CISA Known Exploited Vulnerabilities
KEV additions — March 2026
15 CVEs entered the KEV catalog in March 2026.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added March 25, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-33017 | Langflow Code Injection Vulnerability | — | 24.8 % | Apr 8, 2026 |
Added March 20, 20263
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-31277 | Apple Multiple Products Buffer Overflow Vulnerability | 8.8 | 1.6 % | Apr 3, 2026 |
| CVE-2025-32432 | Craft CMS Code Injection Vulnerability | 10 | 99.8 % | Apr 3, 2026 |
| CVE-2025-54068 | Livewire vulnerable to remote command execution during property update hydration | 9.8 | 96.3 % | Apr 3, 2026 |
Added March 19, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-20131ransomware | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | 10 | 43.2 % | Mar 22, 2026 |
Added March 18, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-20963 | Microsoft SharePoint Remote Code Execution Vulnerability | 9.8 | 29.2 % | Mar 21, 2026 |
Added March 16, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-47813 | Wing FTP Server Information Disclosure Vulnerability | 4.3 | 62.5 % | Mar 30, 2026 |
Added March 13, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-3909 | Google Skia Out-of-Bounds Write Vulnerability | 8.8 | 2.3 % | Mar 27, 2026 |
| CVE-2026-3910 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | 8.8 | 1.1 % | Mar 27, 2026 |
Added March 11, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-68613 | n8n Improper Control of Dynamically-Managed Code Resources Vulnerability | 8.8 | 99.0 % | Mar 25, 2026 |
Added March 9, 20263
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-22054 | Omnissa Workspace ONE Server-Side Request Forgery | 7.5 | 99.7 % | Mar 23, 2026 |
| CVE-2025-26399 | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 9.8 | 90.1 % | Mar 12, 2026 |
| CVE-2026-1603 | Authentication Bypass Allows Credential Leakage in Ivanti Endpoint Manager | 8.6 | 88.3 % | Mar 23, 2026 |
Added March 3, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-21385 | Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 7.8 | 1.3 % | Mar 24, 2026 |
| CVE-2026-22719 | Broadcom VMware Aria Operations Command Injection Vulnerability | 8.1 | 18.1 % | Mar 24, 2026 |