$ kev-tracker
Known Exploited Vulnerabilities Tracker
Every CVE on CISA's live Known Exploited Vulnerabilities catalog, synced directly — not just the ones we've written full articles about — plus other confirmed actively-exploited vulnerabilities. CVSS is NVD's score; EPSS is FIRST.org's modeled 30-day exploitation probability. Filter and sort client-side — nothing leaves your browser.
| CVE ID | Severity | Vendor / Product | CVSS | EPSS | Status | Published | Source |
|---|---|---|---|---|---|---|---|
| CVE-2026-25089 | [ CRITICAL ] | Fortinet / FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS (multiple 4.x and 5.0 lines — see body) | 9.8 | — | kev | Jul 16 | [src] |
| CVE-2026-46817 | [ CRITICAL ] | Oracle / E-Business Suite — Oracle Payments (versions 12.2.3–12.2.15) | 9.8 | — | kev | Jul 15 | [src] |
| CVE-2026-15409 | [ CRITICAL ] | SonicWall / SMA1000 Series (6210, 7210, 8200v) | 10.0 | — | kev | Jul 14 | [src] |
| CVE-2026-15410 | [ HIGH ] | SonicWall / SMA1000 Series (6210, 7210, 8200v) | 7.2 | — | kev | Jul 14 | [src] |
| CVE-2026-56155 | [ HIGH ] | Microsoft / Active Directory Federation Services (AD FS) — see MSRC advisory for affected builds | 7.8 | — | kev | Jul 14 | [src] |
| CVE-2026-56164 | [ MEDIUM ] | Microsoft / Microsoft SharePoint Server (see MSRC advisory for affected builds) | 5.3 | — | kev | Jul 14 | [src] |
| CVE-2026-58644 | [ CRITICAL ] | Microsoft / SharePoint Server 2016 / 2019 / Subscription Edition | 9.8 | — | kev | Jul 14 | [src] |
| CVE-2026-6875 | [ CRITICAL ] | ServiceNow / ServiceNow AI Platform | 9.5 | — | exploited-in-wild | Jul 13 | [src] |
| CVE-2026-56291 | [ CRITICAL ] | Balbooa / Forms (Joomla extension, com_baforms) | 9.8 | — | kev | Jul 9 | [src] |
| CVE-2026-48908 | [ CRITICAL ] | JoomShaper / SP Page Builder (Joomla extension) | 9.8 | 0.8% | kev | Jul 7 | [src] |
| CVE-2026-55255 | [ HIGH ] | Langflow / Langflow (versions before 1.9.1) | 8.4 | 0.2% | kev | Jul 7 | [src] |
| CVE-2026-56290 | [ CRITICAL ] | Joomlack / Page Builder (Joomla extension) | 9.8 | 0.4% | kev | Jul 7 | [src] |
| CVE-2026-45659 | [ HIGH ] | Microsoft / SharePoint Server (on-premises) | 8.8 | 3.2% | kev | Jul 2 | [src] |
| CVE-2026-48282 | [ CRITICAL ] | Adobe / ColdFusion (2023 through update 20; 2025 through update 9) | 10.0 | 1.0% | kev | Jun 30 | [src] |
| CVE-2026-48558 | [ CRITICAL ] | SimpleHelp / SimpleHelp Server | 10.0 | 1.2% | kev | Jun 29 | [src] |
| CVE-2026-20896 | [ CRITICAL ] | Gitea / Gitea Docker image (1.26.2 and earlier) | 9.8 | 0.8% | exploited-in-wild | Jun 23 | [src] |
| CVE-2026-48939 | [ CRITICAL ] | iCagenda / iCagenda (Joomla extension) | 9.8 | — | kev | Jun 20 | [src] |
| CVE-2026-12569 | [ CRITICAL ] | PTC / Windchill PDMLink and FlexPLM (see body for affected version ranges) | 9.8 | 1.2% | kev | Jun 17 | [src] |
| CVE-2026-8037 | [ CRITICAL ] | Progress Software / Kemp LoadMaster (GA and LTSF branches) | 9.6 | 29.6% | exploited-in-wild | Jun 4 | [src] |
| CVE-2026-32201 | [ MEDIUM ] | Microsoft / Microsoft SharePoint Server (Enterprise 2016, Server 2019, Subscription Edition) | 6.5 | — | kev | Apr 14 | [src] |
| CVE-2026-33825 | [ HIGH ] | Microsoft / Defender Antimalware Platform (versions 4.0.0.0 through before 4.18.26030.3011) | 7.8 | 6.7% | kev | Apr 14 | [src] |
| CVE-2026-39808 | [ CRITICAL ] | Fortinet / FortiSandbox (4.4 branch and multiple PaaS builds — see body) | 9.8 | — | kev | Apr 14 | [src] |
| CVE-2025-61882 | [ CRITICAL ] | Oracle / E-Business Suite — BI Publisher Integration (versions 12.2.3–12.2.14) | 9.8 | — | exploited-in-wild | Oct 5, 2025 | [src] |
| CVE-2024-3400 | [ CRITICAL ] | Palo Alto Networks / PAN-OS (GlobalProtect gateway/portal) | 10.0 | 100.0% | kev | Apr 12, 2024 | [src] |
| CVE-2024-27198 | [ CRITICAL ] | JetBrains / TeamCity | 9.8 | 99.9% | kev | Mar 4, 2024 | [src] |
| CVE-2024-21413 | [ CRITICAL ] | Microsoft / Outlook (Microsoft 365 Apps, Office 2016–2021) | 9.8 | 94.7% | kev | Feb 13, 2024 | [src] |
| CVE-2023-46805 | [ HIGH ] | Ivanti / Connect Secure and Policy Secure | 8.2 | 100.0% | kev | Jan 10, 2024 | [src] |
| CVE-2024-21887 | [ CRITICAL ] | Ivanti / Connect Secure and Policy Secure | 9.1 | 100.0% | kev | Jan 10, 2024 | [src] |
| CVE-2023-20198 | [ CRITICAL ] | Cisco / IOS XE Software | 10.0 | 99.6% | kev | Oct 16, 2023 | [src] |
| CVE-2023-4966 | [ CRITICAL ] | Citrix / NetScaler ADC and NetScaler Gateway | 9.4 | 100.0% | kev | Oct 10, 2023 | [src] |
| CVE-2023-22515 | [ CRITICAL ] | Atlassian / Confluence Data Center and Server | 10.0 | 99.2% | kev | Oct 4, 2023 | [src] |
| CVE-2023-4346 | [ MEDIUM ] | KNX Association / KNX Protocol (Connection Authorization Option 1) | — | — | kev | Aug 24, 2023 | [src] |
| CVE-2023-38831 | [ HIGH ] | RARLAB / WinRAR | 7.8 | 97.8% | kev | Aug 23, 2023 | [src] |
| CVE-2023-34362 | [ CRITICAL ] | Progress Software / MOVEit Transfer | 9.8 | 99.9% | kev | Jun 2, 2023 | [src] |
| CVE-2023-2868 | [ CRITICAL ] | Barracuda / Email Security Gateway | 9.8 | 87.0% | kev | May 23, 2023 | [src] |
| CVE-2023-28771 | [ CRITICAL ] | Zyxel / ZyWALL/USG, USG FLEX, ATP, and VPN series firewalls | 9.8 | 99.3% | kev | Apr 25, 2023 | [src] |
| CVE-2022-40684 | [ CRITICAL ] | Fortinet / FortiOS / FortiProxy | — | 100.0% | kev | Oct 10, 2022 | [src] |
| CVE-2022-26134 | [ CRITICAL ] | Atlassian / Confluence Server and Data Center | 9.8 | 100.0% | kev | Jun 2, 2022 | [src] |
| CVE-2022-30190 | [ HIGH ] | Microsoft / Windows Support Diagnostic Tool (MSDT) | 7.8 | 99.4% | kev | May 30, 2022 | [src] |
| CVE-2022-1388 | [ CRITICAL ] | F5 / BIG-IP | 9.8 | 100.0% | kev | May 4, 2022 | [src] |
| CVE-2022-22965 | [ CRITICAL ] | VMware / Spring Framework | 9.8 | 99.7% | kev | Mar 31, 2022 | [src] |
| CVE-2021-44228 | [ CRITICAL ] | Apache / Log4j2 | 10.0 | 100.0% | kev | Dec 10, 2021 | [src] |
| CVE-2021-40444 | [ HIGH ] | Microsoft / Windows MSHTML | 8.8 | 96.8% | kev | Sep 7, 2021 | [src] |
| CVE-2021-34527 | [ HIGH ] | Microsoft / Windows Print Spooler | 8.8 | 99.8% | kev | Jul 1, 2021 | [src] |
| CVE-2021-22205 | [ CRITICAL ] | GitLab / GitLab CE/EE | 9.9 | 99.7% | kev | Apr 14, 2021 | [src] |
| CVE-2021-26855 | [ CRITICAL ] | Microsoft / Exchange Server | 9.8 | 100.0% | kev | Mar 2, 2021 | [src] |
| CVE-2021-21972 | [ CRITICAL ] | VMware / vCenter Server | 9.8 | 99.6% | kev | Feb 23, 2021 | [src] |
| CVE-2018-0171 | [ CRITICAL ] | Cisco / IOS and IOS XE with Smart Install client enabled | 9.8 | — | exploited-in-wild | Mar 28, 2018 | [src] |
| CVE-2008-4128 | [ MEDIUM ] | Cisco / IOS 12.4 mainline (Cisco 871 Integrated Services Router) | 4.3 | — | kev | Sep 18, 2008 | [src] |