Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-41940 | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that… | WebPros / cPanel & WHM and WP2 (WordPress Squared) | Apr 30, 2026 | Ransomware | View → |
| CVE-2024-1708 | ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact… | ConnectWise / ScreenConnect | Apr 28, 2026 | Ransomware | View → |
| CVE-2026-32202 | Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing… | Microsoft / Windows | Apr 28, 2026 | — | View → |
| CVE-2024-57726 | SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive… | SimpleHelp / SimpleHelp | Apr 24, 2026 | Ransomware | View → |
| CVE-2024-57728 | SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by… | SimpleHelp / SimpleHelp | Apr 24, 2026 | Ransomware | View → |
| CVE-2024-7399 | Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system… | Samsung / MagicINFO 9 Server | Apr 24, 2026 | — | View → |
| CVE-2025-29635 | D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote… | D-Link / DIR-823X | Apr 24, 2026 | — | View → |
| CVE-2026-39987 | Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute… | Marimo / Marimo | Apr 23, 2026 | — | View → |
| CVE-2026-33825 | Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to… | Microsoft / Defender | Apr 22, 2026 | Ransomware | View → |
| CVE-2023-27351 | PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected… | PaperCut / NG/MF | Apr 20, 2026 | Ransomware | View → |
| CVE-2024-27199 | JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. | JetBrains / TeamCity | Apr 20, 2026 | Ransomware | View → |
| CVE-2025-2749 | Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary… | Kentico / Kentico Xperience | Apr 20, 2026 | — | View → |
| CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate… | Quest / KACE Systems Management Appliance (SMA) | Apr 20, 2026 | — | View → |
| CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary… | Synacor / Zimbra Collaboration Suite (ZCS) | Apr 20, 2026 | — | View → |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API… | Cisco / Catalyst SD-WAN Manger | Apr 20, 2026 | — | View → |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local… | Cisco / Catalyst SD-WAN Manager | Apr 20, 2026 | — | View → |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote… | Cisco / Catalyst SD-WAN Manager | Apr 20, 2026 | — | View → |
| CVE-2026-34197 | Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. | Apache / ActiveMQ | Apr 16, 2026 | — | View → |
| CVE-2009-0238 | Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected… | Microsoft / Office | Apr 14, 2026 | — | View → |
| CVE-2026-32201 | Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing… | Microsoft / SharePoint Server | Apr 14, 2026 | — | View → |