The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-48908 | CRITICAL | 9.8 | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. | Jun 20, 2026 |
| CVE-2026-48282 | CRITICAL | 10.0 | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. | Jun 30, 2026 |
| CVE-2026-48172 | CRITICAL | 9.8 | LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges. | May 21, 2026 |
| CVE-2026-20230 | HIGH | 8.6 | Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. | Jun 3, 2026 |
| CVE-2026-19490 | CRITICAL | 9.8 | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. | Aug 19, 2026 |
| CVE-2026-10520 | CRITICAL | 10.0 | Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. | Jun 9, 2026 |
| CVE-2026-104286 | CRITICAL | 9.8 | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. | Oct 1, 2026 |
| CVE-2025-5777 | HIGH | 7.5 | Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. | Jun 17, 2025 |
| CVE-2025-3928 | HIGH | 8.8 | Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells. | Apr 25, 2025 |
| CVE-2025-25249 | HIGH | 8.1 | Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. | Jan 13, 2026 |
| CVE-2025-21042 | HIGH | 8.8 | Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code. | Sep 12, 2025 |
| CVE-2024-50623 | CRITICAL | 9.8 | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges. | Oct 28, 2024 |
| CVE-2023-35311 | HIGH | 8.8 | Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. | Jul 11, 2023 |
| CVE-2021-41277 | CRITICAL | 10.0 | Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. | Nov 17, 2021 |
| CVE-2020-9054 | CRITICAL | 9.8 | Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code. | Mar 4, 2020 |
| CVE-2020-1054 | HIGH | 7.0 | Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. | May 21, 2020 |
| CVE-2019-8720 | HIGH | 8.8 | WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. | Mar 6, 2023 |
| CVE-2013-3900 | MEDIUM | 5.5 | A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. | Dec 11, 2013 |
| CVE-2017-12149 | CRITICAL | 9.8 | The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data. | Oct 4, 2017 |
| CVE-2026-21589 | UNKNOWN | — | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. | Oct 5, 2026 |
| CVE-2025-52691 | CRITICAL | 10.0 | SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. | Dec 29, 2025 |
| CVE-2025-43510 | HIGH | 7.8 | Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. | Dec 12, 2025 |
| CVE-2025-43520 | MEDIUM | 5.5 | Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory. | Dec 12, 2025 |
| CVE-2025-43529 | HIGH | 8.8 | Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Dec 17, 2025 |
| CVE-2025-66376 | HIGH | 7.2 | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. | Jan 5, 2026 |