Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a… | Cisco / Secure Firewall Management Center (FMC) | Mar 19, 2026 | Ransomware | View → |
| CVE-2025-66376 | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse… | Synacor / Zimbra Collaboration Suite (ZCS) | Mar 18, 2026 | — | View → |
| CVE-2026-20963 | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over… | Microsoft / SharePoint | Mar 18, 2026 | — | View → |
| CVE-2025-47813 | Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID… | Wing FTP Server / Wing FTP Server | Mar 16, 2026 | — | View → |
| CVE-2026-3909 | Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a… | Google / Skia | Mar 13, 2026 | — | View → |
| CVE-2026-3910 | Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a… | Google / Chromium V8 | Mar 13, 2026 | — | View → |
| CVE-2025-68613 | n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that… | n8n / n8n | Mar 11, 2026 | — | View → |
| CVE-2021-22054 | Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that… | Omnissa / Workspace One UEM | Mar 9, 2026 | — | View → |
| CVE-2025-26399 | SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run… | SolarWinds / Web Help Desk | Mar 9, 2026 | Ransomware | View → |
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote… | Ivanti / Endpoint Manager (EPM) | Mar 9, 2026 | — | View → |
| CVE-2017-7921 | Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on… | Hikvision / Multiple Products | Mar 5, 2026 | — | View → |
| CVE-2021-22681 | Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a… | Rockwell / Multiple Products | Mar 5, 2026 | — | View → |
| CVE-2021-30952 | Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously… | Apple / Multiple Products | Mar 5, 2026 | — | View → |
| CVE-2023-41974 | Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges. | Apple / iOS and iPadOS | Mar 5, 2026 | — | View → |
| CVE-2023-43000 | Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content… | Apple / Multiple Products | Mar 5, 2026 | — | View → |
| CVE-2026-21385 | Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation. | Qualcomm / Multiple Chipsets | Mar 3, 2026 | — | View → |
| CVE-2026-22719 | Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an… | Broadcom / VMware Aria Operations | Mar 3, 2026 | — | View → |
| CVE-2022-20775 | Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via… | Cisco / SD-WAN | Feb 25, 2026 | — | View → |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an… | Cisco / Catalyst SD-WAN Controller and Manager | Feb 25, 2026 | — | View → |
| CVE-2026-25108 | Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a… | Soliton Systems K.K / FileZen | Feb 24, 2026 | — | View → |