The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
25 Aug 2025 Git Path traversal
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple xcode 26.0, git-scm git 2.50.1, git-scm git 2.49.1, git-scm git 2.48.2, git-scm git 2.47.3 and 4 older
- CISA due date
- 15 Sep 2025
- Weakness
- CWE-59, CWE-436
22 Jul 2025 Google Chromium Input validation flaw
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 138.0.7204.157, apple safari 18.6, apple ipados 18.6, apple iphone os 18.6, apple macos 15.6 and 4 older
- CISA due date
- 12 Aug 2025
- Weakness
- CWE-20
21 Nov 2024 Apple Multiple Products Cross-site scripting
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older
- CISA due date
- 12 Dec 2024
- Weakness
- CWE-79
21 Nov 2024 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older
- CISA due date
- 12 Dec 2024
4 Dec 2023 Apple Multiple Products Memory corruption
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Fixed in (NVD)
- apple safari 17.1.2, apple ipados 17.1.2, apple iphone os 17.1.2, apple ipados 16.7.3, apple iphone os 16.7.3 and 4 older
- CISA due date
- 25 Dec 2023
- Weakness
- CWE-787
4 Dec 2023 Apple Multiple Products Memory corruption
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Fixed in (NVD)
- apple safari 17.1.2, apple ipados 17.1.2, apple iphone os 17.1.2, apple ipados 16.7.3, apple iphone os 16.7.3 and 4 older
- CISA due date
- 25 Dec 2023
- Weakness
- CWE-125
25 Sep 2023 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.0.1, apple iphone os 17.0.1, apple macos 14.0, webkitgtk+ 2.42.2
- CISA due date
- 16 Oct 2023
- Weakness
- CWE-754
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 15.6.1, apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, webkitgtk 2.36.7 and 1 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
3 Nov 2021 Apple iOS, iPadOS, and macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.