$ kev-tracker
Known Exploited Vulnerabilities Tracker
Every CVE on CISA's live Known Exploited Vulnerabilities catalog, synced directly — not just the ones we've written full articles about — plus other confirmed actively-exploited vulnerabilities. CVSS is NVD's score; EPSS is FIRST.org's modeled 30-day exploitation probability. Filter and sort client-side — nothing leaves your browser.
Showing 100 newest of 1762
| CVE ID | Severity | Vendor / Product | CVSS | EPSS | Status | Patch by | Published | Source |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-0322 | [ HIGH ] | Palo Alto Networks / PAN-OS | — | — | kev | Oct 17 | Oct 14 | [src] |
| CVE-2026-76519 | [ CRITICAL ] | Cisco / Secure Email Gateway | 9.8 | — | kev | Oct 17 | Oct 14 | [src] |
| CVE-2026-104935 | [ HIGH ] | Ivanti / Connect Secure + Patch & Defense: "Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure." | 8.6 | 26.0% | kev | Oct 16 | Oct 13 | [src] |
| CVE-2026-96951 | [ HIGH ] | Microsoft / Windows | 8.8 | 1.5% | kev | Oct 16 | Oct 13 | [src] |
| CVE-2026-85097 | [ CRITICAL ] | Bricksforge / Bricksforge plugin for WordPress (through 3.1.8.9) ~ Analysis: "CVE-2026-85097 is a CVSS 9.8 unauthenticated file upload flaw in Bricksforge for WordPress (versions through 3.1.8.9) enabling remote code execution." | 9.8 | 0.3% | exploited-in-wild | — | Oct 12 | [src] |
| CVE-2026-102255 | [ CRITICAL ] | SonicWall / SMA1000 ~ Analysis: "Critical (CVSS 10.0) remote vulnerability in SonicWall SMA1000 appliances." | 10.0 | 0.5% | exploited-in-wild | — | Oct 10 | [src] |
| CVE-2015-3306 | [ CRITICAL ] | ProFTPD / ProFTPD | 10.0 | 99.5% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2015-5477 | [ HIGH ] | ISC / BIND | 7.8 | 99.4% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2016-3081 | [ HIGH ] | Apache / Struts | 8.1 | 96.1% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2021-3199 | [ CRITICAL ] | ONLYOFFICE / Docs | 9.8 | 19.4% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2023-22894 | [ MEDIUM ] | Strapi / Strapi | 4.9 | 3.6% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2026-21589 | [ CRITICAL ] | Atlassian / Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye Data Center ! Breaking: "CVSS 9.3 path traversal lets unauthenticated attackers read files from eight Atlassian Data Center products' web root directories." | 9.3 | 2.8% | exploited-in-wild | — | Oct 6 | [src] |
| CVE-2026-61500 | [ CRITICAL ] | Rejetto / HTTP File Server (HFS) ~ Analysis: "Weak session-signing key in Rejetto HFS lets attackers forge admin sessions and execute code remotely." | 9.3 | 1.0% | exploited-in-wild | — | Oct 5 | [src] |
| CVE-2026-105133 | [ HIGH ] | Ahsay Systems / AhsayCBS + Patch & Defense: "AhsayCBS OS command injection via manipulated function arguments allows SYSTEM-level code execution." | 7.3 | 0.4% | kev | Oct 17 | Oct 4 | [src] |
| CVE-2026-105134 | [ CRITICAL ] | Ahsay Systems / AhsayCBS + Patch & Defense: "Unauthenticated attackers can substitute a random token for valid credentials in AhsayCBS, gaining full console access." | 10.0 | 1.8% | kev | Oct 17 | Oct 4 | [src] |
| CVE-2026-88779 | [ HIGH ] | Citrix / NetScaler ADC, NetScaler Gateway + Patch & Defense: "NetScaler ADC and Gateway contain an exploited memory-buffer flaw enabling denial of service." | 7.5 | 0.6% | kev | Oct 7 | Oct 4 | [src] |
| CVE-2026-102489 | [ HIGH ] | Zammad GmbH / Zammad | — | 1.3% | kev | Oct 5 | Oct 2 | [src] |
| CVE-2026-102490 | [ HIGH ] | Zammad GmbH / Zammad | — | 0.5% | kev | Oct 5 | Oct 2 | [src] |
| CVE-2026-104286 | [ CRITICAL ] | Fortinet / FortiMail + Patch & Defense: "Fortinet FortiMail path traversal flaw (CVSS 9.8) lets unauthenticated attackers write arbitrary files." | 9.8 | 2.2% | kev | Oct 4 | Oct 1 | [src] |
| CVE-2026-76504 | [ CRITICAL ] | Cisco / Catalyst SD-WAN Manager + Patch & Defense: "Unauthenticated attackers can gain admin access to Cisco Catalyst SD-WAN Manager via a URI encoding flaw." | 9.8 | 1.8% | kev | Oct 3 | Sep 30 | [src] |
| CVE-2026-86950 | [ HIGH ] | Apple / iOS 26, iPadOS, macOS 26, macOS 15 ! Breaking: "CoreGraphics memory confusion flaw in Apple iOS 26, iPadOS, macOS 26, and macOS 15." | 8.8 | 1.2% | kev | Oct 13 | Sep 28 | [src] |
| CVE-2026-88771 | [ HIGH ] | Citrix / NetScaler ADC, NetScaler Gateway + Patch & Defense: "Citrix NetScaler ADC and Gateway improper input validation flaw allows unauthenticated remote code execution; actively exploited and CISA KEV listed." | — | 1.1% | kev | Sep 30 | Sep 27 | [src] |
| CVE-2026-88772 | [ HIGH ] | Citrix / NetScaler ADC, NetScaler Gateway + Patch & Defense: "Citrix NetScaler ADC and Gateway memory buffer flaw allows remote code execution or denial of service; actively exploited and CISA KEV listed." | — | 1.3% | kev | Sep 30 | Sep 27 | [src] |
| CVE-2026-65660 | [ HIGH ] | Microsoft / SharePoint + Patch & Defense: "A code injection flaw in Microsoft Office SharePoint lets an authorized attacker execute code over a network." | 8.8 | 2.1% | kev | Sep 28 | Sep 25 | [src] |
| CVE-2026-67279 | [ MEDIUM ] | MikroTik / RouterOS ~ Analysis: "Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request." | 6.5 | 1.0% | kev | Sep 28 | Sep 25 | [src] |
| CVE-2026-48842 | [ HIGH ] | Roundcube / Roundcube Webmail (before 1.6.16 / 1.7.1) + Patch & Defense: "Pre-authentication SQL injection in Roundcube's virtuser_query plugin lets unauthenticated attackers bypass login and read or alter the webmail database." | 8.1 | 0.9% | exploited-in-wild | — | Sep 24 | [src] |
| CVE-2026-5430 | [ CRITICAL ] | WSO2 / API Control Plane, API Manager, Traffic Manager, Universal Gateway + Patch & Defense: "WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway contain a path traversal flaw enabling unauthenticated file upload and remote code execution." | 10.0 | 0.6% | kev | Sep 27 | Sep 24 | [src] |
| CVE-2026-32996 | [ HIGH ] | Veeam / Veeam Agent for Microsoft Windows + Patch & Defense: "Local privilege escalation in Veeam Agent for Microsoft Windows gives local attackers SYSTEM-level access." | 7.3 | 0.2% | exploited-in-wild | — | Sep 22 | [src] |
| CVE-2026-87902 | [ HIGH ] | WordPress / WordPress Core ! Breaking: "Path traversal in WordPress core's get_page_template() enables unauthenticated local PHP file inclusion and conditional RCE." | 8.1 | 40.0% | kev | Sep 28 | Sep 22 | [src] |
| CVE-2026-93616 | [ CRITICAL ] | Check Point / Security Management Server, Multi-Domain Management Server, Log Server, SmartEvent ~ Analysis: "CVE-2026-93616: CVSS 9.8 path traversal and file upload in Check Point Management Server enabling unauth RCE." | 9.8 | 19.7% | kev | Sep 25 | Sep 22 | [src] |
| CVE-2026-93952 | [ CRITICAL ] | Arista / VeloCloud Orchestrator ~ Analysis: "“CVE-2026-93952 is a CVSS 10.0 improper input validation flaw in Arista VeloCloud Orchestrator that allows unauthenticated remote code execution." | 10.0 | 1.1% | kev | Sep 25 | Sep 22 | [src] |
| CVE-2026-94127 | [ CRITICAL ] | F5 / BIG-IP APM ~ Analysis: "CVSS 9.8 F5 BIG-IP APM heap overflow: unauth RCE when an access policy and OAuth profile share a virtual server." | 9.8 | 2.2% | kev | Sep 25 | Sep 22 | [src] |
| CVE-2026-7273 | [ HIGH ] | Zyxel / GS1900 Series Switches + Patch & Defense: "Stack-based buffer overflow in Zyxel GS1900 CGI program lets unauthenticated LAN attackers execute OS commands." | 8.8 | 2.5% | kev | Sep 24 | Sep 21 | [src] |
| CVE-2025-39682 | [ CRITICAL ] | Linux / Kernel + Patch & Defense: "Linux kernel TLS receive path: zero-length record bypasses recvmsg() handling, corrupting downstream TLS processing." | 9.8 | 2.9% | kev | Sep 21 | Sep 18 | [src] |
| CVE-2025-39964 | [ HIGH ] | Linux / Kernel + Patch & Defense: "Linux kernel AF_ALG race condition: concurrent writes corrupt state, crashing the system or corrupting cryptographic output." | 7.8 | 1.3% | kev | Sep 21 | Sep 18 | [src] |
| CVE-2026-53266 | [ HIGH ] | Linux / Kernel + Patch & Defense: "OOB write in Linux kernel ebtables SNAT target." | 8.8 | 0.8% | kev | Sep 21 | Sep 18 | [src] |
| CVE-2026-58138 | [ CRITICAL ] | Orkes / Orkes Conductor ~ Analysis: "Unauthenticated RCE in Orkes Conductor via crafted inline workflow definitions." | 9.8 | 14.7% | exploited-in-wild | — | Sep 18 | [src] |
| CVE-2026-58704 | [ HIGH ] | Google / Pixel + Patch & Defense: "Improper authorization in Google Pixel's cellular modem lets a nearby attacker bypass permission checks and escalate privileges without user interaction." | 8.8 | 0.6% | kev | Sep 19 | Sep 16 | [src] |
| CVE-2026-76460 | [ CRITICAL ] | Cisco / Identity Services Engine ~ Analysis: "CVSS 10.0 auth bypass in Cisco ISE and ISE-PIC." | 10.0 | 14.0% | kev | Sep 19 | Sep 16 | [src] |
| CVE-2026-87886 | [ HIGH ] | Acronis / Backup | 7.8 | 0.2% | kev | Sep 19 | Sep 16 | [src] |
| CVE-2026-76461 | [ CRITICAL ] | Cisco / Secure Email Gateway ~ Analysis: "SQL injection in Cisco AsyncOS for Secure Email Gateway lets an unauthenticated remote attacker execute arbitrary OS commands with root privileges." | 9.8 | 29.5% | kev | Sep 17 | Sep 14 | [src] |
| CVE-2026-42016 | [ HIGH ] | JFrog / Artifactory + Patch & Defense: "JFrog Artifactory validates token signature and issuer but not scope, creating a privilege escalation path." | 8.1 | 8.6% | kev | Sep 25 | Sep 11 | [src] |
| CVE-2026-42018 | [ HIGH ] | JFrog / Artifactory ? Vulnerability Watch: "JFrog Artifactory returns an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled, allowing unauthorized resource access and enabling privilege escalation chains." | 7.5 | 9.8% | kev | Sep 25 | Sep 11 | [src] |
| CVE-2026-84869 | [ CRITICAL ] | ConnectWise / ScreenConnect + Patch & Defense: "ConnectWise ScreenConnect allows file transfer and execution through active remote sessions without authorization." | 9.9 | 0.9% | kev | Sep 14 | Sep 11 | [src] |
| CVE-2026-85706 | [ CRITICAL ] | GitLab / GitLab CE/EE ? Vulnerability Watch: "GitLab CE/EE contains a path traversal flaw due to improper path confinement and missing access controls, allowing an unauthenticated attacker to read arbitrary files from the server." | 10.0 | 93.0% | kev | Sep 14 | Sep 11 | [src] |
| CVE-2026-67277 | [ HIGH ] | MikroTik / RouterOS + Patch & Defense: "MikroTik RouterOS btest service missing authentication allows kernel memory disclosure." | 8.2 | 1.6% | kev | Sep 13 | Sep 10 | [src] |
| CVE-2026-85102 | [ CRITICAL ] | Check Point / Check Point firewall and management products + Patch & Defense: "CVSS 9.8 critical: unauthenticated RCE via VPN certificate handling in Check Point firewall and management products." | 9.8 | 7.5% | kev | Sep 25 | Sep 10 | [src] |
| CVE-2026-86060 | [ CRITICAL ] | MikroTik / RouterOS + Patch & Defense: "MikroTik RouterOS SSH login path argument flaw allows unauthenticated privilege escalation." | 9.8 | 6.4% | kev | Sep 13 | Sep 10 | [src] |
| CVE-2025-25249 | [ HIGH ] | Fortinet / FortiOS, FortiSwitchManager, FortiSASE + Patch & Defense: "CVSS 8.1 heap overflow in FortiOS, FortiSwitchManager, and FortiSASE allows code execution via crafted packets." | 8.1 | 3.8% | kev | Sep 12 | Sep 9 | [src] |
| CVE-2026-20079 | [ CRITICAL ] | Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management + Patch & Defense: "CVE-2026-20079 is a CVSS 10.0 unauthenticated auth bypass in Cisco FMC with root OS access." | 10.0 | 88.2% | kev | Sep 12 | Sep 9 | [src] |
| CVE-2026-87491 | [ HIGH ] | Google / Chromium V8 | 8.8 | 3.1% | kev | Sep 23 | Sep 9 | [src] |
| CVE-2026-75650 | [ CRITICAL ] | Adobe / Commerce and Magento Open Source ? Vulnerability Watch: "CVSS 10.0 template-injection in Adobe Commerce and Magento Open Source." | 10.0 | 3.9% | kev | Sep 11 | Sep 8 | [src] |
| CVE-2026-81963 | [ HIGH ] | Microsoft / Windows ? Vulnerability Watch: "“Windows Update Stack link-following flaw lets a local attacker escalate to SYSTEM." | 7.8 | 0.4% | kev | Sep 22 | Sep 8 | [src] |
| CVE-2026-85880 | [ HIGH ] | Microsoft / Windows ? Vulnerability Watch: "Windows ALPC contains a heap buffer overflow allowing AppContainer sandbox escape to local privilege escalation." | 7.8 | 3.6% | kev | Sep 22 | Sep 8 | [src] |
| CVE-2026-86218 | [ CRITICAL ] | N-able / N-central ? Vulnerability Watch: "Pre-authentication remote code execution in N-able N-central via static code injection." | 10.0 | 14.5% | kev | Sep 11 | Sep 6 | [src] |
| CVE-2026-85046 | [ HIGH ] | Google / Chrome (before 152.0.7977.82) + Patch & Defense: "Type confusion in Chrome's V8 engine lets remote attackers run arbitrary code inside the browser sandbox via a crafted HTML page." | 8.8 | 48.9% | kev | Sep 18 | Sep 4 | [src] |
| CVE-2026-0768 | [ CRITICAL ] | Langflow / Langflow ~ Analysis: "An unauthenticated remote code execution flaw in Langflow allows attackers to run arbitrary Python code on exposed instances, enabling theft of AI API keys and cloud credentials." | 9.8 | 23.2% | exploited-in-wild | — | Sep 2 | [src] |
| CVE-2026-48710 | [ MEDIUM ] | Kludex / Starlette | 6.5 | 7.1% | kev | Sep 16 | Sep 2 | [src] |
| CVE-2026-49869 | [ CRITICAL ] | Kestra / Kestra OSS | 10.0 | 2.1% | kev | Sep 5 | Sep 2 | [src] |
| CVE-2026-59822 | [ HIGH ] | BerriAI / LiteLLM | 8.2 | 0.8% | kev | Sep 16 | Sep 2 | [src] |
| CVE-2026-9586 | [ HIGH ] | Sangoma / Switchvox | — | 19.0% | kev | Sep 5 | Sep 2 | [src] |
| CVE-2026-83548 | [ HIGH ] | SonicWall / SMA1000 ! Breaking: "Unauthenticated SSRF in the SMA1000 Workplace interface allows remote attackers to reach internal functionality via an unintended access path." | — | 8.0% | kev | Sep 5 | Sep 1 | [src] |
| CVE-2026-83549 | [ HIGH ] | SonicWall / SMA1000 Appliance Management Console ! Breaking: "Post-auth OS command injection in the SonicWall SMA1000 AMC allows an authenticated administrator to execute arbitrary OS commands." | 7.8 | 9.9% | kev | Sep 5 | Sep 1 | [src] |
| CVE-2026-81578 | [ CRITICAL ] | PaperCut Software / PaperCut NG and PaperCut MF (versions 24, 25, 26) + Patch & Defense: "Authentication bypass in PaperCut NG/MF (CVSS 9.8, Critical) lets unauthenticated attackers access admin functions via malformed requests." | 9.8 | 85.6% | kev | Sep 14 | Aug 28 | [src] |
| CVE-2026-82078 | [ CRITICAL ] | PaperCut Software / PaperCut NG and PaperCut MF (versions 24, 25, 26) + Patch & Defense: "PaperCut NG/MF (CVSS 9.4 Critical): unsafe dynamic class-loading enables unauthenticated RCE." | 9.1 | 63.5% | kev | Sep 14 | Aug 28 | [src] |
| CVE-2026-82329 | [ CRITICAL ] | JFrog / Artifactory ~ Analysis: "JFrog Artifactory has an authentication flaw that lets unauthenticated network attackers gain admin rights under the software's default configuration." | 9.8 | 14.1% | kev | Sep 5 | Aug 28 | [src] |
| CVE-2023-49105 | [ CRITICAL ] | ownCloud / ownCloud | 9.8 | 42.9% | kev | Aug 30 | Aug 27 | [src] |
| CVE-2026-53362 | [ HIGH ] | Linux / Kernel | 7.8 | 0.7% | kev | Aug 30 | Aug 27 | [src] |
| CVE-2026-66384 | [ MEDIUM ] | JFrog / Artifactory | 5.3 | 0.7% | kev | Sep 10 | Aug 27 | [src] |
| CVE-2026-8452 | [ CRITICAL ] | Citrix / NetScaler ADC and NetScaler Gateway + Patch & Defense: "CVE-2026-8452 is a CVSS 9.8 critical memory buffer overflow in Citrix NetScaler ADC and NetScaler Gateway affecting appliances configured as Gateway or AAA virtual server, confirmed exploited in the wild and added to CISA KEV on August 26, 2026." | 9.8 | 1.0% | kev | Aug 29 | Aug 27 | [src] |
| CVE-2015-3246 | [ HIGH ] | Red Hat / Libuser | 7.2 | 8.5% | kev | Sep 9 | Aug 26 | [src] |
| CVE-2015-5287 | [ MEDIUM ] | Red Hat / Automatic Bug Reporting Tool | 6.9 | 5.0% | kev | Sep 9 | Aug 26 | [src] |
| CVE-2019-1068 | [ HIGH ] | Microsoft / SQL Server | 8.8 | 57.3% | kev | Aug 29 | Aug 26 | [src] |
| CVE-2021-23758 | [ HIGH ] | Ajax.NET Professional / Ajax.NET Professional | 8.1 | 82.6% | kev | Sep 9 | Aug 26 | [src] |
| CVE-2022-0995 | [ HIGH ] | Linux / Kernel | 7.8 | 8.9% | kev | Aug 29 | Aug 26 | [src] |
| CVE-2026-15981 | [ CRITICAL ] | Xecurify / miniOrange SAML 2.0 Single Sign On ! Breaking: "Critical auth bypass in miniOrange SAML 2.0 SSO for WordPress lets unauthenticated attackers sign in as any user including admins." | 9.8 | 1.9% | exploited-in-wild | — | Aug 25 | [src] |
| CVE-2026-21962 | [ CRITICAL ] | Oracle / WebLogic Server / HTTP Server ! Breaking: "Unauthenticated HTTP access exposes critical data on Oracle HTTP Server and WebLogic Server." | 10.0 | 73.2% | kev | Aug 27 | Aug 25 | [src] |
| CVE-2026-60004 | [ CRITICAL ] | Gitea / Gitea | 9.8 | 24.0% | kev | Aug 28 | Aug 25 | [src] |
| CVE-2026-61979 | [ HIGH ] | Xecurify / miniOrange SAML 2.0 Single Sign On ! Breaking: "High-severity auth bypass in miniOrange SAML 2.0 SSO for WordPress; being exploited alongside critical CVE-2026-15981 in active attack campaigns." | 8.1 | 0.4% | exploited-in-wild | — | Aug 25 | [src] |
| CVE-2026-69836 | [ CRITICAL ] | Microsoft / Entra ID (formerly Azure Active Directory) + Patch & Defense: "Deserialization flaw in Microsoft Entra ID allows unauthenticated remote code execution over a network." | 10.0 | 1.5% | kev | — | Aug 21 | [src] |
| CVE-2026-73570 | [ HIGH ] | Synacor / Zimbra Collaboration Suite (ZCS) ! Breaking: "CVE-2026-73570 — CVSS 8.9 command injection in Zimbra Collaboration Suite's SNMP handler enables unauthenticated remote code execution." | 8.9 | 71.7% | kev | Aug 24 | Aug 21 | [src] |
| CVE-2026-72529 | [ CRITICAL ] | TrueConf / Server | 9.8 | 1.5% | kev | Aug 23 | Aug 20 | [src] |
| CVE-2026-72530 | [ CRITICAL ] | TrueConf / Server | 9.0 | 1.7% | kev | Sep 3 | Aug 20 | [src] |
| CVE-2026-19490 | [ CRITICAL ] | Citrix / NetScaler ADC, NetScaler Gateway + Patch & Defense: "Unauthenticated auth bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) allows remote exploitation with no user interaction." | 9.3 | 23.2% | kev | Sep 12 | Aug 19 | [src] |
| CVE-2026-32475 | [ CRITICAL ] | Elementor / Elementor Pro + Patch & Defense: "Elementor Pro through 4.2.1 has an unrestricted file upload flaw (CVSS 9.0) enabling attackers to plant webshells and run commands on WordPress servers." | 9.0 | 2.0% | exploited-in-wild | — | Aug 19 | [src] |
| CVE-2026-25895 | [ CRITICAL ] | frangoteam / FUXA (≤ 1.2.9) ? Vulnerability Watch: "Missing authentication and path traversal in FUXA SCADA/HMI software (≤ 1.2.9) let unauthenticated attackers write arbitrary files—including the application itself—enabling remote code execution on OT systems." | 9.8 | 6.9% | exploited-in-wild | — | Aug 18 | [src] |
| CVE-2026-33824 | [ CRITICAL ] | Microsoft / Internet Key Exchange (IKE) Service Extensions | 9.8 | 1.6% | kev | Aug 21 | Aug 18 | [src] |
| CVE-2026-64849 | [ CRITICAL ] | MLflow / MLflow (< 3.15.0) ? Vulnerability Watch: "A server-side request forgery in MLflow before 3.15.0 allows unauthenticated access to internal endpoints including cloud metadata services, enabling cloud credential and IAM secret theft." | 9.3 | 9.8% | kev | Sep 2 | Aug 18 | [src] |
| CVE-2026-65400 | [ CRITICAL ] | Apple / macOS | 9.8 | 1.7% | kev | Aug 21 | Aug 18 | [src] |
| CVE-2025-62593 | [ HIGH ] | Ray-Project / Ray + Patch & Defense: "Ray-Project Ray has a code injection flaw enabling RCE, added to CISA KEV on August 18, 2026." | — | 62.5% | kev | Aug 20 | Aug 17 | [src] |
| CVE-2026-20349 | [ HIGH ] | Cisco / Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) + Patch & Defense: "Unauthenticated remote attackers can crash Cisco Secure Firewall ASA and FTD devices over VPN." | 8.6 | 1.0% | kev | Aug 14 | Aug 11 | [src] |
| CVE-2026-68820 | [ HIGH ] | Microsoft / Windows (multiple versions) + Patch & Defense: "Use-after-free in Windows Ancillary Function Driver for WinSock (afd.sys) lets local attackers gain SYSTEM privileges via race condition." | 7.0 | 0.3% | kev | Aug 25 | Aug 11 | [src] |
| CVE-2026-71362 | [ CRITICAL ] | Adobe / Commerce, Magento Open Source ! Breaking: "Adobe Commerce and Magento Open Source contain an incorrect authorization flaw enabling privilege escalation to sensitive resources." | 9.1 | 87.5% | kev | Sep 27 | Aug 11 | [src] |
| CVE-2026-72898 | [ CRITICAL ] | Metabase / Metabase | 10.0 | 19.0% | kev | Aug 14 | Aug 11 | [src] |
| CVE-2026-18556 | [ HIGH ] | N-able / N-central | 7.4 | 7.9% | kev | Aug 7 | Aug 4 | [src] |
| CVE-2026-34486 | [ HIGH ] | Apache / Tomcat | 7.5 | 6.6% | kev | Aug 7 | Aug 4 | [src] |
| CVE-2026-9198 | [ CRITICAL ] | IBM / Langflow | 9.8 | 28.7% | kev | Aug 7 | Aug 4 | [src] |
| CVE-2026-18577 | [ HIGH ] | N-able / N-central | — | 14.6% | kev | Aug 6 | Aug 3 | [src] |
| CVE-2026-59310 | [ CRITICAL ] | Broadcom (VMware) / VMware vCenter Serverransomware + Patch & Defense: "Unauthenticated network-adjacent attackers can bypass authentication in VMware vCenter Server." | 9.8 | 2.6% | kev | Aug 21 | Jul 30 | [src] |
| CVE-2026-20316 | [ MEDIUM ] | Cisco / Cisco Secure Firewall Management Center (FMC)ransomware + Patch & Defense: "Cisco Secure FMC ships a static low-privileged account; remote unauthenticated attackers can log in and access sensitive data." | 5.3 | 35.1% | kev | Aug 1 | Jul 29 | [src] |
page 1
Get pinged the moment something's KEV'd
/kev.json and/kev.xml carry the same data as this table — every CVE on CISA's KEV catalog or otherwise confirmed under active exploitation, refreshed as we sync it. No account, no auth, no rate limit beyond being reasonable. Per-CVE, per-vendor and per-month files are documented on theAPI page. Point a cron job at it and forward new entries to Slack or Discord:
# run every 15 min; diff against the last-seen cveId to only alert on NEW entries
curl -s https://0daynews.com/kev.json | jq -r '.items[0] | "🚨 \(.cveId) — \(.title)\nCVSS \(.cvss) · \(.vendor)/\(.product)\n\(.url)"' \
| xargs -0 -I{} curl -s -X POST -H 'Content-type: application/json' \
--data "{\"text\": \"{}\"}" https://hooks.slack.com/services/YOUR/SLACK/WEBHOOKDiscord incoming webhooks take the same POST shape with "content"instead of "text". Only care about one vendor? Everyvendor page has its own combined article+CVE RSS feed at /vendors/<slug>/feed.xml.