The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
3 Nov 2026 WordPress Core Race condition
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 5.8.19, wordpress 5.7.21, wordpress 5.6.23, wordpress 5.5.24, wordpress 5.4.25 and 7 older
- CISA due date
- 6 Nov 2026
- Weakness
- CWE-367
25 Sep 2026 WordPress Core Security flaw
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 5.8.17, wordpress 5.7.19, wordpress 5.6.21, wordpress 5.5.22, wordpress 5.4.23 and 7 older
- CISA due date
- 28 Sep 2026
- Weakness
- CWE-98
21 Jul 2026 WordPress Core Security flaw
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 7.0.2, wordpress 6.9.5
- CISA due date
- 24 Jul 2026
- Weakness
- CWE-436
21 Jul 2026 WordPress Core SQL injection
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 7.0.2, wordpress 6.9.5, wordpress 6.8.6
- CISA due date
- 4 Aug 2026
- Weakness
- CWE-89
30 Apr 2026 WebPros cPanel & WHM and WP2 (WordPress Squared) Authentication bypass
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cpanel 136.0.5, cpanel 134.0.20, cpanel 132.0.29, cpanel 130.0.19, cpanel 126.0.54 and 7 older
- CISA due date
- 3 May 2026
- Weakness
- CWE-306
7 Jul 2025 PHPMailer Command injection
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- phpmailer project phpmailer 5.2.18
- CISA due date
- 28 Jul 2025
- Weakness
- CWE-77, CWE-88
3 Nov 2021 WordPress File Manager Plugin Malicious file upload
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- filemanagerpro file manager 6.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-434
3 Nov 2021 WordPress Snap Creek Duplicator Plugin Path traversal
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- awesomemotive duplicator 3.8.7.1, awesomemotive duplicator 1.3.28
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 WordPress Social Warfare Plugin Cross-site scripting
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- warfareplugins social warfare 3.5.3, warfareplugins social warfare pro 3.5.3
- CISA due date
- 3 May 2022
- Weakness
- CWE-79
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.