[{"t":"KEV index: all known exploited vulnerabilities","u":"/kev/","k":"Data","d":"Filter all 1,721 entries"},{"t":"KEV additions in 2026","u":"/kev/2026/","k":"Data","d":"237 entries"},{"t":"KEV additions in 2025","u":"/kev/2025/","k":"Data","d":"245 entries"},{"t":"KEV additions in 2024","u":"/kev/2024/","k":"Data","d":"186 entries"},{"t":"KEV additions in 2023","u":"/kev/2023/","k":"Data","d":"187 entries"},{"t":"KEV additions in 2022","u":"/kev/2022/","k":"Data","d":"555 entries"},{"t":"KEV additions in 2021","u":"/kev/2021/","k":"Data","d":"311 entries"},{"t":"Ransomware-linked KEV vulnerabilities","u":"/kev/ransomware/","k":"Data","d":"361 entries flagged Known"},{"t":"Microsoft","u":"/vendors/microsoft/","k":"Vendor","d":"388 KEV entries, 117 ransomware-linked"},{"t":"Cisco","u":"/vendors/cisco/","k":"Vendor","d":"99 KEV entries, 7 ransomware-linked"},{"t":"Apple","u":"/vendors/apple/","k":"Vendor","d":"94 KEV entries, 0 ransomware-linked"},{"t":"Adobe","u":"/vendors/adobe/","k":"Vendor","d":"81 KEV entries, 11 ransomware-linked"},{"t":"Google","u":"/vendors/google/","k":"Vendor","d":"75 KEV entries, 0 ransomware-linked"},{"t":"Oracle","u":"/vendors/oracle/","k":"Vendor","d":"46 KEV entries, 13 ransomware-linked"},{"t":"Apache","u":"/vendors/apache/","k":"Vendor","d":"40 KEV entries, 8 ransomware-linked"},{"t":"Ivanti","u":"/vendors/ivanti/","k":"Vendor","d":"35 KEV entries, 12 ransomware-linked"},{"t":"Linux","u":"/vendors/linux/","k":"Vendor","d":"31 KEV entries, 2 ransomware-linked"},{"t":"Fortinet","u":"/vendors/fortinet/","k":"Vendor","d":"30 KEV entries, 14 ransomware-linked"},{"t":"D-Link","u":"/vendors/d-link/","k":"Vendor","d":"26 KEV entries, 2 ransomware-linked"},{"t":"VMware","u":"/vendors/vmware/","k":"Vendor","d":"26 KEV entries, 9 ransomware-linked"},{"t":"Citrix","u":"/vendors/citrix/","k":"Vendor","d":"24 KEV entries, 7 ransomware-linked"},{"t":"SonicWall","u":"/vendors/sonicwall/","k":"Vendor","d":"19 KEV entries, 13 ransomware-linked"},{"t":"Synacor","u":"/vendors/synacor/","k":"Vendor","d":"19 KEV entries, 6 ransomware-linked"},{"t":"Android","u":"/vendors/android/","k":"Vendor","d":"17 KEV entries, 0 ransomware-linked"},{"t":"Palo Alto Networks","u":"/vendors/palo-alto-networks/","k":"Vendor","d":"15 KEV entries, 6 ransomware-linked"},{"t":"Samsung","u":"/vendors/samsung/","k":"Vendor","d":"15 KEV entries, 0 ransomware-linked"},{"t":"SAP","u":"/vendors/sap/","k":"Vendor","d":"14 KEV entries, 3 ransomware-linked"},{"t":"Atlassian","u":"/vendors/atlassian/","k":"Vendor","d":"13 KEV entries, 8 ransomware-linked"},{"t":"Mozilla","u":"/vendors/mozilla/","k":"Vendor","d":"13 KEV entries, 1 ransomware-linked"},{"t":"Zyxel","u":"/vendors/zyxel/","k":"Vendor","d":"13 KEV entries, 2 ransomware-linked"},{"t":"Qualcomm","u":"/vendors/qualcomm/","k":"Vendor","d":"12 KEV entries, 0 ransomware-linked"},{"t":"Trend Micro","u":"/vendors/trend-micro/","k":"Vendor","d":"12 KEV entries, 0 ransomware-linked"},{"t":"QNAP","u":"/vendors/qnap/","k":"Vendor","d":"11 KEV entries, 9 ransomware-linked"},{"t":"Roundcube","u":"/vendors/roundcube/","k":"Vendor","d":"11 KEV entries, 0 ransomware-linked"},{"t":"SolarWinds","u":"/vendors/solarwinds/","k":"Vendor","d":"11 KEV entries, 2 ransomware-linked"},{"t":"Arm","u":"/vendors/arm/","k":"Vendor","d":"9 KEV entries, 0 ransomware-linked"},{"t":"Progress","u":"/vendors/progress/","k":"Vendor","d":"9 KEV entries, 4 ransomware-linked"},{"t":"Red Hat","u":"/vendors/red-hat/","k":"Vendor","d":"9 KEV entries, 4 ransomware-linked"},{"t":"Zoho","u":"/vendors/zoho/","k":"Vendor","d":"9 KEV entries, 2 ransomware-linked"},{"t":"F5","u":"/vendors/f5/","k":"Vendor","d":"8 KEV entries, 4 ransomware-linked"},{"t":"IBM","u":"/vendors/ibm/","k":"Vendor","d":"8 KEV entries, 2 ransomware-linked"},{"t":"Juniper","u":"/vendors/juniper/","k":"Vendor","d":"8 KEV entries, 0 ransomware-linked"},{"t":"NETGEAR","u":"/vendors/netgear/","k":"Vendor","d":"8 KEV entries, 0 ransomware-linked"},{"t":"Mitel","u":"/vendors/mitel/","k":"Vendor","d":"7 KEV entries, 5 ransomware-linked"},{"t":"Sophos","u":"/vendors/sophos/","k":"Vendor","d":"7 KEV entries, 2 ransomware-linked"},{"t":"Jenkins","u":"/vendors/jenkins/","k":"Vendor","d":"6 KEV entries, 1 ransomware-linked"},{"t":"TP-Link","u":"/vendors/tp-link/","k":"Vendor","d":"6 KEV entries, 0 ransomware-linked"},{"t":"Broadcom","u":"/vendors/broadcom/","k":"Vendor","d":"5 KEV entries, 1 ransomware-linked"},{"t":"Check Point","u":"/vendors/check-point/","k":"Vendor","d":"5 KEV entries, 2 ransomware-linked"},{"t":"DrayTek","u":"/vendors/draytek/","k":"Vendor","d":"5 KEV entries, 0 ransomware-linked"},{"t":"Drupal","u":"/vendors/drupal/","k":"Vendor","d":"5 KEV entries, 2 ransomware-linked"},{"t":"Exim","u":"/vendors/exim/","k":"Vendor","d":"5 KEV entries, 1 ransomware-linked"},{"t":"GitLab","u":"/vendors/gitlab/","k":"Vendor","d":"5 KEV entries, 1 ransomware-linked"},{"t":"GNU","u":"/vendors/gnu/","k":"Vendor","d":"5 KEV entries, 0 ransomware-linked"},{"t":"Langflow","u":"/vendors/langflow/","k":"Vendor","d":"5 KEV entries, 1 ransomware-linked"},{"t":"N-able","u":"/vendors/n-able/","k":"Vendor","d":"5 KEV entries, 0 ransomware-linked"},{"t":"PaperCut","u":"/vendors/papercut/","k":"Vendor","d":"5 KEV entries, 2 ransomware-linked"},{"t":"RARLAB","u":"/vendors/rarlab/","k":"Vendor","d":"5 KEV entries, 4 ransomware-linked"},{"t":"WordPress","u":"/vendors/wordpress/","k":"Vendor","d":"5 KEV entries, 0 ransomware-linked"},{"t":"Vendors ranked by KEV entries","u":"/vendors/","k":"Data","d":"283 vendors"},{"t":"Microsoft Windows","u":"/products/microsoft-windows/","k":"Product","d":"172 KEV entries"},{"t":"Apple Multiple Products","u":"/products/apple-multiple-products/","k":"Product","d":"53 KEV entries"},{"t":"Google Chromium V8","u":"/products/google-chromium-v8/","k":"Product","d":"41 KEV entries"},{"t":"Microsoft Internet Explorer","u":"/products/microsoft-internet-explorer/","k":"Product","d":"36 KEV entries"},{"t":"Adobe Flash Player","u":"/products/adobe-flash-player/","k":"Product","d":"33 KEV entries"},{"t":"Linux Kernel","u":"/products/linux-kernel/","k":"Product","d":"31 KEV entries"},{"t":"Microsoft Office","u":"/products/microsoft-office/","k":"Product","d":"29 KEV entries"},{"t":"Microsoft Win32k","u":"/products/microsoft-win32k/","k":"Product","d":"25 KEV entries"},{"t":"Microsoft Exchange Server","u":"/products/microsoft-exchange-server/","k":"Product","d":"17 KEV entries"},{"t":"Adobe ColdFusion","u":"/products/adobe-coldfusion/","k":"Product","d":"16 KEV entries"},{"t":"Synacor Zimbra Collaboration Suite (ZCS)","u":"/products/synacor-zimbra-collaboration-suite-zcs/","k":"Product","d":"16 KEV entries"},{"t":"Cisco IOS and IOS XE Software","u":"/products/cisco-ios-and-ios-xe-software/","k":"Product","d":"14 KEV entries"},{"t":"Adobe Acrobat and Reader","u":"/products/adobe-acrobat-and-reader/","k":"Product","d":"13 KEV entries"},{"t":"Samsung Mobile Devices","u":"/products/samsung-mobile-devices/","k":"Product","d":"13 KEV entries"},{"t":"Oracle WebLogic Server","u":"/products/oracle-weblogic-server/","k":"Product","d":"12 KEV entries"},{"t":"Palo Alto Networks PAN-OS","u":"/products/palo-alto-networks-pan-os/","k":"Product","d":"12 KEV entries"},{"t":"Apple iOS, iPadOS, and macOS","u":"/products/apple-ios-ipados-and-macos/","k":"Product","d":"11 KEV entries"},{"t":"Qualcomm Multiple Chipsets","u":"/products/qualcomm-multiple-chipsets/","k":"Product","d":"10 KEV entries"},{"t":"SAP NetWeaver","u":"/products/sap-netweaver/","k":"Product","d":"10 KEV entries"},{"t":"Fortinet FortiOS","u":"/products/fortinet-fortios/","k":"Product","d":"9 KEV entries"},{"t":"Microsoft SharePoint","u":"/products/microsoft-sharepoint/","k":"Product","d":"9 KEV entries"},{"t":"VMware vCenter Server","u":"/products/vmware-vcenter-server/","k":"Product","d":"9 KEV entries"},{"t":"Adobe Reader and Acrobat","u":"/products/adobe-reader-and-acrobat/","k":"Product","d":"8 KEV entries"},{"t":"Apple iOS","u":"/products/apple-ios/","k":"Product","d":"8 KEV entries"},{"t":"Ivanti Endpoint Manager Mobile (EPMM)","u":"/products/ivanti-endpoint-manager-mobile-epmm/","k":"Product","d":"7 KEV entries"},{"t":"Ivanti Pulse Connect Secure","u":"/products/ivanti-pulse-connect-secure/","k":"Product","d":"7 KEV entries"},{"t":"Juniper Junos OS","u":"/products/juniper-junos-os/","k":"Product","d":"7 KEV entries"},{"t":"Oracle Java SE","u":"/products/oracle-java-se/","k":"Product","d":"7 KEV entries"},{"t":"Roundcube Webmail","u":"/products/roundcube-webmail/","k":"Product","d":"7 KEV entries"},{"t":"Android Framework","u":"/products/android-framework/","k":"Product","d":"6 KEV entries"},{"t":"Apache Tomcat","u":"/products/apache-tomcat/","k":"Product","d":"6 KEV entries"},{"t":"Apple macOS","u":"/products/apple-macos/","k":"Product","d":"6 KEV entries"},{"t":"Arm Mali Graphics Processing Unit (GPU)","u":"/products/arm-mali-graphics-processing-unit-gpu/","k":"Product","d":"6 KEV entries"},{"t":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","u":"/products/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd/","k":"Product","d":"6 KEV entries"},{"t":"Cisco IOS software","u":"/products/cisco-ios-software/","k":"Product","d":"6 KEV entries"},{"t":"Cisco IOS XR","u":"/products/cisco-ios-xr/","k":"Product","d":"6 KEV entries"},{"t":"Fortinet Multiple Products","u":"/products/fortinet-multiple-products/","k":"Product","d":"6 KEV entries"},{"t":"Google Chromium","u":"/products/google-chromium/","k":"Product","d":"6 KEV entries"},{"t":"Mozilla Firefox and Thunderbird","u":"/products/mozilla-firefox-and-thunderbird/","k":"Product","d":"6 KEV entries"},{"t":"Oracle Fusion Middleware","u":"/products/oracle-fusion-middleware/","k":"Product","d":"6 KEV entries"},{"t":"Zoho ManageEngine","u":"/products/zoho-manageengine/","k":"Product","d":"6 KEV entries"},{"t":"Apache Struts","u":"/products/apache-struts/","k":"Product","d":"5 KEV entries"},{"t":"Apple iOS and iPadOS","u":"/products/apple-ios-and-ipados/","k":"Product","d":"5 KEV entries"},{"t":"Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers","u":"/products/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers/","k":"Product","d":"5 KEV entries"},{"t":"Citrix NetScaler ADC and NetScaler Gateway","u":"/products/citrix-netscaler-adc-and-netscaler-gateway/","k":"Product","d":"5 KEV entries"},{"t":"Langflow Langflow","u":"/products/langflow-langflow/","k":"Product","d":"5 KEV entries"},{"t":"Microsoft Defender","u":"/products/microsoft-defender/","k":"Product","d":"5 KEV entries"},{"t":"Microsoft SharePoint Server","u":"/products/microsoft-sharepoint-server/","k":"Product","d":"5 KEV entries"},{"t":"Mozilla Firefox","u":"/products/mozilla-firefox/","k":"Product","d":"5 KEV entries"},{"t":"SolarWinds Web Help Desk","u":"/products/solarwinds-web-help-desk/","k":"Product","d":"5 KEV entries"},{"t":"SonicWall SMA1000 Appliances","u":"/products/sonicwall-sma1000-appliances/","k":"Product","d":"5 KEV entries"},{"t":"Zyxel Multiple Firewalls","u":"/products/zyxel-multiple-firewalls/","k":"Product","d":"5 KEV entries"},{"t":"Accellion FTA","u":"/products/accellion-fta/","k":"Product","d":"4 KEV entries"},{"t":"Android Pixel","u":"/products/android-pixel/","k":"Product","d":"4 KEV entries"},{"t":"Apache HTTP Server","u":"/products/apache-http-server/","k":"Product","d":"4 KEV entries"},{"t":"Apple iOS and macOS","u":"/products/apple-ios-and-macos/","k":"Product","d":"4 KEV entries"},{"t":"Apple iOS, iPadOS, and watchOS","u":"/products/apple-ios-ipados-and-watchos/","k":"Product","d":"4 KEV entries"},{"t":"Cisco Adaptive Security Appliance (ASA)","u":"/products/cisco-adaptive-security-appliance-asa/","k":"Product","d":"4 KEV entries"},{"t":"Cisco Catalyst SD-WAN Manager","u":"/products/cisco-catalyst-sd-wan-manager/","k":"Product","d":"4 KEV entries"},{"t":"Cisco IOS and IOS XE","u":"/products/cisco-ios-and-ios-xe/","k":"Product","d":"4 KEV entries"},{"t":"Cisco IOS Software","u":"/products/cisco--ios-software/","k":"Product","d":"4 KEV entries"},{"t":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","u":"/products/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance/","k":"Product","d":"4 KEV entries"},{"t":"ConnectWise ScreenConnect","u":"/products/connectwise-screenconnect/","k":"Product","d":"4 KEV entries"},{"t":"Craft CMS Craft CMS","u":"/products/craft-cms-craft-cms/","k":"Product","d":"4 KEV entries"},{"t":"Fortinet FortiOS and FortiProxy","u":"/products/fortinet-fortios-and-fortiproxy/","k":"Product","d":"4 KEV entries"},{"t":"GIGABYTE Multiple Products","u":"/products/gigabyte-multiple-products/","k":"Product","d":"4 KEV entries"},{"t":"Ivanti Endpoint Manager (EPM)","u":"/products/ivanti-endpoint-manager-epm/","k":"Product","d":"4 KEV entries"},{"t":"JetBrains TeamCity","u":"/products/jetbrains-teamcity/","k":"Product","d":"4 KEV entries"},{"t":"JFrog Artifactory","u":"/products/jfrog-artifactory/","k":"Product","d":"4 KEV entries"},{"t":"Microsoft Open Management Infrastructure (OMI)","u":"/products/microsoft-open-management-infrastructure-omi/","k":"Product","d":"4 KEV entries"},{"t":"Microsoft Word","u":"/products/microsoft-word/","k":"Product","d":"4 KEV entries"},{"t":"MikroTik RouterOS","u":"/products/mikrotik-routeros/","k":"Product","d":"4 KEV entries"},{"t":"Nagios Nagios XI","u":"/products/nagios-nagios-xi/","k":"Product","d":"4 KEV entries"},{"t":"Oracle E-Business Suite","u":"/products/oracle-e-business-suite/","k":"Product","d":"4 KEV entries"},{"t":"Oracle Java Runtime Environment (JRE)","u":"/products/oracle-java-runtime-environment-jre/","k":"Product","d":"4 KEV entries"},{"t":"PaperCut NG/MF","u":"/products/papercut-ng-mf/","k":"Product","d":"4 KEV entries"},{"t":"QNAP Network Attached Storage (NAS)","u":"/products/qnap-network-attached-storage-nas/","k":"Product","d":"4 KEV entries"},{"t":"QNAP Photo Station","u":"/products/qnap-photo-station/","k":"Product","d":"4 KEV entries"},{"t":"RARLAB WinRAR","u":"/products/rarlab-winrar/","k":"Product","d":"4 KEV entries"},{"t":"Roundcube Roundcube Webmail","u":"/products/roundcube-roundcube-webmail/","k":"Product","d":"4 KEV entries"},{"t":"SimpleHelp  SimpleHelp","u":"/products/simplehelp-simplehelp/","k":"Product","d":"4 KEV entries"},{"t":"SolarWinds Serv-U","u":"/products/solarwinds-serv-u/","k":"Product","d":"4 KEV entries"},{"t":"Veeam Backup & Replication","u":"/products/veeam-backup-and-replication/","k":"Product","d":"4 KEV entries"},{"t":"Android Kernel","u":"/products/android-kernel/","k":"Product","d":"3 KEV entries"},{"t":"Apache ActiveMQ","u":"/products/apache-activemq/","k":"Product","d":"3 KEV entries"},{"t":"Apache OFBiz","u":"/products/apache-ofbiz/","k":"Product","d":"3 KEV entries"},{"t":"Atlassian Confluence Data Center and Server","u":"/products/atlassian-confluence-data-center-and-server/","k":"Product","d":"3 KEV entries"},{"t":"BerriAI LiteLLM","u":"/products/berriai-litellm/","k":"Product","d":"3 KEV entries"},{"t":"Cisco Identity Services Engine","u":"/products/cisco-identity-services-engine/","k":"Product","d":"3 KEV entries"},{"t":"Cisco IOS Software and Cisco IOS XE Software","u":"/products/cisco-ios-software-and-cisco-ios-xe-software/","k":"Product","d":"3 KEV entries"},{"t":"Citrix NetScaler","u":"/products/citrix-netscaler/","k":"Product","d":"3 KEV entries"},{"t":"CrushFTP CrushFTP","u":"/products/crushftp-crushftp/","k":"Product","d":"3 KEV entries"},{"t":"D-Link Multiple Routers","u":"/products/d-link-multiple-routers/","k":"Product","d":"3 KEV entries"},{"t":"Dassault Systèmes DELMIA Apriso","u":"/products/dassault-syst-mes-delmia-apriso/","k":"Product","d":"3 KEV entries"},{"t":"DotNetNuke (DNN) DotNetNuke (DNN)","u":"/products/dotnetnuke-dnn-dotnetnuke-dnn/","k":"Product","d":"3 KEV entries"},{"t":"Drupal Core","u":"/products/drupal-core/","k":"Product","d":"3 KEV entries"},{"t":"Exim Exim","u":"/products/exim-exim/","k":"Product","d":"3 KEV entries"},{"t":"F5 BIG-IP","u":"/products/f5-big-ip/","k":"Product","d":"3 KEV entries"},{"t":"Fortinet FortiClient EMS","u":"/products/fortinet-forticlient-ems/","k":"Product","d":"3 KEV entries"},{"t":"Fortinet FortiWeb","u":"/products/fortinet-fortiweb/","k":"Product","d":"3 KEV entries"},{"t":"IBM Data Risk Manager","u":"/products/ibm-data-risk-manager/","k":"Product","d":"3 KEV entries"},{"t":"ImageMagick ImageMagick","u":"/products/imagemagick-imagemagick/","k":"Product","d":"3 KEV entries"},{"t":"Ivanti Cloud Services Appliance (CSA)","u":"/products/ivanti-cloud-services-appliance-csa/","k":"Product","d":"3 KEV entries"},{"t":"Kaseya Virtual System/Server Administrator (VSA)","u":"/products/kaseya-virtual-system-server-administrator-vsa/","k":"Product","d":"3 KEV entries"},{"t":"Meta Platforms WhatsApp","u":"/products/meta-platforms-whatsapp/","k":"Product","d":"3 KEV entries"},{"t":"Microsoft .NET Framework","u":"/products/microsoft-net-framework/","k":"Product","d":"3 KEV entries"},{"t":"Microsoft Active Directory","u":"/products/microsoft-active-directory/","k":"Product","d":"3 KEV entries"},{"t":"Microsoft Excel","u":"/products/microsoft-excel/","k":"Product","d":"3 KEV entries"},{"t":"Microsoft Silverlight","u":"/products/microsoft-silverlight/","k":"Product","d":"3 KEV entries"},{"t":"Mitel MiVoice Connect","u":"/products/mitel-mivoice-connect/","k":"Product","d":"3 KEV entries"},{"t":"N-able N-central","u":"/products/n-able-n-central/","k":"Product","d":"3 KEV entries"},{"t":"Palo Alto Networks Expedition","u":"/products/palo-alto-networks-expedition/","k":"Product","d":"3 KEV entries"},{"t":"Qlik Sense","u":"/products/qlik-sense/","k":"Product","d":"3 KEV entries"},{"t":"Rails Ruby on Rails","u":"/products/rails-ruby-on-rails/","k":"Product","d":"3 KEV entries"},{"t":"SaltStack Salt","u":"/products/saltstack-salt/","k":"Product","d":"3 KEV entries"},{"t":"SmarterTools SmarterMail","u":"/products/smartertools-smartermail/","k":"Product","d":"3 KEV entries"},{"t":"SonicWall SonicOS","u":"/products/sonicwall-sonicos/","k":"Product","d":"3 KEV entries"},{"t":"SonicWall SonicWall Email Security","u":"/products/sonicwall-sonicwall-email-security/","k":"Product","d":"3 KEV entries"},{"t":"TeleMessage TM SGNL","u":"/products/telemessage-tm-sgnl/","k":"Product","d":"3 KEV entries"},{"t":"Ubiquiti UniFi OS","u":"/products/ubiquiti-unifi-os/","k":"Product","d":"3 KEV entries"},{"t":"Veritas Backup Exec Agent","u":"/products/veritas-backup-exec-agent/","k":"Product","d":"3 KEV entries"},{"t":"VMware ESXi","u":"/products/vmware-esxi/","k":"Product","d":"3 KEV entries"},{"t":"VMware Multiple Products","u":"/products/vmware-multiple-products/","k":"Product","d":"3 KEV entries"},{"t":"CWE-20: Improper input validation","u":"/cwe/cwe-20/","k":"Weakness","d":"119 KEV entries"},{"t":"CWE-78: OS command injection","u":"/cwe/cwe-78/","k":"Weakness","d":"110 KEV entries"},{"t":"CWE-787: Out-of-bounds write","u":"/cwe/cwe-787/","k":"Weakness","d":"104 KEV entries"},{"t":"CWE-416: Use after free","u":"/cwe/cwe-416/","k":"Weakness","d":"93 KEV entries"},{"t":"CWE-119: Memory buffer bounds error","u":"/cwe/cwe-119/","k":"Weakness","d":"85 KEV entries"},{"t":"CWE-22: Path traversal","u":"/cwe/cwe-22/","k":"Weakness","d":"79 KEV entries"},{"t":"CWE-502: Unsafe deserialization","u":"/cwe/cwe-502/","k":"Weakness","d":"71 KEV entries"},{"t":"CWE-94: Code injection","u":"/cwe/cwe-94/","k":"Weakness","d":"70 KEV entries"},{"t":"CWE-287: Improper authentication","u":"/cwe/cwe-287/","k":"Weakness","d":"47 KEV entries"},{"t":"CWE-306: Missing authentication","u":"/cwe/cwe-306/","k":"Weakness","d":"42 KEV entries"},{"t":"CWE-843: Type confusion","u":"/cwe/cwe-843/","k":"Weakness","d":"38 KEV entries"},{"t":"CWE-284: Improper access control","u":"/cwe/cwe-284/","k":"Weakness","d":"36 KEV entries"},{"t":"CWE-79: Cross-site scripting (XSS)","u":"/cwe/cwe-79/","k":"Weakness","d":"33 KEV entries"},{"t":"CWE-122: Heap-based buffer overflow","u":"/cwe/cwe-122/","k":"Weakness","d":"33 KEV entries"},{"t":"CWE-89: SQL injection","u":"/cwe/cwe-89/","k":"Weakness","d":"32 KEV entries"},{"t":"CWE-264: Permissions and access controls (category)","u":"/cwe/cwe-264/","k":"Weakness","d":"31 KEV entries"},{"t":"CWE-77: Command injection","u":"/cwe/cwe-77/","k":"Weakness","d":"30 KEV entries"},{"t":"CWE-200: Information exposure","u":"/cwe/cwe-200/","k":"Weakness","d":"25 KEV entries"},{"t":"CWE-434: Unrestricted file upload","u":"/cwe/cwe-434/","k":"Weakness","d":"23 KEV entries"},{"t":"CWE-918: Server-side request forgery","u":"/cwe/cwe-918/","k":"Weakness","d":"22 KEV entries"},{"t":"CWE-288: Authentication bypass via alternate path","u":"/cwe/cwe-288/","k":"Weakness","d":"21 KEV entries"},{"t":"CWE-269: Improper privilege management","u":"/cwe/cwe-269/","k":"Weakness","d":"18 KEV entries"},{"t":"CWE-399: Resource management errors (category)","u":"/cwe/cwe-399/","k":"Weakness","d":"18 KEV entries"},{"t":"CWE-59: Link following","u":"/cwe/cwe-59/","k":"Weakness","d":"17 KEV entries"},{"t":"CWE-125: Out-of-bounds read","u":"/cwe/cwe-125/","k":"Weakness","d":"17 KEV entries"},{"t":"CWE-863: Incorrect authorization","u":"/cwe/cwe-863/","k":"Weakness","d":"17 KEV entries"},{"t":"CWE-190: Integer overflow","u":"/cwe/cwe-190/","k":"Weakness","d":"16 KEV entries"},{"t":"CWE-74: Injection","u":"/cwe/cwe-74/","k":"Weakness","d":"12 KEV entries"},{"t":"CWE-120: Classic buffer overflow","u":"/cwe/cwe-120/","k":"Weakness","d":"12 KEV entries"},{"t":"CWE-121: Stack-based buffer overflow","u":"/cwe/cwe-121/","k":"Weakness","d":"12 KEV entries"},{"t":"CWE-362: Race condition","u":"/cwe/cwe-362/","k":"Weakness","d":"12 KEV entries"},{"t":"CWE-862: Missing authorization","u":"/cwe/cwe-862/","k":"Weakness","d":"12 KEV entries"},{"t":"CWE-693: Protection mechanism failure","u":"/cwe/cwe-693/","k":"Weakness","d":"11 KEV entries"},{"t":"CWE-23: Relative path traversal","u":"/cwe/cwe-23/","k":"Weakness","d":"9 KEV entries"},{"t":"CWE-506","u":"/cwe/cwe-506/","k":"Weakness","d":"8 KEV entries"},{"t":"CWE-611: XML external entity (XXE)","u":"/cwe/cwe-611/","k":"Weakness","d":"8 KEV entries"},{"t":"CWE-798: Hard-coded credentials","u":"/cwe/cwe-798/","k":"Weakness","d":"8 KEV entries"},{"t":"CWE-138","u":"/cwe/cwe-138/","k":"Weakness","d":"7 KEV entries"},{"t":"CWE-95: Eval injection","u":"/cwe/cwe-95/","k":"Weakness","d":"6 KEV entries"},{"t":"CWE-189","u":"/cwe/cwe-189/","k":"Weakness","d":"6 KEV entries"},{"t":"CWE-352: Cross-site request forgery","u":"/cwe/cwe-352/","k":"Weakness","d":"6 KEV entries"},{"t":"CWE-404","u":"/cwe/cwe-404/","k":"Weakness","d":"6 KEV entries"},{"t":"CWE-36","u":"/cwe/cwe-36/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-73","u":"/cwe/cwe-73/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-88","u":"/cwe/cwe-88/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-276: Incorrect default permissions","u":"/cwe/cwe-276/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-290","u":"/cwe/cwe-290/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-295","u":"/cwe/cwe-295/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-347","u":"/cwe/cwe-347/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-367","u":"/cwe/cwe-367/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-400: Uncontrolled resource consumption","u":"/cwe/cwe-400/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-822","u":"/cwe/cwe-822/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-917","u":"/cwe/cwe-917/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-1188","u":"/cwe/cwe-1188/","k":"Weakness","d":"5 KEV entries"},{"t":"CWE-116","u":"/cwe/cwe-116/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-184","u":"/cwe/cwe-184/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-326","u":"/cwe/cwe-326/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-415: Double free","u":"/cwe/cwe-415/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-444","u":"/cwe/cwe-444/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-494","u":"/cwe/cwe-494/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-522","u":"/cwe/cwe-522/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-754","u":"/cwe/cwe-754/","k":"Weakness","d":"4 KEV entries"},{"t":"CWE-80","u":"/cwe/cwe-80/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-134","u":"/cwe/cwe-134/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-158","u":"/cwe/cwe-158/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-250","u":"/cwe/cwe-250/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-285: Improper authorization","u":"/cwe/cwe-285/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-552","u":"/cwe/cwe-552/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-755","u":"/cwe/cwe-755/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-807","u":"/cwe/cwe-807/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-908","u":"/cwe/cwe-908/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-912","u":"/cwe/cwe-912/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-1220","u":"/cwe/cwe-1220/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-1336","u":"/cwe/cwe-1336/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-1386","u":"/cwe/cwe-1386/","k":"Weakness","d":"3 KEV entries"},{"t":"CWE-1390","u":"/cwe/cwe-1390/","k":"Weakness","d":"3 KEV entries"},{"t":"Weaknesses (CWE) ranked","u":"/cwe/","k":"Data","d":"185 CWEs"},{"t":"State of KEV report","u":"/stats/","k":"Report","d":"Computed statistics with citations"},{"t":"SMS OTP regulation board","u":"/regulations/","k":"Regulation","d":"Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in f"},{"t":"UAE: SMS and email OTP phase-out","u":"/regulations/uae/","k":"Regulation","d":"Complete, Jul 2025 – Mar 2026"},{"t":"Philippines: Circular 1213: no SMS or email OTP for high-risk transactions","u":"/regulations/philippines/","k":"Regulation","d":"In force, From Jun 25, 2026"},{"t":"India: Authentication Directions 2025","u":"/regulations/india/","k":"Regulation","d":"In force, From Apr 1, 2026"},{"t":"Singapore: OTP login phase-out for customers with digital tokens","u":"/regulations/singapore/","k":"Regulation","d":"In force, From Jul 2024"},{"t":"Malaysia: Banks directed off SMS OTP","u":"/regulations/malaysia/","k":"Regulation","d":"In force, 2022 – 2024"},{"t":"European Union: PSR / PSD3 fraud and SCA package","u":"/regulations/european-union/","k":"Regulation","d":"Pending, Deal Nov 27, 2025"},{"t":"United States: SP 800-63B-4: SMS OTP is a \"restricted\" authenticator","u":"/regulations/united-states/","k":"Regulation","d":"Guidance, Final 2025"},{"t":"Glide Identity's three-carrier beta: what the data does and doesn't show","u":"/briefings/glide-identity-three-carrier-beta/","k":"Briefing","d":"Owner-affiliated coverage. The sources establish that Glide Identity announced a beta of SIM-based cryptographic authentication across AT&T, T-Mobile and Verizo"},{"t":"The UAE’s SMS OTP phase-out is done. What US banks can take from it","u":"/briefings/uae-sms-otp-phase-out/","k":"Briefing","d":"The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved cus"},{"t":"SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks","u":"/briefings/nist-800-63-4-sms-otp/","k":"Briefing","d":"NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organizat"},{"t":"Carrier-native authentication, explained: how a SIM can sign a login","u":"/briefings/carrier-authentication-explained/","k":"Briefing","d":"Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from th"},{"t":"What the UK’s APP fraud reimbursement rules changed for fraud teams","u":"/briefings/uk-app-fraud-reimbursement/","k":"Briefing","d":"Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, wi"},{"t":"Are synced passkeys phishing-resistant?","u":"/briefings/synced-passkeys-phishing-resistant/","k":"Briefing","d":"Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. "},{"t":"Why OTP bots keep working against bank customers","u":"/briefings/otp-bots-explained/","k":"Briefing","d":"An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time pas"},{"t":"SIM swap attacks, explained","u":"/briefings/sim-swap-attacks-explained/","k":"Briefing","d":"A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, in"},{"t":"The FCC’s SIM-swap rules: what carriers now have to do","u":"/briefings/fcc-sim-swap-rules/","k":"Briefing","d":"The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify"},{"t":"Inside BSP Circular 1213, the Philippines’ OTP rule","u":"/briefings/philippines-bsp-circular-1213/","k":"Briefing","d":"Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate "},{"t":"Singapore banks to phase out OTPs for customers with digital tokens","u":"/briefings/singapore-banks-phase-out-otp/","k":"Briefing","d":"In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes "},{"t":"Glide Identity (Glide.id) company dossier","u":"/companies/glide-identity/","k":"Company","d":"Owner-affiliated coverage. Milestones, products, carrier beta, KEV check"},{"t":"Company dossiers","u":"/companies/","k":"Company","d":"Sourced fact files with KEV checks"},{"t":"Account takeover (ATO)","u":"/glossary/#account-takeover","k":"Term","d":"Criminal control of a legitimate account."},{"t":"APP fraud","u":"/glossary/#app-fraud","k":"Term","d":"Scams where victims authorize the payment themselves."},{"t":"Binding Operational Directive (BOD)","u":"/glossary/#binding-operational-directive","k":"Term","d":"A compulsory CISA order to federal agencies."},{"t":"CAMARA","u":"/glossary/#camara","k":"Term","d":"Open-source project defining telecom network APIs."},{"t":"CVE ID","u":"/glossary/#cve","k":"Term","d":"The public identifier for a disclosed vulnerability."},{"t":"CWE","u":"/glossary/#cwe","k":"Term","d":"A catalog of weakness types behind vulnerabilities."},{"t":"FIDO2","u":"/glossary/#fido2","k":"Term","d":"Open standard behind passkeys and security keys."},{"t":"KEV due date","u":"/glossary/#kev-due-date","k":"Term","d":"The remediation deadline CISA sets for each KEV entry."},{"t":"Known Exploited Vulnerabilities (KEV) catalog","u":"/glossary/#kev","k":"Term","d":"CISA's list of vulnerabilities exploited in the wild."},{"t":"Known ransomware campaign use","u":"/glossary/#known-ransomware-campaign-use","k":"Term","d":"KEV flag for vulnerabilities used by ransomware."},{"t":"National Vulnerability Database (NVD)","u":"/glossary/#nvd","k":"Term","d":"NIST's enriched database of CVE records."},{"t":"Number verification","u":"/glossary/#number-verification","k":"Term","d":"Carrier check that a device holds a given number."},{"t":"OTP bot","u":"/glossary/#otp-bot","k":"Term","d":"Automated calls that trick victims into reading out codes."},{"t":"Passkey","u":"/glossary/#passkey","k":"Term","d":"A login credential bound to one website."},{"t":"Phishing-resistant MFA","u":"/glossary/#phishing-resistant-mfa","k":"Term","d":"Authentication a fake site can't relay."},{"t":"Silent network authentication","u":"/glossary/#silent-network-authentication","k":"Term","d":"Verification through the mobile network, with no code typed."},{"t":"SIM swap","u":"/glossary/#sim-swap","k":"Term","d":"Hijacking a phone number by moving it to a new SIM."},{"t":"Strong customer authentication","u":"/glossary/#strong-customer-authentication","k":"Term","d":"The EU's two-factor rule for payments."},{"t":"Zero trust","u":"/glossary/#zero-trust","k":"Term","d":"No request trusted for where it comes from alone."},{"t":"Zero-day","u":"/glossary/#zero-day","k":"Term","d":"A flaw exploited before a fix is available."},{"t":"NIST SP 800-63-4","u":"/glossary/#body-nist-sp-800-63-4","k":"Body","d":"Standard"},{"t":"NIST","u":"/glossary/#body-nist","k":"Body","d":"Standards body"},{"t":"Federal Communications Commission","u":"/glossary/#body-fcc","k":"Body","d":"Regulator"},{"t":"FFIEC","u":"/glossary/#body-ffiec","k":"Body","d":"Regulator"},{"t":"CISA","u":"/glossary/#body-cisa","k":"Body","d":"Agency"},{"t":"Monetary Authority of Singapore","u":"/glossary/#body-mas","k":"Body","d":"Central bank"},{"t":"Bangko Sentral ng Pilipinas","u":"/glossary/#body-bsp","k":"Body","d":"Central bank"},{"t":"Central Bank of the UAE","u":"/glossary/#body-cbuae","k":"Body","d":"Central bank"},{"t":"Reserve Bank of India","u":"/glossary/#body-rbi","k":"Body","d":"Central bank"},{"t":"FIDO Alliance","u":"/glossary/#body-fido-alliance","k":"Body","d":"Industry body"},{"t":"GSMA","u":"/glossary/#body-gsma","k":"Body","d":"Industry body"},{"t":"Payment Systems Regulator","u":"/glossary/#body-psr","k":"Body","d":"Regulator"},{"t":"Methodology","u":"/trust/methodology/","k":"Trust","d":"How Telemetry computes every KEV statistic, which pages are indexed, and how the SMS OTP board is verified."},{"t":"Ownership and funding","u":"/trust/ownership-and-funding/","k":"Trust","d":"Who owns Telemetry, how it is funded, and the companies its owner has a financial interest in."},{"t":"Editorial standards","u":"/trust/editorial-standards/","k":"Trust","d":"How Telemetry sources, rates confidence in, reviews and updates its briefings."},{"t":"Corrections","u":"/trust/corrections/","k":"Trust","d":"How to report an error in Telemetry's data or briefings, and how corrections are logged."},{"t":"AI use policy","u":"/trust/ai-use/","k":"Trust","d":"How Telemetry does and does not use AI tools, and how AI crawlers may use our data."},{"t":"Commercial content policy","u":"/trust/commercial-content/","k":"Trust","d":"How Telemetry labels and separates commercial content from editorial and data."}]