The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2023-4911 | HIGH | 7.8 | GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges. | Oct 3, 2023 |
| CVE-2022-2586 | MEDIUM | 5.3 | Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. | Jan 8, 2024 |
| CVE-2026-76519 | UNKNOWN | — | Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. | Oct 14, 2026 |
| CVE-2026-0322 | UNKNOWN | — | Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. | Oct 14, 2026 |
| CVE-2026-104935 | UNKNOWN | — | Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. | Oct 13, 2026 |
| CVE-2026-96951 | UNKNOWN | — | Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. | Oct 13, 2026 |
| CVE-2025-26399 | CRITICAL | 9.8 | SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. | Sep 23, 2025 |
| CVE-2015-5477 | UNKNOWN | — | ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. | Oct 8, 2026 |
| CVE-2016-3081 | UNKNOWN | — | Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. | Oct 8, 2026 |
| CVE-2021-3199 | UNKNOWN | — | ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. | Oct 8, 2026 |
| CVE-2015-3306 | UNKNOWN | — | ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Oct 8, 2026 |
| CVE-2025-21043 | HIGH | 8.8 | Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code. | Sep 12, 2025 |
| CVE-2026-48558 | CRITICAL | 10.0 | SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. | Jun 12, 2026 |
| CVE-2025-14611 | CRITICAL | 9.8 | Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. | Dec 12, 2025 |
| CVE-2025-48633 | MEDIUM | 5.5 | Android Framework contains an unspecified vulnerability that allows for information disclosure. | Dec 8, 2025 |
| CVE-2025-48572 | HIGH | 7.8 | Android Framework contains an unspecified vulnerability that allows for privilege escalation. | Dec 8, 2025 |
| CVE-2025-14174 | HIGH | 8.8 | Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Dec 12, 2025 |
| CVE-2026-9082 | CRITICAL | 9.8 | Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. | May 20, 2026 |
| CVE-2026-7473 | MEDIUM | 5.8 | Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. | Jun 5, 2026 |
| CVE-2026-76460 | CRITICAL | 10.0 | Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. | Sep 16, 2026 |
| CVE-2026-58704 | HIGH | 8.8 | Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. | Sep 15, 2026 |
| CVE-2026-56290 | CRITICAL | 9.8 | Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. | Jun 29, 2026 |
| CVE-2026-55255 | HIGH | 8.4 | Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. | Jun 23, 2026 |
| CVE-2026-48908 | CRITICAL | 9.8 | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. | Jun 20, 2026 |
| CVE-2026-48282 | CRITICAL | 10.0 | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. | Jun 30, 2026 |
Page 1 of 70