CISA Known Exploited Vulnerabilities
The CISA Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of CVEs confirmed to be exploited in the wild. Under Binding Operational Directive 22-01, US federal civilian agencies must remediate each entry by its due date, which makes KEV additions the strongest patch-now signal in vulnerability management. CSIRTS.com flags every advisory that references a KEV-listed CVE as exploited.
CSIRTS.com ingests CISA Known Exploited Vulnerabilities every 3 hours, normalizes each advisory into a common schema and cross-references every CVE against the CISA KEV catalog and public exploit datasets. Publishes catalog additions with required remediation dates. Also available via RSS, JSON API and the MCP server.
Latest from CISA Known Exploited Vulnerabilities
CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability
CVE-2026-72530: TrueConf Server Code Injection Vulnerability
CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability
CVE-2026-65400: Apple macOS Improper Authentication Vulnerability
CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability
CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability
CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability
CVE-2026-72898: Metabase SQL Injection Vulnerability
CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability
CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
CVE-2026-9198: IBM Langflow Code Injection Vulnerability
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability
Browse all 1,676 advisories from CISA Known Exploited Vulnerabilities →
Never miss a CISA Known Exploited Vulnerabilities advisory. The daily briefing covers every new advisory from this source — alongside the other feeds we watch for you. Subscribe free — one email every morning after 06:00 UTC, one-click unsubscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.