The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
26 Oct 2026 PHP Group PHP Memory corruption
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 12.1.4, paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.4, paloaltonetworks pan-os 10.2.7 and 4 older
- CISA due date
- 29 Oct 2026
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
26 Oct 2026 PHP Group PHP Memory corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 12.1.4, paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.4, paloaltonetworks pan-os 10.2.7 and 4 older
- CISA due date
- 29 Oct 2026
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.