The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
27 Oct 2026 Google Brotli Memory corruption
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- nodejs node.js 26.12.1, nodejs node.js 24.22.1, nodejs node.js 22.23.4, microsoft .net 10.0.14, microsoft .net 9.0.22 and 7 older
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-252, CWE-787
22 Jul 2025 Google Chromium Input validation flaw
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 138.0.7204.157, apple safari 18.6, apple ipados 18.6, apple iphone os 18.6, apple macos 15.6 and 4 older
- CISA due date
- 12 Aug 2025
- Weakness
- CWE-20
4 Mar 2025 Linux Kernel Security flaw
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.11.8, linux kernel 6.6.61, linux kernel 6.1.117, linux kernel 5.15.172, linux kernel 5.10.230 and 3 older
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-908
6 Feb 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 116.0.5845.179, microsoft edge chromium 116.0.1938.76
- CISA due date
- 27 Feb 2024
- Weakness
- CWE-843
2 Jan 2024 Google Chromium WebRTC Memory corruption
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 120.0.6099.129
- CISA due date
- 23 Jan 2024
- Weakness
- CWE-787
30 Nov 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 119.0.6045.199, microsoft edge chromium 119.0.2151.97
- CISA due date
- 21 Dec 2023
- Weakness
- CWE-190
13 Sep 2023 Google Chromium WebP Memory corruption
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- bentley seequent leapfrog 2023.2, mozilla firefox 117.0.1, google chrome 116.0.5845.187, microsoft edge chromium 116.0.1938.81, mozilla thunderbird 115.2.2 and 7 older
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-787
7 Jun 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 114.0.5735.110, couchbase server 7.1.5
- CISA due date
- 28 Jun 2023
- Weakness
- CWE-843
21 Apr 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.137
- CISA due date
- 12 May 2023
- Weakness
- CWE-190
On Hacker News
Google Chrome Zero-Day 1 comment17 Apr 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.121, couchbase server 7.1.5
- CISA due date
- 8 May 2023
- Weakness
- CWE-843
8 Jun 2022 Google Chromium V8 Memory corruption
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 65.0.3325.146
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-190, CWE-787
8 Jun 2022 Google Chromium V8 Memory corruption
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 71.0.3578.80
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Google Chromium V8 Security flaw
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 70.0.3538.67
- CISA due date
- 22 Jun 2022
8 Jun 2022 Google Chromium V8 Memory corruption
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 57.0.2987.108, google chrome 57.0.2987.98
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-125
8 Jun 2022 Google Chromium V8 Memory corruption
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 49.0.2623.108
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
23 May 2022 Android Kernel Memory corruption
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-362, CWE-416
3 Nov 2021 Google Chromium V8 Memory corruption
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 95.0.4638.69
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-755
3 Nov 2021 Google Chromium Intents Open redirect
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 95.0.4638.69
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20
3 Nov 2021 Google Chromium Access control flaw
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.71
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-862
3 Nov 2021 Google Chromium V8 Memory corruption
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.71
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Portals Memory corruption
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.61
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 90.0.4430.85
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-843
3 Nov 2021 Google Chromium Blink Memory corruption
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.90
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Race condition
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.72
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-362
3 Nov 2021 Google Chromium V8 Memory corruption
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 88.0.4324.150
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122
3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 80.0.3987.122
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
3 Nov 2021 Google Chrome FreeType Memory corruption
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 86.0.4240.111, freetype 2.10.4
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Android Kernel Memory corruption
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- huawei bla-l29c firmware 9.1.0.300\(c432e4r1p11t8\), huawei berkeley-tl10 firmware 9.1.0.333\(c01e333r1p1t8\), huawei ares-al10d firmware 9.1.0.165\(c00e165r2p5t8\), huawei berkeley-l09 firmware 9.1.0.351\(c432e5r1p13t8\), huawei bla-al00b firmware 10.0.0.170\(c786e170r2p4\) and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.