CISA KEV

Actively exploited vulnerabilities (CISA KEV)

47 actively exploited CVEs (Critical, all platforms) affect a tracked app or OS. CISA confirms exploitation in the wild for each one.

Matching CVEs: 47
Actively exploited: 47
Publication window: 2010-10-28 → 2026-08-06

All CVEs 2,375 CISA KEV 47 Public exploit 13 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

47 entries Critical CISA KEV Clear all

CVE	Severity	Apps	Published
CVE-2026-65400 CRITICAL 9.8 macOS 2026-08-06 An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, m…	CRITICAL 9.8	macOS	2026-08-06
CVE-2026-33824 CRITICAL 9.8 Windows 2026-04-14 Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.	CRITICAL 9.8	Windows	2026-04-14
CVE-2025-59287 CRITICAL · vendor Windows 2025-10-14 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2025-10-14
CVE-2025-10585 CRITICAL 9.8 2025-09-24 Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi…	CRITICAL 9.8		2025-09-24
CVE-2025-39682 CRITICAL 9.8 Android 2025-09-05 In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process …	CRITICAL 9.8	Android	2025-09-05
CVE-2025-43300 CRITICAL 10.0 iOS macOS 2025-08-21 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, …	CRITICAL 10.0	iOS macOS	2025-08-21
CVE-2025-21479 CRITICAL · vendor Android 2025-08-01 Indexed via Android Security Bulletin; full NVD metadata pending.	CRITICAL · vendor	Android	2025-08-01
CVE-2025-31201 CRITICAL 9.8 iOS macOS 2025-04-16 This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.…	CRITICAL 9.8	iOS macOS	2025-04-16
CVE-2025-31200 CRITICAL 9.8 iOS macOS 2025-04-16 A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, …	CRITICAL 9.8	iOS macOS	2025-04-16
CVE-2025-24201 CRITICAL 10.0 iOS macOS 2025-03-11 An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15…	CRITICAL 10.0	iOS macOS	2025-03-11
CVE-2025-24085 CRITICAL 10.0 iOS macOS 2025-01-27 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS…	CRITICAL 10.0	iOS macOS	2025-01-27
CVE-2024-9680 CRITICAL 9.8 2024-10-09 An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulner…	CRITICAL 9.8		2024-10-09
CVE-2024-7971 CRITICAL 9.6 2024-08-21 Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security s…	CRITICAL 9.6		2024-08-21
CVE-2024-5274 CRITICAL 9.6 2024-05-28 Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch…	CRITICAL 9.6		2024-05-28
CVE-2024-4947 CRITICAL 9.6 2024-05-15 Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr…	CRITICAL 9.6		2024-05-15
CVE-2024-4671 CRITICAL 9.6 2024-05-14 Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a …	CRITICAL 9.6		2024-05-14
CVE-2024-21413 CRITICAL 9.8 2024-02-13 Microsoft Outlook Remote Code Execution Vulnerability	CRITICAL 9.8		2024-02-13
CVE-2023-6345 CRITICAL 9.6 2023-11-29 Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a s…	CRITICAL 9.6		2023-11-29
CVE-2023-2136 CRITICAL 9.6 Android 2023-04-19 Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a s…	CRITICAL 9.6	Android	2023-04-19
CVE-2023-23397 CRITICAL 9.8 2023-03-14 Microsoft Outlook Elevation of Privilege Vulnerability	CRITICAL 9.8		2023-03-14
CVE-2022-4135 CRITICAL 9.6 2022-11-25 Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform …	CRITICAL 9.6		2022-11-25
CVE-2022-3075 CRITICAL 9.6 2022-09-26 Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially…	CRITICAL 9.6		2022-09-26
CVE-2022-26923 CRITICAL · vendor Windows 2022-05-10 Active Directory Domain Services Elevation of Privilege Vulnerability	CRITICAL · vendor	Windows	2022-05-10
CVE-2021-44228 CRITICAL 10.0 Xcode 2021-12-10 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter…	CRITICAL 10.0	Xcode	2021-12-10
CVE-2021-37973 CRITICAL 9.6 2021-10-08 Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sa…	CRITICAL 9.6		2021-10-08
CVE-2021-30633 CRITICAL 9.6 2021-10-08 Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perfo…	CRITICAL 9.6		2021-10-08
CVE-2021-33742 CRITICAL · vendor Windows 2021-06-08 Windows MSHTML Platform Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2021-06-08
CVE-2021-31166 CRITICAL · vendor Windows 2021-05-11 HTTP Protocol Stack Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2021-05-11
CVE-2020-15999 CRITICAL 9.6 Android 2020-11-03 Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa…	CRITICAL 9.6	Android	2020-11-03
CVE-2020-1472 CRITICAL · vendor Windows 2020-08-11 Netlogon Elevation of Privilege Vulnerability	CRITICAL · vendor	Windows	2020-08-11
CVE-2020-1350 CRITICAL · vendor Windows 2020-07-14 Windows DNS Server Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2020-07-14
CVE-2020-1040 CRITICAL · vendor Windows 2020-07-14 Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2020-07-14
CVE-2020-1020 CRITICAL · vendor Windows 2020-04-14 Adobe Font Manager Library Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2020-04-14
CVE-2020-0938 CRITICAL · vendor Windows 2020-04-14 Adobe Font Manager Library Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2020-04-14
CVE-2020-0796 CRITICAL 10.0 Windows 2020-03-12 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows S…	CRITICAL 10.0	Windows	2020-03-12
CVE-2019-11708 CRITICAL 10.0 2019-07-23 Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op…	CRITICAL 10.0		2019-07-23
CVE-2019-0903 CRITICAL · vendor Windows 2019-05-14 GDI+ Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2019-05-14
CVE-2017-8543 CRITICAL · vendor Windows 2017-06-13 Windows Search Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2017-06-13
CVE-2017-8464 CRITICAL · vendor Windows 2017-06-13 LNK Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2017-06-13
CVE-2017-0148 CRITICAL · vendor Windows 2017-03-14 Windows SMB Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2017-03-14
CVE-2017-0146 CRITICAL · vendor Windows 2017-03-14 Windows SMB Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2017-03-14
CVE-2017-0143 CRITICAL · vendor Windows 2017-03-14 Windows SMB Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2017-03-14
CVE-2016-5195 CRITICAL · vendor Android 2016-12-01 Indexed via Android Security Bulletin; full NVD metadata pending.	CRITICAL · vendor	Android	2016-12-01
CVE-2016-7256 CRITICAL · vendor Windows 2016-11-08 Microsoft Graphics Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2016-11-08
CVE-2016-3393 CRITICAL · vendor Windows 2016-10-11 GDI+ Remote Code Execution Vulnerability	CRITICAL · vendor	Windows	2016-10-11
CVE-2014-0497 CRITICAL 9.8 2014-02-05 Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linu…	CRITICAL 9.8		2014-02-05
CVE-2010-3765 CRITICAL 9.8 2010-10-28 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when Ja…	CRITICAL 9.8		2010-10-28

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM