The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2023-22894 | MEDIUM | 4.9 | Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. | Apr 19, 2023 |
| CVE-2026-64849 | CRITICAL | 9.3 | MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. | Aug 17, 2026 |
| CVE-2026-88779 | HIGH | 7.5 | Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. | Oct 4, 2026 |
| CVE-2026-102490 | UNKNOWN | — | Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. | Oct 2, 2026 |
| CVE-2026-102489 | UNKNOWN | — | Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. | Oct 2, 2026 |
| CVE-2026-76504 | CRITICAL | 9.8 | Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. | Sep 30, 2026 |
| CVE-2025-6558 | HIGH | 8.8 | Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Jul 15, 2025 |
| CVE-2026-41940 | CRITICAL | 9.8 | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. | Apr 29, 2026 |
| CVE-2026-24061 | CRITICAL | 9.8 | GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable. | Jan 21, 2026 |
| CVE-2026-86950 | HIGH | 8.8 | Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. | Sep 28, 2026 |
| CVE-2026-96652 | MEDIUM | 4.3 | Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. | Sep 23, 2026 |
| CVE-2026-96654 | MEDIUM | 6.5 | Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. | Sep 23, 2026 |
| CVE-2026-96655 | MEDIUM | 4.3 | Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. | Sep 23, 2026 |
| CVE-2026-96656 | HIGH | 7.2 | Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. | Sep 23, 2026 |
| CVE-2026-88771 | CRITICAL | 9.8 | Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. | Sep 27, 2026 |
| CVE-2026-88772 | HIGH | 8.1 | Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service | Sep 27, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. | Sep 22, 2026 |
| CVE-2026-71362 | CRITICAL | 9.1 | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. | Aug 11, 2026 |
| CVE-2026-65660 | HIGH | 8.8 | Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. | Aug 11, 2026 |
| CVE-2026-5430 | CRITICAL | 10.0 | WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. | Aug 6, 2026 |
| CVE-2026-85880 | HIGH | 7.8 | Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. | Sep 8, 2026 |
| CVE-2025-48384 | HIGH | 8.0 | Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files. | Jul 8, 2025 |
| CVE-2025-32432 | CRITICAL | 10.0 | Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. | Apr 25, 2025 |
| CVE-2024-48248 | HIGH | 8.6 | NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files. | Mar 4, 2025 |
| CVE-2025-43200 | MEDIUM | 4.2 | Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. | Jun 16, 2025 |