The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-114625 | UNKNOWN | — | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. | Oct 23, 2026 |
| CVE-2026-110447 | UNKNOWN | — | Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. | Oct 23, 2026 |
| CVE-2026-110936 | UNKNOWN | — | Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. | Oct 20, 2026 |
| CVE-2026-106931 | UNKNOWN | — | EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. | Oct 20, 2026 |
| CVE-2025-39964 | HIGH | 7.8 | Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. | Oct 13, 2025 |
| CVE-2025-39682 | CRITICAL | 9.8 | Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. | Sep 5, 2025 |
| CVE-2025-62593 | HIGH | 8.8 | Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. | Nov 26, 2025 |
| CVE-2025-12480 | CRITICAL | 9.1 | Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. | Nov 10, 2025 |
| CVE-2025-20333 | CRITICAL | 9.9 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. | Sep 25, 2025 |
| CVE-2025-60710 | HIGH | 7.8 | Microsoft Windows contains a link following vulnerability that allows for privilege escalation | Nov 11, 2025 |
| CVE-2025-20362 | MEDIUM | 6.5 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. | Sep 25, 2025 |
| CVE-2025-41244 | HIGH | 7.8 | Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. | Sep 29, 2025 |
| CVE-2025-53690 | CRITICAL | 9.0 | Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. | Sep 3, 2025 |
| CVE-2025-9377 | HIGH | 7.2 | TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | Aug 29, 2025 |
| CVE-2025-55177 | MEDIUM | 5.4 | Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. | Aug 29, 2025 |
| CVE-2025-10035 | CRITICAL | 10.0 | Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. | Sep 18, 2025 |
| CVE-2025-58360 | HIGH | 8.2 | OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. | Nov 25, 2025 |
| CVE-2025-64446 | CRITICAL | 9.8 | Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. | Nov 14, 2025 |
| CVE-2025-58034 | HIGH | 7.2 | Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. | Nov 18, 2025 |
| CVE-2025-55182 | CRITICAL | 10.0 | Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. | Dec 3, 2025 |
| CVE-2025-61624 | UNKNOWN | — | FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. | Oct 16, 2026 |
| CVE-2026-102764 | UNKNOWN | — | BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. | Oct 16, 2026 |
| CVE-2026-8037 | CRITICAL | 9.6 | Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. | Jun 4, 2026 |
| CVE-2026-0322 | HIGH | 7.2 | Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. | Oct 14, 2026 |
| CVE-2026-76519 | CRITICAL | 9.8 | Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. | Oct 14, 2026 |
Page 1 of 71