Exploited CVE lookup
Type a CVE ID. If it is in CISA's Known Exploited Vulnerabilities catalog you get a page with the verdict, ransomware use, exploitation likelihood, severity and the fix. If it isn't, you see the live EPSS score and why "not in KEV" doesn't mean "safe". 1,779 exploited CVEs are covered.
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-20320 | Cisco BroadWorks Improper Restriction of XML External Entity Reference VulnerabilityCisco BroadWorks | |
| CVE-2026-125350 | Google Chromium Use-After-Free VulnerabilityGoogle Chromium | |
| CVE-2026-124194 | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action VulnerabilityMicrosoft Office | |
| CVE-2026-116606 | Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel VulnerabilityEDGEBarracuda Networks Barracuda Email Security Gateway (ESG) | |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres VulnerabilityOpenwave Messaging Limited Webtop Media Transcoder | |
| CVE-2026-111560 | Barracuda Networks Multiple Products OS Command Injection VulnerabilityBarracuda Networks Multiple Products | |
| CVE-2026-123218 | IBM Aspera Faspex Incorrect Authorization VulnerabilityIBM Aspera Faspex | |
| CVE-2026-123158 | OpenBSD OpenSSH Unexpected Status Code or Return Value VulnerabilityOpenBSD OpenSSH | |
| CVE-2026-116779 | SignalWire FreeSwitch Code Injection VulnerabilitySignalWire FreeSwitch | |
| CVE-2026-102895 | GPUStack Improper Authentication VulnerabilityGPUStack | |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication VulnerabilityEDGESonicWall SonicOS SSLVPN | |
| CVE-2024-27834 | Apple Multiple Products Improper Authentication VulnerabilityApple Multiple Products | |
| CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilityWordPress Core | |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityEDGEIvanti Connect Secure | |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityEDGEIvanti Connect Secure | |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityGitLab Community Edition and Enterprise Edition | |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityEDGECisco Secure Firewall ASA Software and Cisco Secure FTD Software | |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable VulnerabilityLinux Kernel | |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging VulnerabilityBroadcom VMware ESX | |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityAdobe Commerce and Magento | |
| CVE-2026-111497 | Google Brotli Unchecked Return Value VulnerabilityGoogle Brotli | |
| CVE-2026-109619 | PHP Stale Internal Request-State VulnerabilityPHP Group PHP | |
| CVE-2026-109618 | PHP Memory Corruption VulnerabilityPHP Group PHP | |
| CVE-2026-114625 | Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista VeloCloud Orchestrator | |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Online – Built-in CODE Server | |
| CVE-2026-96656 | Plex Media Server External Control of File Name or Path VulnerabilityPlex Media Server | |
| CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server | |
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server | |
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server | |
| CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens Software Center | |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityEG Secure Solutions SiteGuard Server Edition | |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support | |
| CVE-2025-61624 | Fortinet Multiple Products Path Traversal VulnerabilityEDGEFortinet Multiple Products | |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityAtlassian Multiple Products | |
| CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal VulnerabilityEDGECisco Secure Email Gateway | |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection VulnerabilityAhsayCBS | |
| CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication VulnerabilityAhsayCBS | |
| CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection VulnerabilityEDGEPalo Alto Networks PAN-OS | |
| CVE-2026-96951 | Microsoft Windows Command Injection VulnerabilityMicrosoft Windows | |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityEDGEIvanti Connect Secure |
Browse by vendor or by month, or see what needs action today on the act-now radar.
We wire KEV and EPSS into your scanner and ticketing so your team only sees the exploited CVEs that match your estate.
Get in touch →