Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 8.5 High severity | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following CVE-2026-54420 | Jun 15, 2026 | Jun 18, 2026 | Not reported |
| 6.5 Medium severity | Cisco Catalyst SD-WAN Manager Directory or Path Traversal CVE-2026-20262 | Jun 15, 2026 | Jun 29, 2026 | Not reported |
| 9.8 Critical severity | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function CVE-2026-35273 | Jun 12, 2026 | Jun 15, 2026 | Known |
| 10.0 Critical severity | Ivanti Sentry OS Command Injection CVE-2026-10520 | Jun 11, 2026 | Jun 14, 2026 | Not reported |
| 5.8 Medium severity | Arista Extensible Operating System Incomplete Comparison with Missing Factors CVE-2026-7473 | Jun 9, 2026 | Jun 23, 2026 | Not reported |
| 7.8 High severity | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output CVE-2026-20245 | Jun 9, 2026 | Jun 23, 2026 | Not reported |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Read and Write CVE-2026-11645 | Jun 9, 2026 | Jun 23, 2026 | Not reported |
| 9.3 Critical severity | Check Point Security Gateway Improper Authentication CVE-2026-50751 | Jun 8, 2026 | Jun 11, 2026 | Known |
| 8.8 High severity | BerriAI LiteLLM Command Injection CVE-2026-42271 | Jun 8, 2026 | Jun 22, 2026 | Not reported |
| 7.5 High severity | SolarWinds Serv-U Uncontrolled Resource Consumption CVE-2026-28318 | Jun 5, 2026 | Jun 19, 2026 | Not reported |
| 9.8 Critical severity | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data CVE-2026-45247 | Jun 3, 2026 | Jun 6, 2026 | Not reported |
| 8.4 High severity | Android Framework Integer Overflow CVE-2025-48595 | Jun 2, 2026 | Jun 5, 2026 | Not reported |
| 7.8 High severity | Linux Kernel Improper Authentication CVE-2022-0492 | Jun 2, 2026 | Jun 5, 2026 | Not reported |
| 7.5 High severity | Oracle WebLogic Server Unspecified CVE-2024-21182 | Jun 1, 2026 | Jun 4, 2026 | Not reported |
| 9.1 Critical severity | Palo Alto Networks PAN-OS Authentication Bypass CVE-2026-0257 | May 29, 2026 | Jun 1, 2026 | Known |
| 9.8 Critical severity | Daemon Tools Lite Embedded Malicious Code CVE-2026-8398 | May 27, 2026 | May 30, 2026 | Not reported |
| 9.8 Critical severity | Nx Console Embedded Malicious Code CVE-2026-48027 | May 27, 2026 | Jun 10, 2026 | Known |
| 9.6 Critical severity | TanStack Unspecified CVE-2026-45321 | May 27, 2026 | Jun 10, 2026 | Known |
| 9.8 Critical severity | LiteSpeed cPanel Plugin Privilege Escalation CVE-2026-48172 | May 26, 2026 | May 29, 2026 | Not reported |
| 9.8 Critical severity | Drupal Core SQL Injection CVE-2026-9082 | May 22, 2026 | May 27, 2026 | Not reported |
| 6.7 Medium severity | Trend Micro Apex One (On-Premise) Directory Traversal CVE-2026-34926 | May 21, 2026 | Jun 4, 2026 | Not reported |
| 8.8 High severity | Langflow Origin Validation Error CVE-2025-34291 | May 21, 2026 | Jun 4, 2026 | Not reported |
| 7.5 High severity | Microsoft Defender Denial of Service CVE-2026-45498 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 7.8 High severity | Microsoft Defender Link Following CVE-2026-41091 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 9.3 High severity | Microsoft Internet Explorer Use-After-Free CVE-2010-0806 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Use-After-Free CVE-2010-0249 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 9.3 High severity | Adobe Acrobat and Reader Heap-Based Buffer Overflow CVE-2009-3459 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 9.3 High severity | Microsoft DirectX NULL Byte Overwrite CVE-2009-1537 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 10.0 High severity | Microsoft Windows Buffer Overflow CVE-2008-4250 | May 20, 2026 | Jun 3, 2026 | Not reported |
| 6.1 Medium severity | Microsoft Exchange Server Cross-Site Scripting CVE-2026-42897 | May 15, 2026 | May 29, 2026 | Not reported |
| 10.0 Critical severity | Cisco Catalyst SD-WAN Controller Authentication Bypass CVE-2026-20182 | May 14, 2026 | May 17, 2026 | Not reported |
| 9.8 Critical severity | BerriAI LiteLLM SQL Injection CVE-2026-42208 | May 8, 2026 | May 11, 2026 | Not reported |
| 7.2 High severity | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation CVE-2026-6973 | May 7, 2026 | May 10, 2026 | Not reported |
| 9.8 Critical severity | Palo Alto Networks PAN-OS Out-of-bounds Write CVE-2026-0300 | May 6, 2026 | May 9, 2026 | Not reported |
| 7.8 High severity | Linux Kernel Incorrect Resource Transfer Between Spheres CVE-2026-31431 | May 1, 2026 | May 15, 2026 | Not reported |
| 9.8 Critical severity | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function CVE-2026-41940 | Apr 30, 2026 | May 3, 2026 | Known |
| 4.3 Medium severity | Microsoft Windows Protection Mechanism Failure CVE-2026-32202 | Apr 28, 2026 | May 12, 2026 | Not reported |
| 8.4 High severity | ConnectWise ScreenConnect Path Traversal CVE-2024-1708 | Apr 28, 2026 | May 12, 2026 | Known |
| 7.2 High severity | D-Link DIR-823X Command Injection CVE-2025-29635 | Apr 24, 2026 | May 8, 2026 | Not reported |
| 9.8 Critical severity | Samsung MagicINFO 9 Server Path Traversal CVE-2024-7399 | Apr 24, 2026 | May 8, 2026 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.