Known Exploited Vulnerabilities

Curated + enriched signals for rapid prioritization

{ } JSON RSS PRO

0.7%

actively
exploited

Focus on what’s exploited

Out of 352,641 known CVEs, only 0.7% show real-world exploitation signals.

Data from public sources (including CISA) plus private honeypots, enriched with prioritization metadata.

View stats Report a KEV

2,555

Total Known exploited

103

Added this week

938

More than CISA KEV

Search

Results update as you type.

⌘K

Added

Exploitability

Type to search. Filters apply instantly.

CVE	Severity	Title	Vendor	Product	Added
CVE-2023-6909	7.5 High	Path Traversal: '\..\filename' in mlflow/mlflow Remote Low complexity No user interaction	mlflow	mlflow/mlflow	9 days ago
CVE-2025-9316	6.9 Medium	N-central unauthenticated sessionID generation Remote Low complexity No user interaction	N-able	N-central	9 days ago
CVE-2022-0492	7.8 High	A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain... 1 hour faster than CISA KEV Low complexity No user interaction	Linux	kernel	9 days ago
CVE-2025-48595	8.4 High	In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of... 6 hours faster than CISA KEV Low complexity No user interaction	Google	Android	9 days ago
CVE-2026-41089	9.8 Critical	Windows Netlogon Remote Code Execution Vulnerability Remote Low complexity No user interaction	Microsoft	Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)	9 days ago
CVE-2024-21182	7.5 High	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are... 1 hour faster than CISA KEV Remote Low complexity No user interaction	Oracle Corporation	WebLogic Server	10 days ago
CVE-2023-43000	8.8 High	A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari... Remote Low complexity	Apple	macOS, iOS and iPadOS, Safari	10 days ago
CVE-2025-31277	8.8 High	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6,... Remote Low complexity	Apple	Safari, iOS and iPadOS, macOS, tvOS, visionOS, watchOS	10 days ago
CVE-2026-9082	9.8 Critical	Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 1 day faster than CISA KEV Remote Low complexity No user interaction	Drupal	Drupal core	10 days ago
CVE-2026-48172	10.0 Critical	LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is... 1 day faster than CISA KEV Remote Low complexity No user interaction	LiteSpeed Technologies	cPanel Plugin, WHM Plugin	10 days ago
CVE-2026-34926	6.7 Medium	A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the... 1 day faster than CISA KEV No user interaction	Trend Micro, Inc.	TrendAI Apex One, TrendAI Apex One as a Service	10 days ago
CVE-2025-34291	9.4 Critical	Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE 1 day faster than CISA KEV Remote Low complexity	Langflow	Langflow	10 days ago
CVE-2026-45498	4.0 Medium	Microsoft Defender Denial of Service Vulnerability 1 day faster than CISA KEV Low complexity No user interaction	Microsoft	Microsoft Defender Antimalware Platform	10 days ago
CVE-2026-41091	7.8 High	Microsoft Defender Elevation of Privilege Vulnerability 1 day faster than CISA KEV Low complexity No user interaction	Microsoft	Microsoft Malware Protection Engine	10 days ago
CVE-2026-34234	10.0 Critical	CtrlPanel: Unauthenticated RCE using installer script Remote Low complexity No user interaction	Ctrlpanel-gg	panel	10 days ago
CVE-2026-42897	8.1 High	Microsoft Exchange Server Spoofing Vulnerability 1 day faster than CISA KEV Remote Low complexity	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM	10 days ago
CVE-2026-42208	9.3 Critical	LiteLLM: SQL injection in Proxy API key verification 1 day faster than CISA KEV Remote Low complexity No user interaction	BerriAI	litellm	10 days ago
CVE-2026-6973	7.2 High	A configuration control vulnerability in the Ivanti Endpoint Manager Mobile before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote... 1 day faster than CISA KEV Remote Low complexity No user interaction	Ivanti	Endpoint Manager Mobile	10 days ago
CVE-2026-44742	7.2 High	Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May... Remote Low complexity No user interaction	Postorius project	Postorius	10 days ago
CVE-2026-0300	9.3 Critical	PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal 1 day faster than CISA KEV Remote Low complexity No user interaction	Palo Alto Networks	Cloud NGFW, PAN-OS, Prisma Access	10 days ago
CVE-2026-31431	7.8 High	crypto: algif_aead - Revert to operating out-of-place 1 day faster than CISA KEV Low complexity No user interaction	Linux	Linux	10 days ago
CVE-2026-32202	4.3 Medium	Windows Shell Spoofing Vulnerability 1 day faster than CISA KEV Remote Low complexity	Microsoft	Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)	10 days ago
CVE-2024-1708	8.4 High	Improper limitation of a pathname to a restricted directory (“path traversal”) 1 day faster than CISA KEV Malware Remote Low complexity	ConnectWise	ScreenConnect	10 days ago
CVE-2025-29635	7.2 High	A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote... 1 day faster than CISA KEV Remote Low complexity No user interaction	D-Link	DIR-823X	10 days ago
CVE-2024-7399	8.8 High	Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to... 1 day faster than CISA KEV Remote Low complexity No user interaction	Samsung Electronics	MagicINFO 9 Server	10 days ago

Displaying vulnerabilities 51 - 75 of 2555 in total

KEVIntel

Known Exploited Vulnerability Intelligence Beyond CISA KEV

Prioritize the vulnerabilities attackers are actually exploiting—before they impact your organization.

KEVIntel is known exploited vulnerability intelligence that aggregates, attests, enriches, and distributes exploited-CVE data. It is not a CISA KEV mirror alone. The service includes the official catalog as a baseline and extends coverage with additional exploited-CVE attestations, evidence links, enrichment, and automation-ready delivery through the live feed above, RSS, JSON, and the Pro API.

Aggregated & attested

Exploitation signals from 60+ public sources, vendor advisories, and private honeypots—validated against credible evidence.

Enriched for prioritization

Every CVE joined with EPSS, CVSS, CWE, proof-of-concept references, and Nuclei/Metasploit context.

Automation-ready delivery

Live feed, RSS, JSON, and Pro API for VM, CTI, SOC, and MSSP workflows.

The AI vulnerability tsunami is accelerating disclosure

Hundreds of thousands of CVEs exist in the National Vulnerability Database and vendor advisories, and AI-assisted discovery is accelerating that volume further. CVSS scores describe theoretical severity, but severity is not the same as exploitation. Many high-severity vulnerabilities are never exploited in the wild, while some actively exploited flaws may be under-prioritized if teams rely on CVSS-only prioritization.

Only a small fraction of published CVEs ever show real-world exploitation signals. Security teams cannot remediate everything at once. Exploitation-led prioritization focuses limited patching, detection, and analyst time on CVEs with evidence-backed exploitation—not on vulnerability noise.

Disclosed vulnerabilities Actively exploited

352,641+ and growing

Only 0.7% of disclosed CVEs show real-world exploitation signals — and that sliver is the operationally urgent work.

Focus on the signal, not the noise. KEVIntel helps you identify the vulnerabilities attackers are actually using—so vulnerability management, CTI, SOC, MSSP, and exposure-management teams can prioritize remediation on real exploitation, not scanner volume alone.

CISA KEV is essential. It is not the whole picture.

KEVIntel extends your visibility beyond CISA KEV. CISA KEV is authoritative and valuable; KEVIntel complements it with additional exploited-CVE coverage, RSS delivery, global honeypot telemetry, enrichment, and automation-ready Pro API access. See the full KEVIntel vs CISA KEV comparison.

CISA KEV

No RSS feed
Tracks vulnerabilities in CISA KEV
Curated by CISA

KEVIntel

RSS feed for real-time updates
CISA KEV plus 938+ more exploited in the wild
Independent intelligence from global honeypots, EPSS, CVSS, CWE, PoCs, and Nuclei/Metasploit context

Use CISA KEV. Go further with KEVIntel. Complete visibility, faster prioritization, stronger defenses—with exploitation timelines, source evidence, and platform statistics to back every decision.

From global telemetry to actionable intelligence

KEVIntel follows a simple pipeline: Collect, Attest, Enrich, Deliver. Each exploited CVE links to source material so analysts can verify why it was included and move from signal to action faster.

Collect

Global honeypot networks, CISA KEV, vendor advisories, cyber RSS feeds, and public reporting observe real-world exploitation attempts around the clock.
Attest

Validate exploitation with credible evidence—CISA KEV listings, advisories documenting active exploitation, honeypot observations, and defensible references—to separate signal from noise.
Enrich

Correlate each CVE with EPSS, CVSS, CWE, proof-of-concept references, Nuclei and Metasploit scanner context, online mentions, vendor metadata, and exploitation timelines.
Deliver

Actionable intelligence via this live feed, RSS, JSON, and the Pro API—ready for vulnerability management, CTI, SOC, SIEM/SOAR, MSSP, and exposure-management workflows.

Prioritize what matters

Reduce false positives

Strengthen defenses

Stay ahead of attackers