | 21 d | Unknown | |
| CVE-2026-1731 | BeyondTrustRemote Support (RS) and Privileged Remote Access (PRA) | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability | 2026-02-06 | 7 d | 9.9 | 3 d | Known | |
| CVE-2026-20700 | AppleMultiple Products | Apple Multiple Buffer Overflow Vulnerability | 2026-02-11 | 1 d | 7.8 | 21 d | Unknown | |
| CVE-2025-40536 | SolarWindsWeb Help Desk | SolarWinds Web Help Desk Security Control Bypass Vulnerability | 2026-01-28 | 15 d | 8.1 | 3 d | Unknown | |
| CVE-2025-15556 | Notepad++Notepad++ | Notepad++ Download of Code Without Integrity Check Vulnerability | 2026-02-03 | 9 d | 7.7 | 21 d | Unknown | |
| CVE-2024-43468 | MicrosoftConfiguration Manager | Microsoft Configuration Manager SQL Injection Vulnerability | 2024-10-08 | 492 d | 9.8 | 21 d | Unknown | |
| CVE-2026-21533 | MicrosoftWindows | Microsoft Windows Improper Privilege Management Vulnerability | 2026-02-10 | 0 d | 7.8 | 21 d | Unknown | |
| CVE-2026-21525 | MicrosoftWindows | Microsoft Windows NULL Pointer Dereference Vulnerability | 2026-02-10 | 0 d | 6.2 | 21 d | Unknown | |
| CVE-2026-21519 | MicrosoftWindows | Microsoft Windows Type Confusion Vulnerability | 2026-02-10 | 0 d | 7.8 | 21 d | Unknown | |
| CVE-2026-21514 | MicrosoftOffice | Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | 2026-02-10 | 0 d | 7.8 | 21 d | Unknown | |
| CVE-2026-21513 | MicrosoftWindows | Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | 2026-02-10 | 0 d | 8.8 | 21 d | Unknown | |
| CVE-2026-21510 | MicrosoftWindows | Microsoft Windows Shell Protection Mechanism Failure Vulnerability | 2026-02-10 | 0 d | 8.8 | 21 d | Unknown | |
| CVE-2026-24423 | SmarterToolsSmarterMail | SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability | 2026-01-23 | 13 d | 9.3 | 21 d | Known | |
| CVE-2025-11953 | React Native CommunityCLI | React Native Community CLI OS Command Injection Vulnerability | 2025-11-03 | 94 d | 9.8 | 21 d | Unknown | |
| CVE-2025-64328 | SangomaFreePBX | Sangoma FreePBX OS Command Injection Vulnerability | 2025-11-07 | 88 d | 8.6 | 21 d | Unknown | |
| CVE-2025-40551 | SolarWindsWeb Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 2026-01-28 | 6 d | 9.8 | 3 d | Unknown | |
| CVE-2021-39935 | GitLabCommunity and Enterprise Editions | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability | 2021-12-13 | 1513 d | 6.8 | 21 d | Unknown | |
| CVE-2019-19006 | SangomaFreePBX | Sangoma FreePBX Improper Authentication Vulnerability | 2019-11-21 | 2266 d | 9.8 | 21 d | Unknown | |
| CVE-2026-1281 | IvantiEndpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2026-01-29 | 0 d | 9.8 | 3 d | Unknown | |
| CVE-2026-24858 | FortinetMultiple Products | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-01-27 | 0 d | 9.4 | 3 d | Unknown | |
| CVE-2026-24061 | GNUInetUtils | GNU InetUtils Argument Injection Vulnerability | 2026-01-21 | 5 d | 9.8 | 21 d | Unknown | |
| CVE-2026-23760 | SmarterToolsSmarterMail | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-01-22 | 4 d | 9.3 | 21 d | Known | |
| CVE-2026-21509 | MicrosoftOffice | Microsoft Office Security Feature Bypass Vulnerability | 2026-01-26 | 0 d | 7.8 | 21 d | Unknown | |
| CVE-2025-52691 | SmarterToolsSmarterMail | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability | 2025-12-29 | 28 d | 10.0 | 21 d | Known | |
| CVE-2018-14634 | LinuxKernel | Linux Kernel Integer Overflow Vulnerability | 2018-09-25 | 2680 d | 7.8 | 21 d | Unknown | |
| CVE-2024-37079 | BroadcomVMware vCenter Server | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 2024-06-18 | 584 d | 9.8 | 21 d | Unknown | |
| CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 2025-12-22 | 31 d | 8.8 | 21 d | Unknown | |
| CVE-2025-54313 | Prettiereslint-config-prettier | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 2025-07-19 | 187 d | 7.5 | 21 d | Unknown | |
| CVE-2025-34026 | VersaConcerto | Versa Concerto Improper Authentication Vulnerability | 2025-05-21 | 246 d | 9.2 | 21 d | Unknown | |
| CVE-2025-31125 | ViteVitejs | Vite Vitejs Improper Access Control Vulnerability | 2025-03-31 | 297 d | 5.3 | 21 d | Unknown | |
| CVE-2026-20045 | CiscoUnified Communications Manager | Cisco Unified Communications Products Code Injection Vulnerability | 2026-01-21 | 0 d | 8.2 | 21 d | Unknown | |
| CVE-2026-20805 | MicrosoftWindows | Microsoft Windows Information Disclosure Vulnerability | 2026-01-13 | 0 d | 5.5 | 21 d | Unknown | |
| CVE-2025-8110 | GogsGogs | Gogs Path Traversal Vulnerability | 2025-12-10 | 33 d | 8.7 | 21 d | Unknown | |
| CVE-2025-37164 | Hewlett Packard Enterprise (HPE)OneView | Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 2025-12-16 | 22 d | 10.0 | 21 d | Unknown | |
| CVE-2009-0556 | MicrosoftOffice | Microsoft Office PowerPoint Code Injection Vulnerability | 2009-04-03 | 6123 d | 8.8 | 21 d | Unknown |
Confirmation lag = date added to the KEV catalog minus the publication date of the CVE record (calendar days; a negative value means CISA listed it before the CVE record was published). CVSS = base score given by the CVE Numbering Authority, or by CISA when the authority gives none. Fix window = federal remediation due date minus date added. "Unknown" ransomware use means CISA has not confirmed it, not that it was ruled out. Sources: CISA KEV catalog; CVE Program records.