Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-39808 | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized… | Fortinet / FortiSandbox | Jul 16, 2026 | — | View → |
| CVE-2026-58644 | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over… | Microsoft / SharePoint | Jul 16, 2026 | — | View → |
| CVE-2023-4346 | KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that… | KNX Association / KNX Protocol Connection Authorization Option 1 | Jul 15, 2026 | — | View → |
| CVE-2026-46817 | Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network… | Oracle / E-Business Suite | Jul 15, 2026 | — | View → |
| CVE-2026-15409 | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to… | SonicWall / SMA1000 Appliances | Jul 14, 2026 | Ransomware | View → |
| CVE-2026-15410 | SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote… | SonicWall / SMA1000 Appliances | Jul 14, 2026 | Ransomware | View → |
| CVE-2026-56155 | Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an… | Microsoft / Active Directory Federation Services | Jul 14, 2026 | — | View → |
| CVE-2026-56164 | Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate… | Microsoft / SharePoint Server | Jul 14, 2026 | — | View → |
| CVE-2008-4128 | Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a… | Cisco / IOS | Jul 13, 2026 | — | View → |
| CVE-2026-48939 | iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file… | iCagenda / iCagenda | Jul 10, 2026 | — | View → |
| CVE-2026-56291 | Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file… | Balbooa / Forms | Jul 10, 2026 | — | View → |
| CVE-2026-48282 | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. | Adobe / ColdFusion | Jul 7, 2026 | — | View → |
| CVE-2026-48908 | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to… | JoomShaper / SP Page Builder | Jul 7, 2026 | — | View → |
| CVE-2026-55255 | Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any… | Langflow / Langflow | Jul 7, 2026 | — | View → |
| CVE-2026-56290 | Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated… | Joomlack / Page Builder | Jul 7, 2026 | — | View → |
| CVE-2026-45659 | Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code… | Microsoft / SharePoint Server | Jul 1, 2026 | Ransomware | View → |
| CVE-2026-48558 | SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured,… | SimpleHelp / SimpleHelp | Jun 29, 2026 | — | View → |
| CVE-2026-12569 | PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute… | PTC / Windchill and FlexPLM | Jun 25, 2026 | Ransomware | View → |
| CVE-2026-20230 | Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME)… | Cisco / Unified Communications Manager | Jun 25, 2026 | — | View → |
| CVE-2025-67038 | Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username… | Lantronix / EDS5000 | Jun 23, 2026 | — | View → |