Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read… | GitLab / Community Edition and Enterprise Edition | Sep 11, 2026 | — | View → |
| CVE-2026-67277 | MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial… | MikroTik / RouterOS | Sep 10, 2026 | — | View → |
| CVE-2026-86060 | MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change… | MikroTik / RouterOS | Sep 10, 2026 | — | View → |
| CVE-2025-25249 | Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute… | Fortinet / Multiple Products | Sep 9, 2026 | — | View → |
| CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the… | Citrix / NetScaler | Sep 9, 2026 | — | View → |
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an… | Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Sep 9, 2026 | — | View → |
| CVE-2026-87491 | Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the… | Google / Chromium V8 | Sep 9, 2026 | — | View → |
| CVE-2026-75650 | Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that… | Adobe / Commerce and Magento | Sep 8, 2026 | — | View → |
| CVE-2026-81963 | Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to… | Microsoft / Windows | Sep 8, 2026 | — | View → |
| CVE-2026-85880 | Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate… | Microsoft / Windows | Sep 8, 2026 | — | View → |
| CVE-2026-86218 | N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. | N-able / N-central | Sep 8, 2026 | — | View → |
| CVE-2026-85046 | Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via… | Google / Chromium V8 | Sep 4, 2026 | — | View → |
| CVE-2026-48710 | Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part,… | Kludex / Starlette | Sep 2, 2026 | — | View → |
| CVE-2026-49869 | Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute… | Kestra / Kestra OSS | Sep 2, 2026 | — | View → |
| CVE-2026-59822 | BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated… | BerriAI / LiteLLM | Sep 2, 2026 | — | View → |
| CVE-2026-82329 | JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker… | JFrog / Artifactory | Sep 2, 2026 | — | View → |
| CVE-2026-83548 | SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to… | SonicWall / SMA1000 Appliances | Sep 2, 2026 | — | View → |
| CVE-2026-83549 | SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as… | SonicWall / SMA1000 Appliances | Sep 2, 2026 | — | View → |
| CVE-2026-9586 | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL… | Sangoma / Switchvox | Sep 2, 2026 | — | View → |
| CVE-2026-81578 | PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to… | PaperCut / NG/MF | Aug 31, 2026 | — | View → |