Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-65660 | Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. | Microsoft / SharePoint | Sep 25, 2026 | — | View → |
| CVE-2026-67279 | Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open… | MikroTik / RouterOS | Sep 25, 2026 | — | View → |
| CVE-2026-87902 | WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template… | WordPress / Core | Sep 25, 2026 | — | View → |
| CVE-2026-5430 | WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for… | WSO2 / Multiple Products | Sep 24, 2026 | — | View → |
| CVE-2026-71362 | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability… | Adobe / Commerce and Magento | Sep 24, 2026 | — | View → |
| CVE-2026-85102 | Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate… | Check Point / Multiple Products | Sep 22, 2026 | — | View → |
| CVE-2026-93616 | Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent… | Check Point / Multiple Products | Sep 22, 2026 | — | View → |
| CVE-2026-93952 | Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access… | Arista / VeloCloud Orchestrator | Sep 22, 2026 | — | View → |
| CVE-2026-94127 | F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual… | F5 / BIG-IP APM | Sep 22, 2026 | — | View → |
| CVE-2026-7273 | Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based,… | Zyxel / GS1900 Series Switches | Sep 21, 2026 | — | View → |
| CVE-2025-39682 | Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a… | Linux / Kernel | Sep 18, 2026 | — | View → |
| CVE-2025-39964 | Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be… | Linux / Kernel | Sep 18, 2026 | — | View → |
| CVE-2026-53266 | Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite… | Linux / Kernel | Sep 18, 2026 | — | View → |
| CVE-2026-58704 | Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass… | Google / Pixel | Sep 16, 2026 | — | View → |
| CVE-2026-76460 | Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs… | Cisco / Identity Services Engine | Sep 16, 2026 | — | View → |
| CVE-2026-87886 | Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow… | Acronis / Backup | Sep 16, 2026 | — | View → |
| CVE-2026-76461 | Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated,… | Cisco / Secure Email Gateway | Sep 14, 2026 | — | View → |
| CVE-2026-42016 | JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check… | JFrog / Artifactory | Sep 11, 2026 | — | View → |
| CVE-2026-42018 | JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an… | JFrog / Artifactory | Sep 11, 2026 | — | View → |
| CVE-2026-84869 | ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an… | ConnectWise / ScreenConnect | Sep 11, 2026 | — | View → |