Exploited now
Known exploited vulnerabilities attackers are using right now
Every vulnerability CISA has added to its Known Exploited Vulnerabilities (KEV) catalog in the last 30 days, newest first. Each shows its EPSS score (the chance of exploitation in the next 30 days), whether it is used in ransomware, and CISA’s deadline for fixing it. If one of these is on your network, it goes to the top of the list.
Most affected this month: Plex (4), Cisco (3), Ahsay (2), Barracuda Networks (2), Google (2).
Every KEV addition in the last 30 days
Tuesday, November 102026-11-10 · 6 added
- CVE-2026-20320Cisco BroadWorks
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
- EPSS
- 0.4%
- CISA fix-by
- 2026-11-24
- CVE-2026-125350Google Chromium
Google Chromium Use-After-Free Vulnerability
- EPSS
- —
- CISA fix-by
- 2026-11-24
- CVE-2026-124194Microsoft Office
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- EPSS
- —
- CISA fix-by
- 2026-11-24
- CVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
- EPSS
- 1.6%
- CISA fix-by
- 2026-11-13
- CVE-2026-111793Openwave Messaging Limited Webtop Media Transcoder
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
- EPSS
- 0.3%
- CISA fix-by
- 2026-11-24
- CVE-2026-111560Barracuda Networks Multiple Products
Barracuda Networks Multiple Products OS Command Injection Vulnerability
- EPSS
- 1.1%
- CISA fix-by
- 2026-11-13
Monday, November 92026-11-09 · 4 added
- CVE-2026-123218IBM Aspera Faspex
IBM Aspera Faspex Incorrect Authorization Vulnerability
- EPSS
- 0.7%
- CISA fix-by
- 2026-11-12
- CVE-2026-123158OpenBSD OpenSSH
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
- EPSS
- 17%
- CISA fix-by
- 2026-11-12
- CVE-2026-116779SignalWire FreeSwitch
SignalWire FreeSwitch Code Injection Vulnerability
- EPSS
- 2.2%
- CISA fix-by
- 2026-11-12
- CVE-2026-102895GPUStack GPUStack
GPUStack Improper Authentication Vulnerability
- EPSS
- 0.6%
- CISA fix-by
- 2026-11-12
Friday, November 62026-11-06 · 1 added
- CVE-2026-19868SonicWall SonicOS SSLVPN
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- EPSS
- 0.5%
- CISA fix-by
- 2026-11-20
Wednesday, November 42026-11-04 · 1 added
- CVE-2024-27834Apple Multiple Products
Apple Multiple Products Improper Authentication Vulnerability
- EPSS
- 1.5%
- CISA fix-by
- 2026-11-18
Tuesday, November 32026-11-03 · 1 added
- CVE-2026-119977WordPress WordPress Core
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- EPSS
- 1.2%
- CISA fix-by
- 2026-11-06
Friday, October 302026-10-30 · 2 added
- CVE-2026-118527Ivanti Connect Secure
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- EPSS
- 0.8%
- CISA fix-by
- 2026-11-13
- CVE-2026-111357Ivanti Connect Secure
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- EPSS
- 0.5%
- CISA fix-by
- 2026-11-02
Thursday, October 292026-10-29 · 2 added
- CVE-2026-97229GitLab Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- EPSS
- 65%
- CISA fix-by
- 2026-11-01
- CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- EPSS
- 0.8%
- CISA fix-by
- 2026-11-01
Wednesday, October 282026-10-28 · 2 added
- CVE-2026-46300Linux Kernel
Linux Kernel Missing Initialization of a Variable Vulnerability
- EPSS
- 16%
- CISA fix-by
- 2026-10-31
- CVE-2026-41709Broadcom VMware ESX
Broadcom VMWare ESX Insufficient Logging Vulnerability
- EPSS
- 0.7%
- CISA fix-by
- 2026-11-11
Tuesday, October 272026-10-27 · 2 added
- CVE-2026-48356Adobe Commerce and Magento
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- EPSS
- 47%
- CISA fix-by
- 2026-11-10
- CVE-2026-111497Google Brotli
Google Brotli Unchecked Return Value Vulnerability
- EPSS
- 83%
- CISA fix-by
- 2026-11-10
Monday, October 262026-10-26 · 2 added
- CVE-2026-109619PHP Group PHP
PHP Stale Internal Request-State Vulnerability
- EPSS
- 100%
- CISA fix-by
- 2026-10-29
- CVE-2026-109618PHP Group PHP
PHP Memory Corruption Vulnerability
- EPSS
- 100%
- CISA fix-by
- 2026-10-29
Friday, October 232026-10-23 · 2 added
- CVE-2026-114625Arista VeloCloud Orchestrator
Arista VeloCloud Orchestrator SQL Injection Vulnerability
- EPSS
- 1.0%
- CISA fix-by
- 2026-10-26
- CVE-2026-110447Collabora Collabora Online – Built-in CODE Server
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
- EPSS
- 73%
- CISA fix-by
- 2026-10-26
Tuesday, October 202026-10-20 · 6 added
- CVE-2026-96656Plex Media Server
Plex Media Server External Control of File Name or Path Vulnerability
- EPSS
- 1.8%
- CISA fix-by
- 2026-10-23
- CVE-2026-96655Plex Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- EPSS
- 11%
- CISA fix-by
- 2026-11-03
- CVE-2026-96654Plex Media Server
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- EPSS
- 1.9%
- CISA fix-by
- 2026-10-23
- CVE-2026-96652Plex Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- EPSS
- 12%
- CISA fix-by
- 2026-11-03
- CVE-2026-110936Siemens Software Center
Siemens Software Center Uncontrolled Search Path Element Vulnerability
- EPSS
- 1.0%
- CISA fix-by
- 2026-11-03
- CVE-2026-106931EG Secure Solutions SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
- EPSS
- 2.5%
- CISA fix-by
- 2026-10-23
Friday, October 162026-10-16 · 2 added
- CVE-2026-102764BeyondTrust Remote Support
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- EPSS
- 78%
- CISA fix-by
- 2026-10-19
- CVE-2025-61624Fortinet Multiple Products
Fortinet Multiple Products Path Traversal Vulnerability
- EPSS
- 1.3%
- CISA fix-by
- 2026-10-19
Thursday, October 152026-10-15 · 1 added
- CVE-2026-21589Atlassian Multiple Products
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- EPSS
- 100%
- CISA fix-by
- 2026-10-18
Wednesday, October 142026-10-14 · 4 added
- CVE-2026-76519Cisco Secure Email Gateway
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- EPSS
- 6.2%
- CISA fix-by
- 2026-10-17
- CVE-2026-105134Ahsay AhsayCBS
Ahsay AhsayCBS Command Injection Vulnerability
- EPSS
- 82%
- CISA fix-by
- 2026-10-17
- CVE-2026-105133Ahsay AhsayCBS
Ahsay AhsayCBS Improper Authentication Vulnerability
- EPSS
- 84%
- CISA fix-by
- 2026-10-17
- CVE-2026-0322Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Code Injection Vulnerability
- EPSS
- 1.7%
- CISA fix-by
- 2026-10-17
Source: CISA Known Exploited Vulnerabilities catalog (version 2026.11.10), 1,779 entries in all; EPSS from FIRST, updated daily.
Known exploited vulnerabilities FAQ
What is a known exploited vulnerability?
A vulnerability that CISA, the US Cybersecurity and Infrastructure Security Agency, has evidence attackers are using in real attacks. CISA lists each one in its Known Exploited Vulnerabilities (KEV) catalog with a date by which US federal agencies must fix it. Everyone else uses the list to decide what to patch first.
How often does CISA add to the KEV catalog?
Several times a week, usually during US working hours, and often a few vulnerabilities at a time. This page picks up each addition within a few hours.
What's the difference between KEV and EPSS?
KEV says a vulnerability has already been exploited. EPSS, from FIRST, is the estimated chance it will be exploited in the next 30 days. A KEV entry with a high EPSS score is being used widely right now, not just in one attack.
What should I do if one of these is on my network?
Fix it before anything else of the same severity: apply the vendor's update or the mitigation CISA links to, then rescan to prove it's gone. CISA's fix-by date is a good deadline even if you aren't a federal agency.
How to read this
CISA lists a vulnerability only with evidence that attackers are using it. EPSS adds how likely more exploitation is in the next 30 days. A high EPSS on a KEV entry means it is being used widely, not just once.
What EPSS meansAre any of these on your network?
Upload a Nessus, Qualys, Rapid7 or OpenVAS export and Scan Hub puts every exploited finding at the top of the report, with the evidence and the fix.
Start free