KEV 2026

Microsoft Exchange Server OWA — Stored XSS via Crafted Email Enables Session Hijacking and Account Takeover

Linux Kernel 'Copy Fail' — algif_aead Page Cache Write for Local Privilege Escalation

Ivanti EPMM — Authenticated Admin RCE Chained from CVE-2026-1340 Credential Theft

Apache ActiveMQ Classic — Authenticated RCE via Jolokia JMX-HTTP Bridge (13-Year-Old Flaw, AI-Discovered)

Google Dawn — Use-After-Free Vulnerability in Graphics Rendering

Adobe Acrobat & Reader — Zero-Day JavaScript Prototype Pollution Leading to Arbitrary Code Execution

Microsoft Defender — BlueHammer TOCTOU Race Condition Enabling Local Privilege Escalation to SYSTEM

TrueConf Client — Arbitrary Code Execution via Insecure Update Mechanism ("TrueChaos")

Cisco Catalyst SD-WAN Manager — DCA Credential Exposure via Accessible Filesystem Enabling Privilege Escalation

Aquasecurity Trivy — Supply Chain Compromise via Embedded Malicious Code

Google Skia — Out-of-Bounds Write via Crafted HTML Page

Google Chromium V8 — Arbitrary Code Execution via Inappropriate Implementation

Ivanti EPM — Unauthenticated Credential Vault Access via Magic Number Header Bypass

Broadcom VMware Aria Operations — Broadcom VMware Aria Operations Command Injection Vulnerability

Qualcomm Multiple Chipsets — Memory Corruption via Integer Overflow in Memory Allocation

Soliton Systems K.K FileZen — Soliton Systems K.K FileZen OS Command Injection Vulnerability

Google Chromium — Google Chromium CSS Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows Shell Protection Mechanism Failure Vulnerability

Microsoft Windows — Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Apple Multiple Products — Apple Multiple Buffer Overflow Vulnerability

Microsoft Office — Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

Microsoft Windows — Microsoft Windows Type Confusion Vulnerability

Microsoft Windows — Microsoft Windows Improper Privilege Management Vulnerability

Cisco Unified Communications Manager — Cisco Unified Communications Products Code Injection Vulnerability

Microsoft Office — Microsoft Office Security Feature Bypass Vulnerability