Tools / KEV calendar

When CISA says it has to be fixed.

Every entry in the Known Exploited Vulnerabilities catalogue comes with a date by which US federal agencies must have remediated it. That date is also the best public signal of how urgently CISA regards the exploitation, so here is the catalogue as a calendar: what is overdue, what is due this week, and what is coming, with the products each one affects.

32 overdue (last 30 days)4 due within 7 days5 due in the next 120 days0 used in ransomware

Subscribe as a calendar (.ics)Only for my products

Paste the .ics address into Outlook, Google Calendar or Apple Calendar as a subscribed calendar and the deadlines stay current.

Overdue

Past CISA's due date. For US federal agencies that is a missed mandate; for everyone else it is a vulnerability that has been exploited in the wild for weeks and is still unpatched.

5 October 2026

30 days ago · 2 CVEs

CVE-2026-102489
Zammad GmbH Zammad Session Fixation Vulnerability
zammad/zammad · added 2 October 2026
KEVCRITICAL 9.4EPSS 22.5%
CVE-2026-102490
Zammad GmbH Zammad Improper Privilege Management Vulnerability
zammad/zammad · added 2 October 2026
KEVCRITICAL 9.4EPSS 10.9%

7 October 2026

28 days ago · 1 CVE

CVE-2026-88779
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
citrix/netscaler application delivery controller · citrix/netscaler gateway · added 4 October 2026
KEVHIGH 8.7EPSS 11.4%

11 October 2026

24 days ago · 5 CVEs

CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
fedoraproject/fedora · debian/debian linux · opensuse/tumbleweed · added 8 October 2026
KEVEXPLOIT ×4 ✓CRITICAL 10.0EPSS 99.5%
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability
juniper/junos · fedoraproject/fedora · redhat/enterprise linux · added 8 October 2026
KEVEXPLOIT ×2 ✓HIGH 7.5EPSS 99.6%
CVE-2016-3081
Apache Struts Command Injection Vulnerability
huawei/agile controller-campus firmware · huawei/anyoffice · huawei/logcenter · added 8 October 2026
KEVEXPLOIT ✓HIGH 8.1EPSS 96.5%
CVE-2021-3199
ONLYOFFICE Docs Server Path Traversal Vulnerability
onlyoffice/document server · added 8 October 2026
KEVCRITICAL 9.8EPSS 30.2%
CVE-2023-22894
Strapi Cleartext Storage of Sensitive Information Vulnerability
strapi/strapi · added 8 October 2026
KEVMEDIUM 4.9EPSS 4.11%

13 October 2026

22 days ago · 1 CVE

CVE-2026-86950
Apple Multiple Products Out-of-Bounds Write Vulnerability
apple/ipados · apple/iphone os · apple/macos · added 29 September 2026
KEVHIGH 8.8EPSS 26.2%

16 October 2026

19 days ago · 2 CVEs

CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
ivanti/connect secure · added 13 October 2026
KEVHIGH 8.6EPSS 88.9%
CVE-2026-96951
Microsoft Windows Command Injection Vulnerability
microsoft/outlook web · microsoft/windows 10 1607 · microsoft/windows 10 1809 · added 13 October 2026
KEVHIGH 8.8EPSS 9.81%

17 October 2026

18 days ago · 4 CVEs

CVE-2026-0322
Palo Alto Networks PAN-OS Code Injection Vulnerability
paloaltonetworks/pan-os · added 14 October 2026
KEVHIGH 8.6EPSS 1.74%
CVE-2026-105133
Ahsay AhsayCBS Improper Authentication Vulnerability
ahsay/cloud backup suite · added 14 October 2026
KEVMEDIUM 6.9EPSS 79.5%
CVE-2026-105134
Ahsay AhsayCBS Command Injection Vulnerability
ahsay/cloud backup suite · added 14 October 2026
KEVCRITICAL 10.0EPSS 81.8%
CVE-2026-76519
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
cisco/asyncos · added 14 October 2026
KEVCRITICAL 9.8EPSS 2.15%

18 October 2026

17 days ago · 1 CVE

CVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
atlassian/bitbucket data center · atlassian/bitbucket server · atlassian/confluence data center · added 15 October 2026
KEVCRITICAL 9.3EPSS 99.5%

19 October 2026

16 days ago · 2 CVEs

CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability
fortinet/fortios · fortinet/fortipam · fortinet/fortiproxy · added 16 October 2026
KEVMEDIUM 6.5EPSS 1.34%
CVE-2026-102764
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
beyondtrust/remote support · added 16 October 2026
KEVCRITICAL 9.3EPSS 18.9%

23 October 2026

12 days ago · 3 CVEs

CVE-2026-106931
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
e-guardian/siteguard · added 20 October 2026
KEVHIGH 8.5EPSS 2.53%
CVE-2026-96654
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
plex/media server · added 20 October 2026
KEVMEDIUM 6.9EPSS 1.95%
CVE-2026-96656
Plex Media Server External Control of File Name or Path Vulnerability
plex/media server · added 20 October 2026
KEVHIGH 8.6EPSS 1.79%

26 October 2026

9 days ago · 2 CVEs

CVE-2026-110447
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
collabora/collabora online - built-in code server · added 23 October 2026
KEVCRITICAL 9.2EPSS 73.3%
CVE-2026-114625
Arista VeloCloud Orchestrator SQL Injection Vulnerability
arista/velocloud orchestrator · added 23 October 2026
KEVCRITICAL 9.4EPSS 1.03%

29 October 2026

6 days ago · 2 CVEs

CVE-2026-109618
PHP Memory Corruption Vulnerability
php/php · siemens/ruggedcom ape1808 firmware · paloaltonetworks/pan-os · added 26 October 2026
KEVEXPLOIT ✓CRITICAL 9.2EPSS 100.0%
CVE-2026-109619
PHP Stale Internal Request-State Vulnerability
php/php · siemens/ruggedcom ape1808 firmware · paloaltonetworks/pan-os · added 26 October 2026
KEVCRITICAL 9.2EPSS 100.0%

31 October 2026

4 days ago · 1 CVE

CVE-2026-46300
Linux Kernel Missing Initialization of a Variable Vulnerability
linux/linux kernel · siemens/simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware · redhat/openshift container platform · added 28 October 2026
KEVEXPLOITHIGH 7.8EPSS 16.1%

1 November 2026

3 days ago · 2 CVEs

CVE-2026-76418
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
cisco/adaptive security appliance software · cisco/secure firewall threat defense · added 29 October 2026
KEVHIGH 8.6EPSS 0.82%
CVE-2026-97229
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
gitlab/gitlab · ruby-lang/ruby · added 29 October 2026
KEVCRITICAL 10.0EPSS 27.7%

2 November 2026

2 days ago · 1 CVE

CVE-2026-111357
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
ivanti/connect secure · added 30 October 2026
KEVHIGH 7.0EPSS 0.53%

3 November 2026

1 day ago · 3 CVEs

CVE-2026-110936
Siemens Software Center Uncontrolled Search Path Element Vulnerability
siemens/software center · added 20 October 2026
KEVHIGH 8.4EPSS 0.97%
CVE-2026-96652
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
plex/media server · added 20 October 2026
KEVMEDIUM 5.3EPSS 11.9%
CVE-2026-96655
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
plex/media server · added 20 October 2026
KEVMEDIUM 5.3EPSS 1.64%

Due within seven days

Inside the next change window. If any of these are in your estate they should already be scheduled.

6 November 2026

in 2 days · 1 CVE

CVE-2026-119977
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
— · added 3 November 2026
KEVHIGH 8.1EPSS 0.60%

10 November 2026

in 6 days · 2 CVEs

CVE-2026-111497
Google Brotli Unchecked Return Value Vulnerability
google/brotli · nodejs/node.js · python-hyper/brotlicffi · added 27 October 2026
KEVCRITICAL 9.2EPSS 82.6%
CVE-2026-48356
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
adobe/commerce · adobe/commerce b2b · adobe/magento · added 27 October 2026
KEVCRITICAL 9.3EPSS 44.6%

11 November 2026

in 7 days · 1 CVE

CVE-2026-41709
Broadcom VMWare ESX Insufficient Logging Vulnerability
vmware/esxi · added 28 October 2026
KEVLOW 2.7EPSS 0.69%

Due within a fortnight

13 November 2026

in 9 days · 1 CVE

CVE-2026-118527
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
ivanti/connect secure · added 30 October 2026
KEVMEDIUM 4.3EPSS —

How to use the dates

Binding Operational Directive 22-01 obliges US federal civilian agencies to remediate each KEV entry by its due date. Nothing obliges a UK organisation, but the catalogue is the shortest list of vulnerabilities that are definitely being exploited, and the due dates are a ready-made prioritisation: CISA sets them shorter when the exploitation is broad or the impact severe. Treat an entry in your estate as an emergency change regardless of the date, and treat an overdue one as a reason to hunt for prior compromise as well as to patch.

The CVE watchlist narrows this to your own products and includes KEV additions in its feed and email; each CVE Explorer page shows the deadline alongside the CVSS and EPSS scores. Data from CISA, refreshed every four hours.