CISA KEV Velocity Dashboard
How fast are actively exploited CVEs accumulating? This dashboard tracks the CISA Known Exploited Vulnerabilities catalog: monthly addition velocity, vendor concentration, and the share of entries tied to known ransomware campaigns. Rebuilt automatically on every site deploy.
Catalog snapshot: 2026-11-07 · 1769 entries · Source: CISA KEV Catalog · By vendor · RSS · JSON feed
What is the CISA KEV catalog?
| What it is | The Known Exploited Vulnerabilities (KEV) catalog: CISA’s list of CVEs with reliable evidence of exploitation in the wild. |
|---|---|
| Who maintains it | The U.S. Cybersecurity and Infrastructure Security Agency (CISA). |
| How a CVE gets added | Three criteria: an assigned CVE ID, reliable evidence of active exploitation (scanning, research or a public proof of concept do not count), and a clear remediation action such as a vendor update. |
| Who must act on it | Federal civilian executive branch agencies, which must remediate listed CVEs by each entry’s due date under Binding Operational Directive 22-01. Other organizations are not bound by it; CISA recommends they prioritize KEV entries too. |
| Ransomware flag | Each entry carries a Known / Unknown flag for use in ransomware campaigns; the ransomware share above counts the “Known” entries. |
| Size today | 1,769 entries as of 2026-11-07. Browse them by vendor or by date added. |
Source: CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities.
How old are CVEs when exploitation is confirmed?
18% of KEV entries added in the last 12 months are CVEs from 2+ years ago (by CVE ID year): old, unpatched vulnerabilities keep getting exploited long after disclosure.
Additions per month, last 24 months
Most-listed vendors, last 12 months
Reading the numbers
A CVE only enters the KEV catalog once CISA confirms active exploitation in the wild, so the monthly addition rate is a floor on real-world exploitation activity, not a count of disclosed vulnerabilities.
Federal agencies must remediate each entry by its CISA due date under BOD 22-01; most organizations treat KEV listing as a patch-now signal regardless of CVSS score.
Vendor concentration reflects both install base and attacker focus. A vendor appearing here repeatedly is a prioritization signal for patch management programs.
Latest 25 KEV additions
| CVE | Vulnerability | Vendor / product | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | SonicWall SonicOS SSLVPN | 2026-11-06 | No |
| CVE-2024-27834 | Apple Multiple Products Improper Authentication Vulnerability | Apple Multiple Products | 2026-11-04 | No |
| CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | WordPress WordPress Core | 2026-11-03 | No |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Ivanti Connect Secure | 2026-10-30 | No |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Ivanti Connect Secure | 2026-10-30 | No |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerabili | GitLab Community Edition and Enterprise Edition | 2026-10-29 | No |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to | Cisco Secure Firewall ASA Software and Cisco Secure FTD Soft | 2026-10-29 | No |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability | Broadcom VMware ESX | 2026-10-28 | No |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerability | Linux Kernel | 2026-10-28 | No |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Adobe Commerce and Magento | 2026-10-27 | No |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | Google Brotli | 2026-10-27 | No |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability | PHP Group PHP | 2026-10-26 | No |
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability | PHP Group PHP | 2026-10-26 | No |
| CVE-2026-114625 | Arista VeloCloud Orchestrator SQL Injection Vulnerability | Arista VeloCloud Orchestrator | 2026-10-23 | No |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | Collabora Collabora Online – Built-in CODE Server | 2026-10-23 | No |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | EG Secure Solutions SiteGuard Server Edition | 2026-10-20 | No |
| CVE-2026-96656 | Plex Media Server External Control of File Name or Path Vulnerability | Plex Media Server | 2026-10-20 | No |
| CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Plex Media Server | 2026-10-20 | No |
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerabili | Plex Media Server | 2026-10-20 | No |
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Plex Media Server | 2026-10-20 | No |
| CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element Vulnerability | Siemens Software Center | 2026-10-20 | No |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | BeyondTrust Remote Support | 2026-10-16 | No |
| CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability | Fortinet Multiple Products | 2026-10-16 | No |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerabil | Atlassian Multiple Products | 2026-10-15 | No |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability | Ahsay AhsayCBS | 2026-10-14 | No |
CVE links go to our explainer when one exists, otherwise to the NVD record.
Methodology & reuse
Data is the official CISA Known Exploited Vulnerabilities catalog, fetched at build time; this page regenerates on every deploy (multiple times daily). Charts and figures may be reused with attribution to East Bay Cyber and CISA. Snapshot date: 2026-11-07.