Free tool
CISA KEV — Live Table
Sortable, filterable snapshot of CISA's Known Exploited Vulnerabilities catalog — the CVEs U.S. federal agencies must patch on a deadline.
The CISA Known Exploited Vulnerabilities (KEV) catalog is the closest thing the industry has to a public "patch this now" list. Under Binding Operational Directive 22-01, U.S. federal civilian agencies must remediate every CVE on the list by the published due date, and the same list has become the de facto priority queue for private-sector security and change teams too. This tool renders a compact, sortable snapshot of the catalog so a change manager can scan it in seconds: click any column header to sort, type in the filter box to narrow by vendor / product / CVE, or flip the ransomware-use toggle to show only the entries CISA has flagged as tied to active ransomware campaigns. The underlying data comes from CISA's public JSON feed; the snapshot bundled with this page refreshes nightly. For the authoritative, up-to-the-minute list, use the CISA link at the bottom. Nothing you type here is sent to a server — filtering and sorting all happens in the browser.
| CVE | Vendor | Product | Date added | Due date | Notes |
|---|---|---|---|---|---|
| CVE-2026-125350 | Chromium | 2026-11-10 | 2026-11-24 | Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 | |
| CVE-2026-116606 | Barracuda Networks | Barracuda Email Security Gateway (ESG) | 2026-11-10 | 2026-11-13 | Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-111560 | Barracuda Networks | Multiple Products | 2026-11-10 | 2026-11-13 | Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606 Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-20320 | Cisco | BroadWorks | 2026-11-10 | 2026-11-24 | Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-111793 | Openwave Messaging Limited | Webtop Media Transcoder | 2026-11-10 | 2026-11-24 | Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-124194 | Microsoft | Office | 2026-11-10 | 2026-11-24 | Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. Our analysis: November 2026 Patch Tuesday: A CAB Plan for 1,000+ CVEs; This Week in Change Risk — Week of Nov 9, 2026; October 2026 Patch Tuesday: A CAB Plan Through Year-End |
| CVE-2026-123218 | IBM | Aspera Faspex | 2026-11-09 | 2026-11-12 | IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-116779 | SignalWire | FreeSwitch | 2026-11-09 | 2026-11-12 | SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-123158 | OpenBSD | OpenSSH | 2026-11-09 | 2026-11-12 | OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-102895 | GPUStack | GPUStack | 2026-11-09 | 2026-11-12 | GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2026-19868 | SonicWall | SonicOS SSLVPN | 2026-11-06 | 2026-11-20 | SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). Our analysis: This Week in Change Risk — Week of Nov 9, 2026 |
| CVE-2024-27834 | Apple | Multiple Products | 2026-11-04 | 2026-11-18 | Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. Our analysis: This Week in Change Risk — Week of Nov 2, 2026 |
| CVE-2026-119977 | WordPress | WordPress Core | 2026-11-03 | 2026-11-06 | WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. Our analysis: WordPress CVE-2026-119977: When the Upgrade Is the Risk; This Week in Change Risk — Week of Nov 2, 2026 |
| CVE-2026-111357 | Ivanti | Connect Secure | 2026-10-30 | 2026-11-02 | Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. Our analysis: This Week in Change Risk — Week of Nov 2, 2026; Ivanti Connect Secure CVE-2026-104935: Patching Is Not Recovery; This Week in Change Risk — Week of Oct 12, 2026 |
| CVE-2026-118527 | Ivanti | Connect Secure | 2026-10-30 | 2026-11-13 | Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. Our analysis: This Week in Change Risk — Week of Nov 2, 2026; Ivanti Connect Secure CVE-2026-104935: Patching Is Not Recovery; This Week in Change Risk — Week of Oct 12, 2026 |
| CVE-2026-76418 | Cisco | Secure Firewall ASA Software and Cisco Secure FTD Software | 2026-10-29 | 2026-11-01 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Our analysis: This Week in Change Risk — Week of Oct 26, 2026 |
| CVE-2026-97229 | GitLab | Community Edition and Enterprise Edition | 2026-10-29 | 2026-11-01 | GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. Our analysis: This Week in Change Risk — Week of Oct 26, 2026 |
| CVE-2026-46300 | Linux | Kernel | 2026-10-28 | 2026-10-31 | Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Our analysis: This Week in Change Risk — Week of Oct 26, 2026 |
| CVE-2026-41709 | Broadcom | VMware ESX | 2026-10-28 | 2026-11-11 | Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. Our analysis: VMSA-2026-0006: A vCenter Emergency-Change Playbook; This Week in Change Risk — Week of Oct 26, 2026 |
| CVE-2026-48356 | Adobe | Commerce and Magento | 2026-10-27 | 2026-11-10 | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Our analysis: This Week in Change Risk — Week of Oct 26, 2026 |
Source: CISA Known Exploited Vulnerabilities Catalog. Snapshot generated 2026-11-11T09:09:20Z.
About this tool
The KEV catalog is most useful when it shortens a practical question: which entries require an owner to determine whether the organization is exposed? This view makes the public catalog easier to sort and filter during triage. Search by vendor, product, or catalog field, then move relevant entries into the workflow that connects findings to assets, owners, and due dates.
A catalog entry signals known exploitation, not automatic impact. Start with the affected product and vulnerability details, validate installed versions and exposure paths, and check the required action against local policy. The date belongs to the catalog record, not a disclosure or exploitation-start date. When a deadline applies, track the organization's response and any accepted exception outside this table.
How to read the output
- Filter first, then carefully validate each candidate against owned assets.
- Use the required action as a starting point for remediation planning.
- Separate catalog status from internal evidence of exposure or exploitation.
- Assign exceptions and completion evidence in the vulnerability management system.
What this does not tell you
- KEV catalog dates describe CISA catalog activity and do not establish the vulnerability's disclosure or exploitation start date.
- The catalog cannot identify which assets, versions, internet exposures, or compensating controls exist in a specific environment.
- CISA entries are a high-priority input, but organizations still need their own threat, business, and change context.
Data sources
Free to use, no account required, and nothing you enter is transmitted to this site — the tool runs entirely in your browser.