The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-0770 | CRITICAL | 9.8 | Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. | Jan 23, 2026 |
| CVE-2021-27137 | HIGH | 8.1 | DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. | Jul 16, 2026 |
| CVE-2026-50522 | UNKNOWN | — | Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. | Jul 22, 2026 |
| CVE-2026-20245 | HIGH | 7.8 | Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. | Jun 4, 2026 |
| CVE-2026-46817 | CRITICAL | 9.8 | Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. | May 28, 2026 |
| CVE-2026-63030 | UNKNOWN | — | WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. | Jul 21, 2026 |
| CVE-2024-35250 | HIGH | 7.8 | Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges. | Jun 11, 2024 |
| CVE-2026-58644 | CRITICAL | 9.8 | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. | Jul 14, 2026 |
| CVE-2026-39808 | CRITICAL | 9.8 | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. | Apr 14, 2026 |
| CVE-2026-25089 | CRITICAL | 9.8 | Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. | Jun 9, 2026 |
| CVE-2026-15410 | HIGH | 7.2 | SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. | Jul 14, 2026 |
| CVE-2026-15409 | CRITICAL | 10.0 | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. | Jul 14, 2026 |
| CVE-2023-4346 | HIGH | 7.5 | KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. | Aug 29, 2023 |
| CVE-2026-56155 | HIGH | 7.8 | Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. | Jul 14, 2026 |
| CVE-2026-42271 | HIGH | 8.8 | BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. | May 8, 2026 |
| CVE-2026-42208 | CRITICAL | 9.8 | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. | May 8, 2026 |
| CVE-2025-3248 | CRITICAL | 9.8 | Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. | Apr 7, 2025 |
| CVE-2025-34291 | HIGH | 8.8 | Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. | Dec 5, 2025 |
| CVE-2024-11680 | CRITICAL | 9.8 | ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. | Nov 26, 2024 |
| CVE-2026-56164 | MEDIUM | 5.3 | Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. | Jul 14, 2026 |
| CVE-2025-10585 | CRITICAL | 9.8 | Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. | Sep 24, 2025 |
| CVE-2025-13223 | HIGH | 8.8 | Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. | Nov 17, 2025 |
| CVE-2024-1212 | CRITICAL | 10.0 | Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. | Feb 21, 2024 |
| CVE-2026-56291 | CRITICAL | 9.8 | Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE. | Jul 9, 2026 |
| CVE-2026-48939 | CRITICAL | 9.8 | iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. | Jun 20, 2026 |