KEV Tracker
CISA's Known Exploited Vulnerabilities Catalog, explained for medical device manufacturers. Search, filter and export every entry, with CVSS and EPSS scores.
Catalog last synced: 19 Oct 2026, 12:20 CEST
Threat matrix
Severity (CVSS) against likelihood of exploitation (EPSS). Click a cell to filter.
Regulatory lens
How KEV deadlines map to device-maker obligations.
CISA BOD 26-04
U.S. federal agencies (de facto benchmark for critical infrastructure)
FDA Section 524B & postmarket guidance
Cyber devices marketed in the U.S.
EU MDR / IVDR Annex I 17.2 & 17.4
Devices with software placed on the EU market
EU Cyber Resilience Act (Regulation (EU) 2024/2847)
Products with digital elements on the EU market; medical devices under MDR/IVDR are excluded, but connected accessories, apps and supporting software may be in scope
| Vulnerability | Signals | ||||||
|---|---|---|---|---|---|---|---|
| CVE-2025-61624 | Fortinet Multiple Products affected from 7.6.0 through 7.6.4, affected from 7.4.0 through 7.4.9 +17 more | Fortinet Multiple Products Path Traversal Vulnerability | 5.4medium · v3.1 | 1.1%P65 | 16 Oct 2026 | Due today19 Oct 2026 | InfrastructureTriage |
| CVE-2026-102764 | BeyondTrust Remote Support affected through 26.2.3 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | 9.3critical · v4.0 | 1.2%P67 | 16 Oct 2026 | Due today19 Oct 2026 | Triage |
| CVE-2026-21589 | Atlassian Multiple Products affected from 7.17.0 before 9.4.26, affected from 9.5.0 before 10.2.8 +18 more | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 9.3critical · v4.0 | 12.7%P96 | 15 Oct 2026 | 18 Oct 2026 | InfrastructureTriage |
| CVE-2026-0322 | Palo Alto Networks PAN-OS affected from 12.2.0 before 12.2.4, affected from 12.1.0 before 12.1.10-h2 +3 more | Palo Alto Networks PAN-OS Code Injection Vulnerability | 8.6high · v4.0 | 1.2%P68 | 14 Oct 2026 | 17 Oct 2026 | InfrastructureTriage |
| CVE-2026-105133 | Ahsay AhsayCBS 10.3.0, 10.3.1 +1 more | Ahsay AhsayCBS Improper Authentication Vulnerability | 6.9medium · v4.0 | 0.85%P58 | 14 Oct 2026 | 17 Oct 2026 | — |
| CVE-2026-105134 | Ahsay AhsayCBS 10.3.0, 10.3.1 +1 more | Ahsay AhsayCBS Command Injection Vulnerability | 10.0critical · v4.0 | 4.8%P92 | 14 Oct 2026 | 17 Oct 2026 | Triage |
| CVE-2026-76519 | Cisco Secure Email Gateway 14.0.0-698, 13.5.1-277 +21 more | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 9.8critical · v3.1 | 1.6%P75 | 14 Oct 2026 | 17 Oct 2026 | InfrastructureTriage |
| CVE-2026-104935 | Ivanti Connect Secure affected from 25.1.0.0 before 25.1.1.2, affected from 25.1.2.0 before 25.1.3.0 +5 more | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | 8.6high · v3.1 | 26.0%P98 | 13 Oct 2026 | 16 Oct 2026 | InfrastructureTriage |
| CVE-2026-96951 | Microsoft Windows affected from 1.0.0 before 20260925.100, affected from 10.0.14393.0 before 10.0.14393.9612 +18 more | Microsoft Windows Command Injection Vulnerability | 8.8high · v3.1 | 1.5%P74 | 13 Oct 2026 | 16 Oct 2026 | Triage |
| CVE-2015-3306 | ProFTPD ProFTPD 20, 21 +6 more | ProFTPD Improper Access Control Vulnerability | 10.0critical · v3.1 | 99.5%P100 | 08 Oct 2026 | 11 Oct 2026 | Triage |
| CVE-2015-5477 | ISC BIND affected before 12.1, affected from 13.1 before 13.2 +80 more | ISC BIND Data Processing Errors Vulnerability | 7.5high · v3.1 | 99.4%P100 | 08 Oct 2026 | 11 Oct 2026 | — |
| CVE-2016-3081 | Apache Struts v100r002c00, v200r005c00 +64 more | Apache Struts Command Injection Vulnerability | 8.1high · v3.1 | 96.1%P100 | 08 Oct 2026 | 11 Oct 2026 | Device / SBOMTriage |
| CVE-2021-3199 | ONLYOFFICE Docs affected before 5.6.3 | ONLYOFFICE Docs Server Path Traversal Vulnerability | 9.8critical · v3.1 | 20.1%P97 | 08 Oct 2026 | 11 Oct 2026 | Triage |
| CVE-2023-22894 | Strapi Strapi affected from 3.2.1 before 4.8.0 | Strapi Cleartext Storage of Sensitive Information Vulnerability | 7.2high · v3.1 | 3.6%P89 | 08 Oct 2026 | 11 Oct 2026 | Triage |
| CVE-2026-88779 | Citrix NetScaler affected before 14.1-73.41, affected before 13.1-64.28 +4 more | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 8.7high · v4.0 | 0.59%P47 | 04 Oct 2026 | 07 Oct 2026 | Infrastructure |
| CVE-2026-102489 | Zammad GmbH Zammad affected from 6.3.0 before 6.5.4 | Zammad GmbH Zammad Session Fixation Vulnerability | 8.7high · v4.0 | 1.3%P69 | 02 Oct 2026 | 05 Oct 2026 | Triage |
| CVE-2026-102490 | Zammad GmbH Zammad affected from 1.5.0 before 7.2.2 | Zammad GmbH Zammad Improper Privilege Management Vulnerability | 8.5high · v4.0 | 0.55%P45 | 02 Oct 2026 | 05 Oct 2026 | Triage |
| CVE-2026-104286 | Fortinet FortiMail 8.0.0, affected from 7.6.0 through 7.6.5 +3 more | Fortinet FortiMail Path Traversal Vulnerability | 9.8critical · v3.1 | 2.2%P82 | 01 Oct 2026 | 04 Oct 2026 | InfrastructureTriage |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager 20.1.12, 19.2.1 +38 more | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 9.8critical · v3.1 | 1.8%P78 | 30 Sept 2026 | 03 Oct 2026 | InfrastructureTriage |
| CVE-2026-86950 | Apple Multiple Products affected before 26.7.1, affected before 15.8.1 +1 more | Apple Multiple Products Out-of-Bounds Write Vulnerability | 8.8high · v3.1 | 1.2%P69 | 29 Sept 2026 | 13 Oct 2026 | — |
| CVE-2026-88771 | Citrix NetScaler affected before 14.1-73.37, affected before 13.1-64.23 +4 more | Citrix NetScaler Improper Input Validation Vulnerability | 9.5critical · v4.0 | 1.1%P65 | 27 Sept 2026 | 30 Sept 2026 | InfrastructureTriage |
| CVE-2026-88772 | Citrix NetScaler affected before 14.1-73.37, affected before 13.1-64.23 +4 more | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 9.5critical · v4.0 | 1.3%P70 | 27 Sept 2026 | 30 Sept 2026 | InfrastructureTriage |
| CVE-2026-65660 | Microsoft SharePoint affected from 16.0.0 before 16.0.5565.1001, affected from 16.0.0 before 16.0.10417.20198 +1 more | Microsoft SharePoint Code Injection Vulnerability | 8.8high · v3.1 | 2.1%P81 | 25 Sept 2026 | 28 Sept 2026 | InfrastructureTriage |
| CVE-2026-67279 | MikroTik RouterOS affected from 7.24 before 7.24.2, affected from 7.0.0 before 7.23.4 +1 more | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 6.9medium · v4.0 | 1.0%P63 | 25 Sept 2026 | 28 Sept 2026 | — |
| CVE-2026-87902 | WordPress Core affected before 7.1.2 | WordPress Core Remote File Inclusion Vulnerability | 8.1high · v3.1 | 40.0%P99 | 25 Sept 2026 | 28 Sept 2026 | Device / SBOMTriage |
| CVE-2026-5430 | WSO2 Multiple Products affected from 4.5.0 before 4.5.0.57, affected from 4.6.0 before 4.6.0.21 +16 more | WSO2 Multiple Products Path Traversal Vulnerability | 10.0critical · v3.1 | 0.59%P47 | 24 Sept 2026 | 27 Sept 2026 | InfrastructureTriage |
| CVE-2026-71362 | Adobe Commerce and Magento affected through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, affected through 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul +1 more | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 9.1critical · v3.1 | 87.5%P100 | 24 Sept 2026 | 27 Sept 2026 | Triage |
| CVE-2026-85102 | Check Point Multiple Products R82.10 with Jumbo Hotfix Take 43 or below, R82 with Jumbo Hotfix Take 125 or below +1 more | Check Point Multiple Products Improper Certificate Validation Vulnerability | 9.8critical · v3.1 | 50.4%P99 | 22 Sept 2026 | 25 Sept 2026 | InfrastructureTriage |
| CVE-2026-93616 | Check Point Multiple Products R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below +9 more | Check Point Multiple Products Path Traversal Vulnerability | 9.8critical · v3.1 | 75.9%P100 | 22 Sept 2026 | 25 Sept 2026 | InfrastructureTriage |
| CVE-2026-93952 | Arista VeloCloud Orchestrator affected from 5.2.0 through 5.2.3.15, affected from 6.1.0 through 6.1.3.7 +2 more | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 9.5critical · v4.0 | 1.1%P64 | 22 Sept 2026 | 25 Sept 2026 | Triage |
| CVE-2026-94127 | F5 BIG-IP APM affected from 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, affected from 17.5.0 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG +1 more | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 9.3critical · v4.0 | 2.2%P82 | 22 Sept 2026 | 25 Sept 2026 | InfrastructureTriage |
| CVE-2026-7273 | Zyxel GS1900 Series Switches <= 2.90(ABTQ.1)C0, <= 2.90(AAHH.1)C0 +8 more | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8high · v3.1 | 2.5%P84 | 21 Sept 2026 | 24 Sept 2026 | InfrastructureTriage |
| CVE-2025-39682 | Linux Kernel 6.0 | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | 9.8critical · v3.1 | 2.9%P87 | 18 Sept 2026 | 21 Sept 2026 | Device / SBOMTriage |
| CVE-2025-39964 | Linux Kernel 2.6.38 | Linux Kernel Race Condition Vulnerability | 7.8high · v3.1 | 1.4%P71 | 18 Sept 2026 | 21 Sept 2026 | Device / SBOMTriage |
| CVE-2026-53266 | Linux Kernel affected from 5.4.73 before 5.5, affected from 5.8.17 before 5.9 +2 more | Linux Kernel Out-of-Bounds Write Vulnerability | 8.8high · v3.1 | 0.83%P57 | 18 Sept 2026 | 21 Sept 2026 | Device / SBOMTriage |
| CVE-2026-58704 | Pixel Android kernel | Google Pixel Improper Authorization Vulnerability | 8.8high · v3.1 | 0.59%P47 | 16 Sept 2026 | 19 Sept 2026 | Triage |
| CVE-2026-76460 | Cisco Identity Services Engine 3.1.0 p8, 3.1.0 p9 +30 more | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 10.0critical · v3.1 | 14.0%P97 | 16 Sept 2026 | 19 Sept 2026 | InfrastructureTriage |
| CVE-2026-87886 | Acronis Backup affected before 1.9.3.1021, affected before 1.8.11.638 +1 more | Acronis Backup Incorrect Default Permissions Vulnerability | 7.8high · v3.0 | 0.23%P13 | 16 Sept 2026 | 19 Sept 2026 | Triage |
| CVE-2026-76461 | Cisco Secure Email Gateway 14.0.0-698, 13.5.1-277 +21 more | Cisco Secure Email Gateway SQL Injection Vulnerability | 9.8critical · v3.1 | 29.5%P98 | 14 Sept 2026 | 17 Sept 2026 | InfrastructureTriage |
| CVE-2026-42016 | JFrog Artifactory affected before 7.133.11 | JFrog Artifactory Incorrect Authorization Vulnerability | 8.1high · v3.1 | 8.6%P95 | 11 Sept 2026 | 25 Sept 2026 | — |
| CVE-2026-42018 | JFrog Artifactory affected before 7.111.20, affected from 7.117.0 before 7.117.27 +3 more | JFrog Artifactory Improper Authentication Vulnerability | 7.5high · v3.1 | 9.8%P96 | 11 Sept 2026 | 25 Sept 2026 | — |
| CVE-2026-84869 | ConnectWise ScreenConnect All versions prior to 26.6.5 | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | 9.9critical · v3.1 | 0.92%P60 | 11 Sept 2026 | 14 Sept 2026 | InfrastructureTriage |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition affected from 18.7 before 18.11.12, affected from 19.0 before 19.0.9 +3 more | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 10.0critical · v3.1 | 93.0%P100 | 11 Sept 2026 | 14 Sept 2026 | Triage |
| CVE-2026-67277 | MikroTik RouterOS affected from 7.24 before 7.24.2, affected from 7.0.0 before 7.23.4 +1 more | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | 8.8high · v4.0 | 1.6%P75 | 10 Sept 2026 | 13 Sept 2026 | — |
| CVE-2026-86060 | MikroTik RouterOS affected from 7.24 before 7.24.2, affected from 7.0.0 before 7.23.4 +1 more | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 9.2critical · v4.0 | 6.4%P94 | 10 Sept 2026 | 13 Sept 2026 | Triage |
| CVE-2025-25249 | Fortinet Multiple Products affected from 7.2.2 through 7.2.5, affected from 7.6.0 through 7.6.2 +2 more | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | 7.4high · v3.1 | 3.8%P90 | 09 Sept 2026 | 12 Sept 2026 | InfrastructureTriage |
| CVE-2026-19490 | Citrix NetScaler affected from 14.1 through 73.32, affected from 13.1 through 63.21 +2 more | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.3critical · v4.0 | 23.2%P98 | 09 Sept 2026 | 12 Sept 2026 | InfrastructureTriage |
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management 7.0.0, 7.0.0.1 +38 more | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 10.0critical · v3.1 | 88.2%P100 | 09 Sept 2026 | 12 Sept 2026 | InfrastructureTriage |
| CVE-2026-87491 | Chromium V8 affected from 153.0.8010.36 before 153.0.8010.36 | Google Chromium V8 Out of Bounds Write Vulnerability | 8.8high · v3.1 | 3.1%P88 | 09 Sept 2026 | 23 Sept 2026 | Device / SBOM |
| CVE-2026-75650 | Adobe Commerce and Magento affected through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, affected through 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug +1 more | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 10.0critical · v3.1 | 3.9%P90 | 08 Sept 2026 | 11 Sept 2026 | Triage |
Showing 1–50 of 1,748
Independent community resource. This tracker is provided free for the security community by Regulated Cyber, an independent publication. Regulated Cyber is not affiliated with, endorsed by, or acting on behalf of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), NIST, FIRST.org, the CVE Program, the FDA, the European Commission, or any other government agency or standards body. Catalog data is reproduced from public sources and may lag the official listings. Regulatory notes, SBOM checks and vendor questions are editorial starting points, not legal, regulatory or clinical advice; confirm applicability through your own risk management and quality processes.