Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2012-1854 | Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution. | Microsoft / Visual Basic for Applications (VBA) | Apr 13, 2026 | — | View → |
| CVE-2020-9715 | Adobe Acrobat contains a use-after-free vulnerability that allows for code execution | Adobe / Acrobat | Apr 13, 2026 | — | View → |
| CVE-2023-21529 | Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code… | Microsoft / Exchange Server | Apr 13, 2026 | Ransomware | View → |
| CVE-2023-36424 | Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for… | Microsoft / Windows | Apr 13, 2026 | — | View → |
| CVE-2025-60710 | Microsoft Windows contains a link following vulnerability that allows for privilege escalation | Microsoft / Windows | Apr 13, 2026 | Ransomware | View → |
| CVE-2026-21643 | Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or… | Fortinet / FortiClient EMS | Apr 13, 2026 | — | View → |
| CVE-2026-34621 | Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. | Adobe / Acrobat and Reader | Apr 13, 2026 | — | View → |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote… | Ivanti / Endpoint Manager Mobile (EPMM) | Apr 8, 2026 | — | View → |
| CVE-2026-35616 | Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute… | Fortinet / FortiClient EMS | Apr 6, 2026 | — | View → |
| CVE-2026-3502 | TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update… | TrueConf / Client | Apr 2, 2026 | — | View → |
| CVE-2026-5281 | Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to… | Google / Dawn | Apr 1, 2026 | — | View → |
| CVE-2026-3055 | Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an… | Citrix / NetScaler | Mar 30, 2026 | — | View → |
| CVE-2025-53521 | F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. | F5 / BIG-IP | Mar 27, 2026 | — | View → |
| CVE-2026-33634 | Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the… | Aquasecurity / Trivy | Mar 26, 2026 | — | View → |
| CVE-2026-33017 | Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. | Langflow / Langflow | Mar 25, 2026 | — | View → |
| CVE-2025-31277 | Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of… | Apple / Multiple Products | Mar 20, 2026 | — | View → |
| CVE-2025-32432 | Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. | Craft CMS / Craft CMS | Mar 20, 2026 | — | View → |
| CVE-2025-43510 | Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application… | Apple / Multiple Products | Mar 20, 2026 | — | View → |
| CVE-2025-43520 | Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious… | Apple / Multiple Products | Mar 20, 2026 | — | View → |
| CVE-2025-54068 | Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in… | Laravel / Livewire | Mar 20, 2026 | — | View → |