The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-20349 | HIGH | 8.6 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. | Aug 11, 2026 |
| CVE-2026-20316 | MEDIUM | 5.3 | Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. | Jul 29, 2026 |
| CVE-2026-20079 | CRITICAL | 10.0 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. | Mar 4, 2026 |
| CVE-2026-76461 | CRITICAL | 9.8 | Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. | Sep 14, 2026 |
| CVE-2026-65400 | CRITICAL | 9.8 | Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. | Aug 6, 2026 |
| CVE-2026-82078 | CRITICAL | 9.1 | PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. | Aug 28, 2026 |
| CVE-2026-81578 | CRITICAL | 9.8 | PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078. | Aug 28, 2026 |
| CVE-2026-84869 | CRITICAL | 9.9 | ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. | Sep 8, 2026 |
| CVE-2026-42018 | HIGH | 7.5 | JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | Aug 12, 2026 |
| CVE-2026-42016 | HIGH | 8.1 | JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. | Jul 27, 2026 |
| CVE-2026-67277 | HIGH | 8.2 | MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. | Sep 5, 2026 |
| CVE-2026-86060 | CRITICAL | 9.8 | MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. | Sep 5, 2026 |
| CVE-2026-86218 | CRITICAL | 9.8 | N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. | Sep 6, 2026 |
| CVE-2026-81963 | HIGH | 7.8 | Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. | Sep 8, 2026 |
| CVE-2026-75650 | CRITICAL | 10.0 | Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. | Sep 7, 2026 |
| CVE-2025-14733 | CRITICAL | 9.8 | WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. | Dec 19, 2025 |
| CVE-2025-67038 | CRITICAL | 9.8 | Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. | Mar 11, 2026 |
| CVE-2025-38352 | HIGH | 7.8 | Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability. | Jul 22, 2025 |
| CVE-2026-67279 | UNKNOWN | — | Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. | Sep 5, 2026 |
| CVE-2026-31431 | HIGH | 7.8 | Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. | Apr 22, 2026 |
| CVE-2026-48710 | MEDIUM | 6.5 | Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. | May 26, 2026 |
| CVE-2023-50224 | MEDIUM | 6.5 | TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. | May 3, 2024 |
| CVE-2026-9586 | CRITICAL | 9.8 | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. | Jul 17, 2026 |
| CVE-2026-83548 | CRITICAL | 10.0 | SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. | Sep 1, 2026 |
| CVE-2026-82329 | CRITICAL | 9.8 | JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. | Aug 28, 2026 |