Latest CISA KEV additions
The 30 newest vulnerabilities CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first. A KEV listing means CISA has evidence the flaw is being exploited. Check a whole list of CVEs at once with the KEV checker.
Catalog version 2026.11.10, released 2026-11-10T19:03:29.8375Z. 1,779 entries in total. Source: CISA, Known Exploited Vulnerabilities Catalog.
| Added | CVE | Vendor and product | Due (federal) | Ransomware |
|---|---|---|---|---|
| 2026-11-10 | CVE-2026-20320 | Cisco BroadWorksCisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | 2026-11-24 | Not known |
| 2026-11-10 | CVE-2026-125350 | Google ChromiumGoogle Chromium Use-After-Free Vulnerability | 2026-11-24 | Not known |
| 2026-11-10 | CVE-2026-124194 | Microsoft OfficeMicrosoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | 2026-11-24 | Not known |
| 2026-11-10 | CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG)Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-11-13 | Not known |
| 2026-11-10 | CVE-2026-111793 | Openwave Messaging Limited Webtop Media TranscoderOpenwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | 2026-11-24 | Not known |
| 2026-11-10 | CVE-2026-111560 | Barracuda Networks Multiple ProductsBarracuda Networks Multiple Products OS Command Injection Vulnerability | 2026-11-13 | Not known |
| 2026-11-09 | CVE-2026-123218 | IBM Aspera FaspexIBM Aspera Faspex Incorrect Authorization Vulnerability | 2026-11-12 | Not known |
| 2026-11-09 | CVE-2026-123158 | OpenBSD OpenSSHOpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | 2026-11-12 | Not known |
| 2026-11-09 | CVE-2026-116779 | SignalWire FreeSwitchSignalWire FreeSwitch Code Injection Vulnerability | 2026-11-12 | Not known |
| 2026-11-09 | CVE-2026-102895 | GPUStack GPUStackGPUStack Improper Authentication Vulnerability | 2026-11-12 | Not known |
| 2026-11-06 | CVE-2026-19868 | SonicWall SonicOS SSLVPNSonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | 2026-11-20 | Not known |
| 2026-11-04 | CVE-2024-27834 | Apple Multiple ProductsApple Multiple Products Improper Authentication Vulnerability | 2026-11-18 | Not known |
| 2026-11-03 | CVE-2026-119977 | WordPress WordPress CoreWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | 2026-11-06 | Not known |
| 2026-10-30 | CVE-2026-118527 | Ivanti Connect SecureIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | 2026-11-13 | Not known |
| 2026-10-30 | CVE-2026-111357 | Ivanti Connect SecureIvanti Connect Secure Missing Authentication for Critical Function Vulnerability | 2026-11-02 | Not known |
| 2026-10-29 | CVE-2026-97229 | GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | 2026-11-01 | Not known |
| 2026-10-29 | CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | 2026-11-01 | Not known |
| 2026-10-28 | CVE-2026-46300 | Linux KernelLinux Kernel Missing Initialization of a Variable Vulnerability | 2026-10-31 | Not known |
| 2026-10-28 | CVE-2026-41709 | Broadcom VMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability | 2026-11-11 | Not known |
| 2026-10-27 | CVE-2026-48356 | Adobe Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-11-10 | Not known |
| 2026-10-27 | CVE-2026-111497 | Google BrotliGoogle Brotli Unchecked Return Value Vulnerability | 2026-11-10 | Not known |
| 2026-10-26 | CVE-2026-109619 | PHP Group PHPPHP Stale Internal Request-State Vulnerability | 2026-10-29 | Not known |
| 2026-10-26 | CVE-2026-109618 | PHP Group PHPPHP Memory Corruption Vulnerability | 2026-10-29 | Not known |
| 2026-10-23 | CVE-2026-114625 | Arista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection Vulnerability | 2026-10-26 | Not known |
| 2026-10-23 | CVE-2026-110447 | Collabora Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability | 2026-10-26 | Not known |
| 2026-10-20 | CVE-2026-96656 | Plex Media ServerPlex Media Server External Control of File Name or Path Vulnerability | 2026-10-23 | Not known |
| 2026-10-20 | CVE-2026-96655 | Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-11-03 | Not known |
| 2026-10-20 | CVE-2026-96654 | Plex Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 2026-10-23 | Not known |
| 2026-10-20 | CVE-2026-96652 | Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-11-03 | Not known |
| 2026-10-20 | CVE-2026-110936 | Siemens Software CenterSiemens Software Center Uncontrolled Search Path Element Vulnerability | 2026-11-03 | Not known |
Due dates apply to US federal civilian agencies under CISA's directive; for everyone else they are a useful upper bound. "Ransomware: Known" means CISA records known use in ransomware campaigns.