The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-32201 | UNKNOWN | — | Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. | Apr 14, 2026 |
| CVE-2009-0238 | UNKNOWN | — | Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object. | Apr 14, 2026 |
| CVE-2020-9715 | UNKNOWN | — | Adobe Acrobat contains a use-after-free vulnerability that allows for code execution | Apr 13, 2026 |
| CVE-2023-36424 | UNKNOWN | — | Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation | Apr 13, 2026 |
| CVE-2025-60710 | UNKNOWN | — | Microsoft Windows contains a link following vulnerability that allows for privilege escalation | Apr 13, 2026 |
| CVE-2012-1854 | UNKNOWN | — | Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution. | Apr 13, 2026 |
| CVE-2026-21643 | UNKNOWN | — | Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | Apr 13, 2026 |
| CVE-2026-1340 | UNKNOWN | — | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. | Apr 8, 2026 |
| CVE-2026-35616 | UNKNOWN | — | Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | Apr 6, 2026 |
| CVE-2026-3502 | UNKNOWN | — | TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user. | Apr 2, 2026 |
| CVE-2026-5281 | UNKNOWN | — | Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Apr 1, 2026 |
| CVE-2026-3055 | UNKNOWN | — | Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread. | Mar 30, 2026 |
| CVE-2025-53521 | UNKNOWN | — | F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. | Mar 27, 2026 |
| CVE-2026-33634 | UNKNOWN | — | Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory. | Mar 26, 2026 |
| CVE-2026-33017 | UNKNOWN | — | Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. | Mar 25, 2026 |
| CVE-2025-54068 | UNKNOWN | — | Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. | Mar 20, 2026 |
| CVE-2025-32432 | UNKNOWN | — | Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. | Mar 20, 2026 |
| CVE-2025-43520 | UNKNOWN | — | Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory. | Mar 20, 2026 |
| CVE-2025-43510 | UNKNOWN | — | Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. | Mar 20, 2026 |
| CVE-2026-20131 | UNKNOWN | — | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. | Mar 19, 2026 |
| CVE-2026-20963 | UNKNOWN | — | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. | Mar 18, 2026 |
| CVE-2025-66376 | UNKNOWN | — | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. | Mar 18, 2026 |
| CVE-2025-47813 | UNKNOWN | — | Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie. | Mar 16, 2026 |
| CVE-2026-3909 | UNKNOWN | — | Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. | Mar 13, 2026 |
| CVE-2026-3910 | UNKNOWN | — | Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Mar 13, 2026 |