The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
27 Oct 2026 Adobe Commerce and Magento Malicious file upload
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe i\/o events 1.21.0
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-434
24 Sep 2026 Adobe Commerce and Magento Access control flaw
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe commerce 2.4.4, adobe commerce b2b 1.3.3
- CISA due date
- 27 Sep 2026
- Weakness
- CWE-863
8 Sep 2026 Adobe Commerce and Magento Remote code execution
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe magento 2.4.6, adobe commerce 2.4.4, adobe commerce b2b 1.3.3
- CISA due date
- 11 Sep 2026
- Weakness
- CWE-1336
24 Oct 2025 Adobe Commerce and Magento Input validation flaw
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 14 Nov 2025
- Weakness
- CWE-20
17 Jul 2024 Adobe Commerce and Magento Open Source XML external entity
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- adobe commerce webhooks 1.5.0
- CISA due date
- 7 Aug 2024
- Weakness
- CWE-611
15 Feb 2022 Adobe Commerce and Magento Open Source Input validation flaw
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe commerce 2.3.0, adobe magento 2.3.0
- CISA due date
- 1 Mar 2022
- Weakness
- CWE-20
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.