Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-45321 | TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to… | TanStack / TanStack | May 27, 2026 | Ransomware | View → |
| CVE-2026-48027 | Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The… | Nx / Nx Console | May 27, 2026 | Ransomware | View → |
| CVE-2026-8398 | Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability. | Daemon / Daemon Tools Lite | May 27, 2026 | — | View → |
| CVE-2026-48172 | LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by… | LiteSpeed / cPanel Plugin | May 26, 2026 | — | View → |
| CVE-2026-9082 | Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially… | Drupal / Core | May 22, 2026 | — | View → |
| CVE-2025-34291 | Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token… | Langflow / Langflow | May 21, 2026 | — | View → |
| CVE-2026-34926 | Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to… | Trend Micro / Apex One | May 21, 2026 | — | View → |
| CVE-2008-4250 | Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary… | Microsoft / Windows | May 20, 2026 | — | View → |
| CVE-2009-1537 | Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which… | Microsoft / DirectX | May 20, 2026 | — | View → |
| CVE-2009-3459 | Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code… | Adobe / Acrobat and Reader | May 20, 2026 | — | View → |
| CVE-2010-0249 | Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by… | Microsoft / Internet Explorer | May 20, 2026 | — | View → |
| CVE-2010-0806 | Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via… | Microsoft / Internet Explorer | May 20, 2026 | — | View → |
| CVE-2026-41091 | Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. | Microsoft / Defender | May 20, 2026 | — | View → |
| CVE-2026-45498 | Microsoft Defender contains an unspecified vulnerability that allows for denial of service. | Microsoft / Defender | May 20, 2026 | — | View → |
| CVE-2026-42897 | Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain… | Microsoft / Microsoft | May 15, 2026 | — | View → |
| CVE-2026-20182 | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker… | Cisco / Catalyst SD-WAN | May 14, 2026 | — | View → |
| CVE-2026-42208 | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially… | BerriAI / LiteLLM | May 8, 2026 | — | View → |
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with… | Ivanti / Endpoint Manager Mobile (EPMM) | May 7, 2026 | — | View → |
| CVE-2026-0300 | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service… | Palo Alto Networks / PAN-OS | May 6, 2026 | — | View → |
| CVE-2026-31431 | Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. | Linux / Kernel | May 1, 2026 | — | View → |