Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.2 High severity | SimpleHelp Path Traversal CVE-2024-57728 | Apr 24, 2026 | May 8, 2026 | Known |
| 9.9 Critical severity | SimpleHelp Missing Authorization CVE-2024-57726 | Apr 24, 2026 | May 8, 2026 | Known |
| 9.8 Critical severity | Marimo Remote Code Execution CVE-2026-39987 | Apr 23, 2026 | May 7, 2026 | Not reported |
| 7.8 High severity | Microsoft Defender Insufficient Granularity of Access Control CVE-2026-33825 | Apr 22, 2026 | May 6, 2026 | Known |
| 7.5 High severity | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-20133 | Apr 20, 2026 | Apr 23, 2026 | Not reported |
| 7.5 High severity | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format CVE-2026-20128 | Apr 20, 2026 | Apr 23, 2026 | Not reported |
| 5.4 Medium severity | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs CVE-2026-20122 | Apr 20, 2026 | Apr 23, 2026 | Not reported |
| 6.1 Medium severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting CVE-2025-48700 | Apr 20, 2026 | Apr 23, 2026 | Not reported |
| 10.0 Critical severity | Quest KACE Systems Management Appliance (SMA) Improper Authentication CVE-2025-32975 | Apr 20, 2026 | May 4, 2026 | Not reported |
| 7.2 High severity | Kentico Xperience Path Traversal CVE-2025-2749 | Apr 20, 2026 | May 4, 2026 | Not reported |
| 7.3 High severity | JetBrains TeamCity Relative Path Traversal CVE-2024-27199 | Apr 20, 2026 | May 4, 2026 | Known |
| 7.5 High severity | PaperCut NG/MF Improper Authentication CVE-2023-27351 | Apr 20, 2026 | May 4, 2026 | Known |
| 8.8 High severity | Apache ActiveMQ Improper Input Validation CVE-2026-34197 | Apr 16, 2026 | Apr 30, 2026 | Not reported |
| 6.5 Medium severity | Microsoft SharePoint Server Improper Input Validation CVE-2026-32201 | Apr 14, 2026 | Apr 28, 2026 | Not reported |
| 9.3 High severity | Microsoft Office Remote Code Execution CVE-2009-0238 | Apr 14, 2026 | Apr 28, 2026 | Not reported |
| 8.6 High severity | Adobe Acrobat and Reader Prototype Pollution CVE-2026-34621 | Apr 13, 2026 | Apr 27, 2026 | Not reported |
| 9.8 Critical severity | Fortinet FortiClient EMS SQL Injection CVE-2026-21643 | Apr 13, 2026 | Apr 16, 2026 | Not reported |
| 7.8 High severity | Microsoft Windows Link Following CVE-2025-60710 | Apr 13, 2026 | Apr 27, 2026 | Known |
| 7.8 High severity | Microsoft Windows Out-of-Bounds Read CVE-2023-36424 | Apr 13, 2026 | Apr 27, 2026 | Not reported |
| 8.8 High severity | Microsoft Exchange Server Deserialization of Untrusted Data CVE-2023-21529 | Apr 13, 2026 | Apr 27, 2026 | Known |
| 7.8 High severity | Adobe Acrobat Use-After-Free CVE-2020-9715 | Apr 13, 2026 | Apr 27, 2026 | Not reported |
| 6.9 Medium severity | Microsoft Visual Basic for Applications Insecure Library Loading CVE-2012-1854 | Apr 13, 2026 | Apr 27, 2026 | Not reported |
| 9.8 Critical severity | Ivanti Endpoint Manager Mobile (EPMM) Code Injection CVE-2026-1340 | Apr 8, 2026 | Apr 11, 2026 | Not reported |
| 9.8 Critical severity | Fortinet FortiClient EMS Improper Access Control CVE-2026-35616 | Apr 6, 2026 | Apr 9, 2026 | Not reported |
| 7.8 High severity | TrueConf Client Download of Code Without Integrity Check CVE-2026-3502 | Apr 2, 2026 | Apr 16, 2026 | Not reported |
| 8.8 High severity | Google Dawn Use-After-Free CVE-2026-5281 | Apr 1, 2026 | Apr 15, 2026 | Not reported |
| 9.8 Critical severity | Citrix NetScaler Out-of-Bounds Read CVE-2026-3055 | Mar 30, 2026 | Apr 2, 2026 | Not reported |
| 9.8 Critical severity | F5 BIG-IP Stack-Based Buffer Overflow CVE-2025-53521 | Mar 27, 2026 | Mar 30, 2026 | Not reported |
| 8.8 High severity | Aquasecurity Trivy Embedded Malicious Code CVE-2026-33634 | Mar 26, 2026 | Apr 9, 2026 | Not reported |
| 9.8 Critical severity | Langflow Code Injection CVE-2026-33017 | Mar 25, 2026 | Apr 8, 2026 | Not reported |
| 9.8 Critical severity | Laravel Livewire Code Injection CVE-2025-54068 | Mar 20, 2026 | Apr 3, 2026 | Not reported |
| 5.5 Medium severity | Apple Multiple Products Classic Buffer Overflow CVE-2025-43520 | Mar 20, 2026 | Apr 3, 2026 | Not reported |
| 7.8 High severity | Apple Multiple Products Improper Locking CVE-2025-43510 | Mar 20, 2026 | Apr 3, 2026 | Not reported |
| 10.0 Critical severity | Craft CMS Code Injection CVE-2025-32432 | Mar 20, 2026 | Apr 3, 2026 | Not reported |
| 8.8 High severity | Apple Multiple Products Buffer Overflow CVE-2025-31277 | Mar 20, 2026 | Apr 3, 2026 | Not reported |
| 10.0 Critical severity | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data CVE-2026-20131 | Mar 19, 2026 | Mar 22, 2026 | Known |
| 9.8 Critical severity | Microsoft SharePoint Deserialization of Untrusted Data CVE-2026-20963 | Mar 18, 2026 | Mar 21, 2026 | Not reported |
| 6.1 Medium severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting CVE-2025-66376 | Mar 18, 2026 | Apr 1, 2026 | Not reported |
| 4.3 Medium severity | Wing FTP Server Information Disclosure CVE-2025-47813 | Mar 16, 2026 | Mar 30, 2026 | Not reported |
| 8.8 High severity | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer CVE-2026-3910 | Mar 13, 2026 | Mar 27, 2026 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.