Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-34908 | Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make… | Ubiquiti / UniFi OS | Jun 23, 2026 | — | View → |
| CVE-2026-34909 | Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files… | Ubiquiti / UniFi OS | Jun 23, 2026 | — | View → |
| CVE-2026-34910 | Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to… | Ubiquiti / UniFi OS | Jun 23, 2026 | — | View → |
| CVE-2026-20253 | Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to… | Splunk / Enterprise | Jun 18, 2026 | — | View → |
| CVE-2026-48907 | Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP… | Widget Factory / Joomla Content Editor | Jun 16, 2026 | — | View → |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to… | Cisco / Catalyst SD-WAN Manager | Jun 15, 2026 | — | View → |
| CVE-2026-54420 | LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell… | LiteSpeed / cPanel Plugin | Jun 15, 2026 | — | View → |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an… | Oracle / PeopleSoft Enterprise PeopleTools | Jun 12, 2026 | Ransomware | View → |
| CVE-2026-10520 | Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote… | Ivanti / Sentry | Jun 11, 2026 | — | View → |
| CVE-2026-11645 | Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a… | Google / Chromium V8 | Jun 9, 2026 | — | View → |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This… | Cisco / Catalyst SD-WAN Manager | Jun 9, 2026 | — | View → |
| CVE-2026-7473 | Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly… | Arista / Extensible Operating System | Jun 9, 2026 | — | View → |
| CVE-2026-42271 | BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege… | BerriAI / LiteLLM | Jun 8, 2026 | — | View → |
| CVE-2026-50751 | Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated… | Check Point / Security Gateway | Jun 8, 2026 | Ransomware | View → |
| CVE-2026-28318 | SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the… | SolarWinds / Serv-U | Jun 5, 2026 | — | View → |
| CVE-2026-45247 | Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to… | Mirasvit / Mirasvit Full Page Cache Warmer | Jun 3, 2026 | — | View → |
| CVE-2022-0492 | Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent… | Linux / Kernel | Jun 2, 2026 | — | View → |
| CVE-2025-48595 | Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. | Android / Framework | Jun 2, 2026 | — | View → |
| CVE-2024-21182 | Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to… | Oracle / WebLogic Server | Jun 1, 2026 | — | View → |
| CVE-2026-0257 | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and… | Palo Alto Networks / PAN-OS | May 29, 2026 | Ransomware | View → |