CISA KEV · exploited vulnerabilities

InformationCISA KEV · updated just now

Known Exploited Vulnerabilities from CISA, cross-referenced against ingested MENA cases. “MENA-relevant” means a CVE surfaced in a tracked case — not the full undifferentiated catalog. Each carries a remediation priority (P1–P3) so it's clear which to patch first, and why. For direct SIEM/SOAR ingestion, the same data is available as a machine-readable JSON feed →.

Sort

MENA-RELEVANT FULL CATALOG

50 of ~1,722

Comfortable Compact

CVECVE-2026-20122

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco · Catalyst SD-WAN Mangerremediation: past CISA due date

P2added 2026-04-20due 2026-04-23

⋮

CVECVE-2026-20128

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco · Catalyst SD-WAN Managerremediation: past CISA due date

P2added 2026-04-20due 2026-04-23

⋮

CVECVE-2026-20133

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Cisco · Catalyst SD-WAN Managerremediation: past CISA due date

P2added 2026-04-20due 2026-04-23

⋮

CVECVE-2026-34197

Apache ActiveMQ Improper Input Validation Vulnerability

Apache · ActiveMQremediation: past CISA due date

P2added 2026-04-16due 2026-04-30

⋮

CVECVE-2009-0238

Microsoft Office Remote Code Execution

Microsoft · Officeremediation: past CISA due date

P2added 2026-04-14due 2026-04-28

⋮

CVECVE-2026-32201

Microsoft SharePoint Server Improper Input Validation Vulnerability

Microsoft · SharePoint Serverremediation: past CISA due date

P2added 2026-04-14due 2026-04-28

⋮

CVECVE-2012-1854

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft · Visual Basic for Applications (VBA)remediation: past CISA due date

P2added 2026-04-13due 2026-04-27

⋮

CVECVE-2020-9715

Adobe Acrobat Use-After-Free Vulnerability

Adobe · Acrobatremediation: past CISA due date

P2added 2026-04-13due 2026-04-27

⋮

CVECVE-2023-21529

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft · Exchange Serverremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2026-04-13due 2026-04-27

⋮

CVECVE-2023-36424

Microsoft Windows Out-of-Bounds Read Vulnerability

Microsoft · Windowsremediation: past CISA due date

P2added 2026-04-13due 2026-04-27

⋮

CVECVE-2025-60710

Microsoft Windows Link Following Vulnerability

Microsoft · Windowsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2026-04-13due 2026-04-27

⋮

CVECVE-2026-21643

Fortinet FortiClient EMS SQL Injection Vulnerability

Fortinet · FortiClient EMSremediation: past CISA due date

P2added 2026-04-13due 2026-04-16

⋮

CVECVE-2026-34621

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Adobe · Acrobat and Readerremediation: past CISA due date

P2added 2026-04-13due 2026-04-27

⋮

CVECVE-2026-1340

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM)remediation: past CISA due date

P2added 2026-04-08due 2026-04-11

⋮

CVECVE-2026-35616

Fortinet FortiClient EMS Improper Access Control Vulnerability

Fortinet · FortiClient EMSremediation: past CISA due date

P2added 2026-04-06due 2026-04-09

⋮

CVECVE-2026-3502

TrueConf Client Download of Code Without Integrity Check Vulnerability

TrueConf · Clientremediation: past CISA due date

P2added 2026-04-02due 2026-04-16

⋮

CVECVE-2026-5281

Google Dawn Use-After-Free Vulnerability

Google · Dawnremediation: past CISA due date

P2added 2026-04-01due 2026-04-15

⋮

CVECVE-2026-3055

Citrix NetScaler Out-of-Bounds Read Vulnerability

Citrix · NetScalerremediation: past CISA due date

P2added 2026-03-30due 2026-04-02

⋮

CVECVE-2025-53521

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

F5 · BIG-IPremediation: past CISA due date

P2added 2026-03-27due 2026-03-30

⋮

CVECVE-2026-33634

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Aquasecurity · Trivyremediation: past CISA due date

P2added 2026-03-26due 2026-04-09

⋮

CVECVE-2026-33017

Langflow Code Injection Vulnerability

Langflow · Langflowremediation: past CISA due date

P2added 2026-03-25due 2026-04-08

⋮

CVECVE-2025-31277

Apple Multiple Products Buffer Overflow Vulnerability

Apple · Multiple Productsremediation: past CISA due date

P2added 2026-03-20due 2026-04-03

⋮

CVECVE-2025-32432

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMSremediation: past CISA due date

P2added 2026-03-20due 2026-04-03

⋮

CVECVE-2025-43510

Apple Multiple Products Improper Locking Vulnerability

Apple · Multiple Productsremediation: past CISA due date

P2added 2026-03-20due 2026-04-03

⋮

CVECVE-2025-43520

Apple Multiple Products Classic Buffer Overflow Vulnerability

Apple · Multiple Productsremediation: past CISA due date

P2added 2026-03-20due 2026-04-03

⋮

CVECVE-2025-54068

Laravel Livewire Code Injection Vulnerability

Laravel · Livewireremediation: past CISA due date

P2added 2026-03-20due 2026-04-03

⋮

CVECVE-2026-20131

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Cisco · Secure Firewall Management Center (FMC)remediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2026-03-19due 2026-03-22

⋮

CVECVE-2025-66376

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS)remediation: past CISA due date

P2added 2026-03-18due 2026-04-01

⋮

CVECVE-2026-20963

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePointremediation: past CISA due date

P2added 2026-03-18due 2026-03-21

⋮

CVECVE-2025-47813

Wing FTP Server Information Disclosure Vulnerability

Wing FTP Server · Wing FTP Serverremediation: past CISA due date

P2added 2026-03-16due 2026-03-30

⋮

CVECVE-2026-3909

Google Skia Out-of-Bounds Write Vulnerability

Google · Skiaremediation: past CISA due date

P2added 2026-03-13due 2026-03-27

⋮

CVECVE-2026-3910

Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

Google · Chromium V8remediation: past CISA due date

P2added 2026-03-13due 2026-03-27

⋮

CVECVE-2025-68613

n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

n8n · n8nremediation: past CISA due date

P2added 2026-03-11due 2026-03-25

⋮

CVECVE-2021-22054

Omnissa Workspace ONE Server-Side Request Forgery

Omnissa · Workspace One UEMremediation: past CISA due date

P2added 2026-03-09due 2026-03-23

⋮

CVECVE-2025-26399

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds · Web Help Deskremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2026-03-09due 2026-03-12

⋮

CVECVE-2026-1603

Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Ivanti · Endpoint Manager (EPM)remediation: past CISA due date

P2added 2026-03-09due 2026-03-23

⋮

CVECVE-2017-7921

Hikvision Multiple Products Improper Authentication Vulnerability

Hikvision · Multiple Productsremediation: past CISA due date

P2added 2026-03-05due 2026-03-26

⋮

CVECVE-2021-22681MENA

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Rockwell · Multiple Productsremediation: tied to 11 tracked actors · past CISA due datelinked case: 2026-07-22-cyberav3ngers-plc-update

P1added 2026-03-05due 2026-03-26

⋮

ViewLinked report

CVECVE-2021-30952

Apple Multiple Products Integer Overflow or Wraparound Vulnerability

Apple · Multiple Productsremediation: past CISA due date

P2added 2026-03-05due 2026-03-26

⋮

CVECVE-2023-41974

Apple iOS and iPadOS Use-After-Free Vulnerability

Apple · iOS and iPadOSremediation: past CISA due date

P2added 2026-03-05due 2026-03-26

⋮

CVECVE-2023-43000

Apple Multiple products Use-After-Free Vulnerability

Apple · Multiple Productsremediation: past CISA due date

P2added 2026-03-05due 2026-03-26

⋮

CVECVE-2026-21385

Qualcomm Multiple Chipsets Memory Corruption Vulnerability

Qualcomm · Multiple Chipsetsremediation: past CISA due date

P2added 2026-03-03due 2026-03-24

⋮

CVECVE-2026-22719

Broadcom VMware Aria Operations Command Injection Vulnerability

Broadcom · VMware Aria Operationsremediation: past CISA due date

P2added 2026-03-03due 2026-03-24

⋮

CVECVE-2022-20775

Cisco SD-WAN Path Traversal Vulnerability

Cisco · SD-WANremediation: past CISA due date

P2added 2026-02-25due 2026-02-27

⋮

CVECVE-2026-20127

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Cisco · Catalyst SD-WAN Controller and Managerremediation: past CISA due date

P2added 2026-02-25due 2026-02-27

⋮

CVECVE-2026-25108

Soliton Systems K.K FileZen OS Command Injection Vulnerability

Soliton Systems K.K · FileZenremediation: past CISA due date

P2added 2026-02-24due 2026-03-17

⋮

CVECVE-2025-49113

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube · Webmailremediation: past CISA due date

P2added 2026-02-20due 2026-03-13

⋮

CVECVE-2025-68461

RoundCube Webmail Cross-site Scripting Vulnerability

Roundcube · Webmailremediation: past CISA due date

P2added 2026-02-20due 2026-03-13

⋮

CVECVE-2021-22175

GitLab Server-Side Request Forgery (SSRF) Vulnerability

GitLab · GitLabremediation: past CISA due date

P2added 2026-02-18due 2026-03-11

⋮

CVECVE-2026-22769

Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

Dell · RecoverPoint for Virtual Machines (RP4VMs)remediation: past CISA due date

P2added 2026-02-18due 2026-02-21

⋮

151–200 of ~1,722

← Prev Next →