$ kev-tracker
Known Exploited Vulnerabilities Tracker
Every CVE on CISA's live Known Exploited Vulnerabilities catalog, synced directly — not just the ones we've written full articles about — plus other confirmed actively-exploited vulnerabilities. CVSS is NVD's score; EPSS is FIRST.org's modeled 30-day exploitation probability. Filter and sort client-side — nothing leaves your browser.
New to these terms? Read what the KEV catalog is,what EPSS measures andhow KEV due dates work.
Showing 100 newest of 1798
| CVE ID | Severity | Vendor / Product | CVSS | EPSS | Status | Patch by | Published | Source |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-111560 | [ HIGH ] | Barracuda Networks / Multiple Products | — | 6.2% | kev | Nov 13 | Nov 10 | [src] |
| CVE-2026-111793 | [ MEDIUM ] | Openwave Messaging Limited / Webtop Media Transcoder | 4.3 | 0.6% | kev | Nov 24 | Nov 10 | [src] |
| CVE-2026-116606 | [ HIGH ] | Barracuda Networks / Barracuda Email Security Gateway (ESG) | — | 8.9% | kev | Nov 13 | Nov 10 | [src] |
| CVE-2026-124194 | [ MEDIUM ] | Microsoft / Office | 6.5 | 1.6% | kev | Nov 24 | Nov 10 | [src] |
| CVE-2026-125350 | [ HIGH ] | Google / Chromium | — | 1.0% | kev | Nov 24 | Nov 10 | [src] |
| CVE-2026-20320 | [ HIGH ] | Cisco / BroadWorks | 7.5 | 0.8% | kev | Nov 24 | Nov 10 | [src] |
| CVE-2026-102895 | [ CRITICAL ] | GPUStack / GPUStack | 9.8 | 0.5% | kev | Nov 12 | Nov 9 | [src] |
| CVE-2026-116779 | [ CRITICAL ] | SignalWire / FreeSwitch | 9.8 | 2.5% | kev | Nov 12 | Nov 9 | [src] |
| CVE-2026-123158 | [ HIGH ] | OpenBSD / OpenSSH | 8.1 | 18.9% | kev | Nov 12 | Nov 9 | [src] |
| CVE-2026-123218 | [ CRITICAL ] | IBM / Aspera Faspex | 9.8 | 0.5% | kev | Nov 12 | Nov 9 | [src] |
| CVE-2026-19868 | [ HIGH ] | SonicWall / SonicOS SSLVPN | — | 0.5% | kev | Nov 20 | Nov 6 | [src] |
| CVE-2024-27834 | [ MEDIUM ] | Apple / Multiple Products | 5.5 | 1.5% | kev | Nov 18 | Nov 4 | [src] |
| CVE-2026-119977 | [ HIGH ] | WordPress / WordPress Core | 8.1 | 1.2% | kev | Nov 6 | Nov 3 | [src] |
| CVE-2026-111357 | [ HIGH ] | Ivanti / Connect Secure + Patch & Defense: "Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges." | 7.0 | 0.5% | kev | Nov 2 | Oct 30 | [src] |
| CVE-2026-118527 | [ UNKNOWN ] | Ivanti / Connect Secure + Patch & Defense: "CISA lists an exploited predictable-identifier flaw in Ivanti Connect Secure." | — | 0.8% | kev | Nov 13 | Oct 30 | [src] |
| CVE-2026-76418 | [ HIGH ] | Cisco / Secure Firewall ASA and Threat Defense (FTD) Software + Patch & Defense: "Logic errors in Cisco ASA/FTD SSL VPN secondary authentication let unauthenticated remote attackers reload the firewall, causing a denial-of-service condition." | 8.6 | 0.8% | kev | Nov 1 | Oct 29 | [src] |
| CVE-2026-101767 | [ CRITICAL ] | Oracle / E-Business Suite (Application Object Library) + Patch & Defense: "Oracle EBS Application Object Library contains an unauthenticated SQL injection flaw allowing remote code execution." | 9.8 | 0.6% | exploited-in-wild | — | Oct 28 | [src] |
| CVE-2026-118539 | [ CRITICAL ] | Drupal / Commerce Core (contributed module) + Patch & Defense: "A missing authorization flaw in the Drupal Commerce Core module lets unauthenticated attackers bypass access controls on certain routes and entity fields." | — | 0.7% | exploited-in-wild | — | Oct 28 | [src] |
| CVE-2026-41709 | [ LOW ] | Broadcom / VMware ESX + Patch & Defense: "Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged." | 2.7 | 0.7% | kev | Nov 11 | Oct 28 | [src] |
| CVE-2026-46300 | [ HIGH ] | Linux / Kernel + Patch & Defense: "Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place." | 7.8 | 16.1% | kev | Oct 31 | Oct 28 | [src] |
| CVE-2026-111497 | [ HIGH ] | Google / Brotli + Patch & Defense: "Google Brotli decoder out-of-bounds write with remote code execution potential, added to CISA KEV on October 27, 2026." | — | 82.6% | kev | Nov 10 | Oct 27 | [src] |
| CVE-2026-48356 | [ CRITICAL ] | Adobe / Commerce and Magento + Patch & Defense: "Adobe Commerce and Magento unrestricted file upload, rated Critical by Adobe and added to CISA KEV on October 27, 2026." | 9.6 | 47.5% | kev | Nov 10 | Oct 27 | [src] |
| CVE-2026-114625 | [ CRITICAL ] | Arista Networks / VeloCloud Orchestrator (VCO) on-premises ! Breaking: "A SQL injection flaw in Arista's on-prem VeloCloud Orchestrator lets any authenticated user gain superuser operator privileges, with active exploitation confirmed as of October 22, 2026." | 9.9 | 1.0% | kev | Oct 26 | Oct 22 | [src] |
| CVE-2026-109618 | [ CRITICAL ] | PHP / PHP core (before 8.3.36, 8.4.x before 8.4.27, 8.5.x before 8.5.12) ~ Analysis: "PHP OOM handling leaves request memory uninitialized before cleanup runs, enabling unauthenticated RCE." | 9.8 | 100.0% | kev | Oct 29 | Oct 21 | [src] |
| CVE-2026-109619 | [ HIGH ] | PHP / PHP core (before 8.3.36, 8.4.x before 8.4.27, 8.5.x before 8.5.12) ~ Analysis: "Stale PHP global state may reference freed request memory, which subsequent requests read before it resets, enabling unauthenticated RCE." | 8.1 | 100.0% | kev | Oct 29 | Oct 21 | [src] |
| CVE-2026-106931 | [ HIGH ] | EG Secure Solutions / SiteGuard Server Edition | 7.8 | 2.5% | kev | Oct 23 | Oct 20 | [src] |
| CVE-2026-110936 | [ MEDIUM ] | Siemens / Siemens Software Center (versions before V4.0.9.8) ? Vulnerability Watch: "Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path, allowing a local attacker to execute code with the application's privileges." | 6.7 | 1.0% | kev | Nov 3 | Oct 20 | [src] |
| CVE-2026-96652 | [ MEDIUM ] | Plex / Media Server | 4.3 | 11.9% | kev | Nov 3 | Oct 20 | [src] |
| CVE-2026-96654 | [ MEDIUM ] | Plex / Media Server | 6.5 | 1.9% | kev | Oct 23 | Oct 20 | [src] |
| CVE-2026-96655 | [ MEDIUM ] | Plex / Media Server | 4.3 | 10.7% | kev | Nov 3 | Oct 20 | [src] |
| CVE-2026-96656 | [ HIGH ] | Plex / Plex Media Server ~ Analysis: "Plex Media Server before 1.43.3.10861 lets an admin write arbitrary .so files via the TranscoderH264Options preference; the server loads all Codecs-directory .so files at startup without checks." | 7.2 | 1.8% | kev | Oct 23 | Oct 20 | [src] |
| CVE-2025-61624 | [ MEDIUM ] | Fortinet / Multiple Products | 6.0 | 1.4% | kev | Oct 19 | Oct 16 | [src] |
| CVE-2026-102764 | [ CRITICAL ] | BeyondTrust / Remote Support + Patch & Defense: "CVSS 9.8 auth bypass in BeyondTrust Remote Support; unauthenticated attackers can perform file operations on the appliance." | 9.8 | 79.5% | kev | Oct 19 | Oct 16 | [src] |
| CVE-2026-110447 | [ CRITICAL ] | CollaboraOnline / Collabora Online Built-in CODE Server (richdocumentscode) + Patch & Defense: "Critical command injection in Collabora Online's Built-in CODE Server before 26.4.303, exploited to plant webshells on Nextcloud instances since September 2026." | 9.8 | 73.3% | kev | Oct 26 | Oct 15 | [src] |
| CVE-2026-0322 | [ HIGH ] | Palo Alto Networks / PAN-OS ~ Analysis: "PAN-OS code injection flaw lets authenticated network attackers run code as root." | — | 2.1% | kev | Oct 17 | Oct 14 | [src] |
| CVE-2026-76519 | [ CRITICAL ] | Cisco / Secure Email Gateway | 9.8 | 6.2% | kev | Oct 17 | Oct 14 | [src] |
| CVE-2026-104935 | [ HIGH ] | Ivanti / Connect Secure + Patch & Defense: "Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure." | 8.6 | 88.9% | kev | Oct 16 | Oct 13 | [src] |
| CVE-2026-96951 | [ HIGH ] | Microsoft / Windows | 8.8 | 9.8% | kev | Oct 16 | Oct 13 | [src] |
| CVE-2026-97229 | [ CRITICAL ] | GitLab / GitLab CE/EE ~ Analysis: "An integer overflow in GitLab's CI/CD configuration regex validation lets unauthenticated attackers execute arbitrary code on affected CE and EE instances via a crafted pipeline expression." | 10.0 | 69.3% | kev | Nov 1 | Oct 13 | [src] |
| CVE-2026-85097 | [ CRITICAL ] | Bricksforge / Bricksforge plugin for WordPress (through 3.1.8.9) ~ Analysis: "CVE-2026-85097 is a CVSS 9.8 unauthenticated file upload flaw in Bricksforge for WordPress (versions through 3.1.8.9) enabling remote code execution." | 9.8 | 3.3% | exploited-in-wild | — | Oct 12 | [src] |
| CVE-2026-102255 | [ CRITICAL ] | SonicWall / SMA1000 ~ Analysis: "Critical (CVSS 10.0) remote vulnerability in SonicWall SMA1000 appliances." | 10.0 | 1.0% | exploited-in-wild | — | Oct 10 | [src] |
| CVE-2015-3306 | [ CRITICAL ] | ProFTPD / ProFTPD | 10.0 | 99.5% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2015-5477 | [ HIGH ] | ISC / BIND | 7.8 | 99.6% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2016-3081 | [ HIGH ] | Apache / Struts | 8.1 | 96.9% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2021-3199 | [ CRITICAL ] | ONLYOFFICE / Docs | 9.8 | 30.2% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2023-22894 | [ MEDIUM ] | Strapi / Strapi | 4.9 | 4.1% | kev | Oct 11 | Oct 8 | [src] |
| CVE-2026-21589 | [ CRITICAL ] | Atlassian / Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye Data Center ! Breaking: "CVSS 9.3 path traversal lets unauthenticated attackers read files from eight Atlassian Data Center products' web root directories." | 9.3 | 99.7% | kev | Oct 18 | Oct 6 | [src] |
| CVE-2026-61500 | [ CRITICAL ] | Rejetto / HTTP File Server (HFS) ~ Analysis: "Weak session-signing key in Rejetto HFS lets attackers forge admin sessions and execute code remotely." | 9.3 | 1.9% | exploited-in-wild | — | Oct 5 | [src] |
| CVE-2026-105133 | [ HIGH ] | Ahsay Systems / AhsayCBS + Patch & Defense: "AhsayCBS OS command injection via manipulated function arguments allows SYSTEM-level code execution." | 7.3 | 84.5% | kev | Oct 17 | Oct 4 | [src] |
| CVE-2026-105134 | [ CRITICAL ] | Ahsay Systems / AhsayCBS + Patch & Defense: "Unauthenticated attackers can substitute a random token for valid credentials in AhsayCBS, gaining full console access." | 10.0 | 81.8% | kev | Oct 17 | Oct 4 | [src] |
| CVE-2026-88779 | [ HIGH ] | + Patch & Defense: "NetScaler ADC and Gateway contain an exploited memory-buffer flaw enabling denial of service." | 7.5 | 11.4% | kev | Oct 7 | Oct 4 | [src] |
| CVE-2026-102489 | [ HIGH ] | Zammad GmbH / Zammad | — | 49.9% | kev | Oct 5 | Oct 2 | [src] |
| CVE-2026-102490 | [ HIGH ] | Zammad GmbH / Zammad | — | 10.9% | kev | Oct 5 | Oct 2 | [src] |
| CVE-2026-104286 | [ CRITICAL ] | Fortinet / FortiMail + Patch & Defense: "Fortinet FortiMail path traversal flaw (CVSS 9.8) lets unauthenticated attackers write arbitrary files." | 9.8 | 4.6% | kev | Oct 4 | Oct 1 | [src] |
| CVE-2026-76504 | [ CRITICAL ] | + Patch & Defense: "Unauthenticated attackers can gain admin access to Cisco Catalyst SD-WAN Manager via a URI encoding flaw." | 9.8 | 38.9% | kev | Oct 3 | Sep 30 | [src] |
| CVE-2026-86950 | [ HIGH ] | Apple / iOS 26, iPadOS, macOS 26, macOS 15 ! Breaking: "CoreGraphics memory confusion flaw in Apple iOS 26, iPadOS, macOS 26, and macOS 15." | 8.8 | 26.2% | kev | Oct 13 | Sep 28 | [src] |
| CVE-2026-88771 | [ HIGH ] | + Patch & Defense: "Citrix NetScaler ADC and Gateway improper input validation flaw allows unauthenticated remote code execution; actively exploited and CISA KEV listed." | — | 81.9% | kev | Sep 30 | Sep 27 | [src] |
| CVE-2026-88772 | [ HIGH ] | + Patch & Defense: "Citrix NetScaler ADC and Gateway memory buffer flaw allows remote code execution or denial of service; actively exploited and CISA KEV listed." | — | 76.6% | kev | Sep 30 | Sep 27 | [src] |
| CVE-2026-65660 | [ HIGH ] | Microsoft / SharePoint + Patch & Defense: "A code injection flaw in Microsoft Office SharePoint lets an authorized attacker execute code over a network." | 8.8 | 9.9% | kev | Sep 28 | Sep 25 | [src] |
| CVE-2026-67279 | [ MEDIUM ] | MikroTik / RouterOS ~ Analysis: "Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request." | 6.5 | 2.3% | kev | Sep 28 | Sep 25 | [src] |
| CVE-2026-48842 | [ HIGH ] | + Patch & Defense: "Pre-authentication SQL injection in Roundcube's virtuser_query plugin lets unauthenticated attackers bypass login and read or alter the webmail database." | 8.1 | 1.7% | exploited-in-wild | — | Sep 24 | [src] |
| CVE-2026-5430 | [ CRITICAL ] | WSO2 / API Control Plane, API Manager, Traffic Manager, Universal Gateway + Patch & Defense: "WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway contain a path traversal flaw enabling unauthenticated file upload and remote code execution." | 10.0 | 22.4% | kev | Sep 27 | Sep 24 | [src] |
| CVE-2026-32996 | [ HIGH ] | Veeam / Veeam Agent for Microsoft Windows + Patch & Defense: "Local privilege escalation in Veeam Agent for Microsoft Windows gives local attackers SYSTEM-level access." | 7.3 | 0.3% | exploited-in-wild | — | Sep 22 | [src] |
| CVE-2026-87902 | [ HIGH ] | WordPress / WordPress Core ! Breaking: "Path traversal in WordPress core's get_page_template() enables unauthenticated local PHP file inclusion and conditional RCE." | 8.1 | 95.8% | kev | Sep 28 | Sep 22 | [src] |
| CVE-2026-93616 | [ CRITICAL ] | Check Point / Security Management Server, Multi-Domain Management Server, Log Server, SmartEvent ~ Analysis: "CVE-2026-93616: CVSS 9.8 path traversal and file upload in Check Point Management Server enabling unauth RCE." | 9.8 | 91.6% | kev | Sep 25 | Sep 22 | [src] |
| CVE-2026-93952 | [ CRITICAL ] | Arista / VeloCloud Orchestrator ~ Analysis: "“CVE-2026-93952 is a CVSS 10.0 improper input validation flaw in Arista VeloCloud Orchestrator that allows unauthenticated remote code execution." | 10.0 | 1.4% | kev | Sep 25 | Sep 22 | [src] |
| CVE-2026-94127 | [ CRITICAL ] | F5 / BIG-IP APM ~ Analysis: "CVSS 9.8 F5 BIG-IP APM heap overflow: unauth RCE when an access policy and OAuth profile share a virtual server." | 9.8 | 26.6% | kev | Sep 25 | Sep 22 | [src] |
| CVE-2026-7273 | [ HIGH ] | Zyxel / GS1900 Series Switches + Patch & Defense: "Stack-based buffer overflow in Zyxel GS1900 CGI program lets unauthenticated LAN attackers execute OS commands." | 8.8 | 2.7% | kev | Sep 24 | Sep 21 | [src] |
| CVE-2025-39682 | [ CRITICAL ] | Linux / Kernel + Patch & Defense: "Linux kernel TLS receive path: zero-length record bypasses recvmsg() handling, corrupting downstream TLS processing." | 9.8 | 3.3% | kev | Sep 21 | Sep 18 | [src] |
| CVE-2025-39964 | [ HIGH ] | Linux / Kernel + Patch & Defense: "Linux kernel AF_ALG race condition: concurrent writes corrupt state, crashing the system or corrupting cryptographic output." | 7.8 | 1.6% | kev | Sep 21 | Sep 18 | [src] |
| CVE-2026-53266 | [ HIGH ] | Linux / Kernel + Patch & Defense: "OOB write in Linux kernel ebtables SNAT target." | 8.8 | 0.9% | kev | Sep 21 | Sep 18 | [src] |
| CVE-2026-58138 | [ CRITICAL ] | Orkes / Orkes Conductor ~ Analysis: "Unauthenticated RCE in Orkes Conductor via crafted inline workflow definitions." | 9.8 | 9.1% | exploited-in-wild | — | Sep 18 | [src] |
| CVE-2026-58704 | [ HIGH ] | Google / Pixel + Patch & Defense: "Improper authorization in Google Pixel's cellular modem lets a nearby attacker bypass permission checks and escalate privileges without user interaction." | 8.8 | 0.6% | kev | Sep 19 | Sep 16 | [src] |
| CVE-2026-76460 | [ CRITICAL ] | ~ Analysis: "CVSS 10.0 auth bypass in Cisco ISE and ISE-PIC." | 10.0 | 75.6% | kev | Sep 19 | Sep 16 | [src] |
| CVE-2026-87886 | [ HIGH ] | Acronis / Backup | 7.8 | 0.2% | kev | Sep 19 | Sep 16 | [src] |
| CVE-2026-76461 | [ CRITICAL ] | Cisco / Secure Email Gateway ~ Analysis: "SQL injection in Cisco AsyncOS for Secure Email Gateway lets an unauthenticated remote attacker execute arbitrary OS commands with root privileges." | 9.8 | 40.2% | kev | Sep 17 | Sep 14 | [src] |
| CVE-2026-42016 | [ HIGH ] | JFrog / Artifactory + Patch & Defense: "JFrog Artifactory validates token signature and issuer but not scope, creating a privilege escalation path." | 8.1 | 8.6% | kev | Sep 25 | Sep 11 | [src] |
| CVE-2026-42018 | [ HIGH ] | JFrog / Artifactory ? Vulnerability Watch: "JFrog Artifactory returns an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled, allowing unauthorized resource access and enabling privilege escalation chains." | 7.5 | 10.0% | kev | Sep 25 | Sep 11 | [src] |
| CVE-2026-84869 | [ CRITICAL ] | ConnectWise / ScreenConnect + Patch & Defense: "ConnectWise ScreenConnect allows file transfer and execution through active remote sessions without authorization." | 9.9 | 0.9% | kev | Sep 14 | Sep 11 | [src] |
| CVE-2026-85706 | [ CRITICAL ] | GitLab / GitLab CE/EE ? Vulnerability Watch: "GitLab CE/EE contains a path traversal flaw due to improper path confinement and missing access controls, allowing an unauthenticated attacker to read arbitrary files from the server." | 10.0 | 97.4% | kev | Sep 14 | Sep 11 | [src] |
| CVE-2026-67277 | [ HIGH ] | MikroTik / RouterOS + Patch & Defense: "MikroTik RouterOS btest service missing authentication allows kernel memory disclosure." | 8.2 | 1.6% | kev | Sep 13 | Sep 10 | [src] |
| CVE-2026-85102 | [ CRITICAL ] | Check Point / Check Point firewall and management products + Patch & Defense: "CVSS 9.8 critical: unauthenticated RCE via VPN certificate handling in Check Point firewall and management products." | 9.8 | 54.1% | kev | Sep 25 | Sep 10 | [src] |
| CVE-2026-86060 | [ CRITICAL ] | MikroTik / RouterOS + Patch & Defense: "MikroTik RouterOS SSH login path argument flaw allows unauthenticated privilege escalation." | 9.8 | 6.4% | kev | Sep 13 | Sep 10 | [src] |
| CVE-2025-25249 | [ HIGH ] | Fortinet / FortiOS, FortiSwitchManager, FortiSASE + Patch & Defense: "CVSS 8.1 heap overflow in FortiOS, FortiSwitchManager, and FortiSASE allows code execution via crafted packets." | 8.1 | 3.7% | kev | Sep 12 | Sep 9 | [src] |
| CVE-2026-20079 | [ CRITICAL ] | Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management + Patch & Defense: "CVE-2026-20079 is a CVSS 10.0 unauthenticated auth bypass in Cisco FMC with root OS access." | 10.0 | 88.7% | kev | Sep 12 | Sep 9 | [src] |
| CVE-2026-87491 | [ HIGH ] | Google / Chromium V8 | 8.8 | 3.5% | kev | Sep 23 | Sep 9 | [src] |
| CVE-2026-75650 | [ CRITICAL ] | ? Vulnerability Watch: "CVSS 10.0 template-injection in Adobe Commerce and Magento Open Source." | 10.0 | 99.4% | kev | Sep 11 | Sep 8 | [src] |
| CVE-2026-81963 | [ HIGH ] | Microsoft / Windows ? Vulnerability Watch: "“Windows Update Stack link-following flaw lets a local attacker escalate to SYSTEM." | 7.8 | 7.1% | kev | Sep 22 | Sep 8 | [src] |
| CVE-2026-85880 | [ HIGH ] | Microsoft / Windows ? Vulnerability Watch: "Windows ALPC contains a heap buffer overflow allowing AppContainer sandbox escape to local privilege escalation." | 7.8 | 0.4% | kev | Sep 22 | Sep 8 | [src] |
| CVE-2026-86218 | [ CRITICAL ] | N-able / N-central ? Vulnerability Watch: "Pre-authentication remote code execution in N-able N-central via static code injection." | 10.0 | 15.4% | kev | Sep 11 | Sep 6 | [src] |
| CVE-2026-85046 | [ HIGH ] | + Patch & Defense: "Type confusion in Chrome's V8 engine lets remote attackers run arbitrary code inside the browser sandbox via a crafted HTML page." | 8.8 | 1.8% | kev | Sep 18 | Sep 4 | [src] |
| CVE-2026-0768 | [ CRITICAL ] | Langflow / Langflow ~ Analysis: "An unauthenticated remote code execution flaw in Langflow allows attackers to run arbitrary Python code on exposed instances, enabling theft of AI API keys and cloud credentials." | 9.8 | 28.1% | exploited-in-wild | — | Sep 2 | [src] |
| CVE-2026-48710 | [ MEDIUM ] | Kludex / Starlette | 6.5 | 70.3% | kev | Sep 16 | Sep 2 | [src] |
| CVE-2026-49869 | [ CRITICAL ] | Kestra / Kestra OSS | 10.0 | 2.1% | kev | Sep 5 | Sep 2 | [src] |
| CVE-2026-59822 | [ HIGH ] | BerriAI / LiteLLM | 8.2 | 0.8% | kev | Sep 16 | Sep 2 | [src] |
| CVE-2026-9586 | [ HIGH ] | Sangoma / Switchvox | — | 19.0% | kev | Sep 5 | Sep 2 | [src] |
| CVE-2026-83548 | [ HIGH ] | SonicWall / SMA1000 ! Breaking: "Unauthenticated SSRF in the SMA1000 Workplace interface allows remote attackers to reach internal functionality via an unintended access path." | — | 8.0% | kev | Sep 5 | Sep 1 | [src] |
| CVE-2026-83549 | [ HIGH ] | SonicWall / SMA1000 Appliance Management Console ! Breaking: "Post-auth OS command injection in the SonicWall SMA1000 AMC allows an authenticated administrator to execute arbitrary OS commands." | 7.8 | 9.9% | kev | Sep 5 | Sep 1 | [src] |
| CVE-2026-81578 | [ CRITICAL ] | PaperCut Software / PaperCut NG and PaperCut MF (versions 24, 25, 26) + Patch & Defense: "Authentication bypass in PaperCut NG/MF (CVSS 9.8, Critical) lets unauthenticated attackers access admin functions via malformed requests." | 9.8 | 84.7% | kev | Sep 14 | Aug 28 | [src] |
| CVE-2026-82078 | [ CRITICAL ] | PaperCut Software / PaperCut NG and PaperCut MF (versions 24, 25, 26) + Patch & Defense: "PaperCut NG/MF (CVSS 9.4 Critical): unsafe dynamic class-loading enables unauthenticated RCE." | 9.1 | 63.0% | kev | Sep 14 | Aug 28 | [src] |
page 1
Get pinged the moment something's KEV'd
/kev.json and/kev.xml carry the same data as this table — every CVE on CISA's KEV catalog or otherwise confirmed under active exploitation, refreshed as we sync it. No account, no auth, no rate limit beyond being reasonable. Per-CVE, per-vendor and per-month files are documented on theAPI page. Point a cron job at it and forward new entries to Slack or Discord:
# run every 15 min; diff against the last-seen cveId to only alert on NEW entries
curl -s https://0daynews.com/kev.json | jq -r '.items[0] | "🚨 \(.cveId) — \(.title)\nCVSS \(.cvss) · \(.vendor)/\(.product)\n\(.url)"' \
| xargs -0 -I{} curl -s -X POST -H 'Content-type: application/json' \
--data "{\"text\": \"{}\"}" https://hooks.slack.com/services/YOUR/SLACK/WEBHOOKDiscord incoming webhooks take the same POST shape with "content"instead of "text". Only care about one vendor? Everyvendor page has its own combined article+CVE RSS feed at /vendors/<slug>/feed.xml.