Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2023-21823 | Microsoft Windows Graphic Component Privilege Escalation Vulnerability Microsoft / Windows | Feb 14, 2023 | Mar 7, 2023 | |
| CVE-2023-23376 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability Microsoft / Windows | Feb 14, 2023 | Mar 7, 2023 | Known |
| CVE-2023-23529 | Apple Multiple Products WebKit Type Confusion Vulnerability Apple / Multiple Products | Feb 14, 2023 | Mar 7, 2023 | |
| CVE-2015-2291 | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability Intel / Ethernet Diagnostics Driver for Windows | Feb 10, 2023 | Mar 3, 2023 | Known |
| CVE-2022-24990 | TerraMaster OS Remote Command Execution Vulnerability TerraMaster / TerraMaster OS | Feb 10, 2023 | Mar 3, 2023 | Known |
| CVE-2023-0669 | Fortra GoAnywhere MFT Remote Code Execution Vulnerability Fortra / GoAnywhere MFT | Feb 10, 2023 | Mar 3, 2023 | Known |
| CVE-2022-21587 | Oracle E-Business Suite Unspecified Vulnerability Oracle / E-Business Suite | Feb 2, 2023 | Feb 23, 2023 | Known |
| CVE-2023-22952 | Multiple SugarCRM Products Remote Code Execution Vulnerability SugarCRM / Multiple Products | Feb 2, 2023 | Feb 23, 2023 | |
| CVE-2017-11357 | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability Telerik / User Interface (UI) for ASP.NET AJAX | Jan 26, 2023 | Feb 16, 2023 | Known |
| CVE-2022-47966 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Zoho / ManageEngine | Jan 23, 2023 | Feb 13, 2023 | Known |
| CVE-2022-44877 | CWP Control Web Panel OS Command Injection Vulnerability CWP / Control Web Panel | Jan 17, 2023 | Feb 7, 2023 | |
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Vulnerability Microsoft / Exchange Server | Jan 10, 2023 | Jan 31, 2023 | Known |
| CVE-2023-21674 | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability Microsoft / Windows | Jan 10, 2023 | Jan 31, 2023 | |
| CVE-2018-18809 | TIBCO JasperReports Library Directory Traversal Vulnerability TIBCO / JasperReports | Dec 29, 2022 | Jan 19, 2023 | |
| CVE-2018-5430 | TIBCO JasperReports Server Information Disclosure Vulnerability TIBCO / JasperReports | Dec 29, 2022 | Jan 19, 2023 | |
| CVE-2022-42856 | Apple iOS Type Confusion Vulnerability Apple / iOS | Dec 14, 2022 | Jan 4, 2023 | |
| CVE-2022-26500 | Veeam Backup & Replication Remote Code Execution Vulnerability Veeam / Backup & Replication | Dec 13, 2022 | Jan 3, 2023 | Known |
| CVE-2022-26501 | Veeam Backup & Replication Remote Code Execution Vulnerability Veeam / Backup & Replication | Dec 13, 2022 | Jan 3, 2023 | Known |
| CVE-2022-27518 | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability Citrix / Application Delivery Controller (ADC) and Gateway | Dec 13, 2022 | Jan 3, 2023 | |
| CVE-2022-42475 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability Fortinet / FortiOS | Dec 13, 2022 | Jan 3, 2023 | Known |
| CVE-2022-44698 | Microsoft Defender SmartScreen Security Feature Bypass Vulnerability Microsoft / Defender | Dec 13, 2022 | Jan 3, 2023 | Known |
| CVE-2022-4262 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Dec 5, 2022 | Dec 26, 2022 | |
| CVE-2021-35587 | Oracle Fusion Middleware Unspecified Vulnerability Oracle / Fusion Middleware | Nov 28, 2022 | Dec 19, 2022 | |
| CVE-2022-4135 | Google Chromium GPU Heap Buffer Overflow Vulnerability Google / Chromium GPU | Nov 28, 2022 | Dec 19, 2022 | |
| CVE-2022-41049 | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability Microsoft / Windows | Nov 14, 2022 | Dec 9, 2022 | |
| CVE-2021-25337 | Samsung Mobile Devices Improper Access Control Vulnerability Samsung / Mobile Devices | Nov 8, 2022 | Nov 29, 2022 | |
| CVE-2021-25369 | Samsung Mobile Devices Improper Access Control Vulnerability Samsung / Mobile Devices | Nov 8, 2022 | Nov 29, 2022 | |
| CVE-2021-25370 | Samsung Mobile Devices Memory Corruption Vulnerability Samsung / Mobile Devices | Nov 8, 2022 | Nov 29, 2022 | |
| CVE-2022-41073 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability Microsoft / Windows | Nov 8, 2022 | Dec 9, 2022 | Known |
| CVE-2022-41091 | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability Microsoft / Windows | Nov 8, 2022 | Dec 9, 2022 | Known |
| CVE-2022-41125 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability Microsoft / Windows | Nov 8, 2022 | Dec 9, 2022 | |
| CVE-2022-41128 | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability Microsoft / Windows | Nov 8, 2022 | Dec 9, 2022 | |
| CVE-2022-3723 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Oct 28, 2022 | Nov 18, 2022 | |
| CVE-2022-42827 | Apple iOS and iPadOS Out-of-Bounds Write Vulnerability Apple / iOS and iPadOS | Oct 25, 2022 | Nov 15, 2022 | |
| CVE-2018-19320 | GIGABYTE Multiple Products Unspecified Vulnerability GIGABYTE / Multiple Products | Oct 24, 2022 | Nov 14, 2022 | Known |
| CVE-2018-19321 | GIGABYTE Multiple Products Privilege Escalation Vulnerability GIGABYTE / Multiple Products | Oct 24, 2022 | Nov 14, 2022 | Known |
| CVE-2018-19322 | GIGABYTE Multiple Products Code Execution Vulnerability GIGABYTE / Multiple Products | Oct 24, 2022 | Nov 14, 2022 | Known |
| CVE-2018-19323 | GIGABYTE Multiple Products Privilege Escalation Vulnerability GIGABYTE / Multiple Products | Oct 24, 2022 | Nov 14, 2022 | Known |
| CVE-2020-3153 | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability Cisco / AnyConnect Secure | Oct 24, 2022 | Nov 14, 2022 | Known |
| CVE-2020-3433 | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability Cisco / AnyConnect Secure | Oct 24, 2022 | Nov 14, 2022 | Known |
| CVE-2021-3493 | Linux Kernel Privilege Escalation Vulnerability Linux / Kernel | Oct 20, 2022 | Nov 10, 2022 | |
| CVE-2022-41352 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Oct 20, 2022 | Nov 10, 2022 | Known |
| CVE-2022-40684 | Fortinet Multiple Products Authentication Bypass Vulnerability Fortinet / Multiple Products | Oct 11, 2022 | Nov 1, 2022 | Known |
| CVE-2022-41033 | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability Microsoft / Windows COM+ Event System Service | Oct 11, 2022 | Nov 1, 2022 | |
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability Atlassian / Bitbucket Server and Data Center | Sep 30, 2022 | Oct 21, 2022 | |
| CVE-2022-41040 | Microsoft Exchange Server Server-Side Request Forgery Vulnerability Microsoft / Exchange Server | Sep 30, 2022 | Oct 21, 2022 | Known |
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Sep 30, 2022 | Oct 21, 2022 | Known |
| CVE-2022-3236 | Sophos Firewall Code Injection Vulnerability Sophos / Firewall | Sep 23, 2022 | Oct 14, 2022 | |
| CVE-2022-35405 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Zoho / ManageEngine | Sep 22, 2022 | Oct 13, 2022 | |
| CVE-2010-2568 | Microsoft Windows Remote Code Execution Vulnerability Microsoft / Windows | Sep 15, 2022 | Oct 6, 2022 | |
| CVE-2013-2094 | Linux Kernel Privilege Escalation Vulnerability Linux / Kernel | Sep 15, 2022 | Oct 6, 2022 | |
| CVE-2013-2596 | Linux Kernel Integer Overflow Vulnerability Linux / Kernel | Sep 15, 2022 | Oct 6, 2022 | |
| CVE-2013-2597 | Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability Code Aurora / ACDB Audio Driver | Sep 15, 2022 | Oct 6, 2022 | |
| CVE-2013-6282 | Linux Kernel Improper Input Validation Vulnerability Linux / Kernel | Sep 15, 2022 | Oct 6, 2022 | |
| CVE-2022-40139 | Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability Trend Micro / Apex One and Apex One as a Service | Sep 15, 2022 | Oct 6, 2022 | |
| CVE-2022-32917 | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability Apple / iOS, iPadOS, and macOS | Sep 14, 2022 | Oct 5, 2022 | |
| CVE-2022-37969 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability Microsoft / Windows | Sep 14, 2022 | Oct 5, 2022 | Known |
| CVE-2011-1823 | Android OS Privilege Escalation Vulnerability Android / Android OS | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2011-4723 | D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability D-Link / DIR-300 Router | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2017-5521 | NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability NETGEAR / Multiple Devices | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2018-13374 | Fortinet FortiOS and FortiADC Improper Access Control Vulnerability Fortinet / FortiOS and FortiADC | Sep 8, 2022 | Sep 29, 2022 | Known |
| CVE-2018-2628 | Oracle WebLogic Server Unspecified Vulnerability Oracle / WebLogic Server | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2018-6530 | D-Link Multiple Routers OS Command Injection Vulnerability D-Link / Multiple Routers | Sep 8, 2022 | Sep 29, 2022 | Known |
| CVE-2018-7445 | MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability MikroTik / RouterOS | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2020-9934 | Apple iOS, iPadOS, and macOS Input Validation Vulnerability Apple / iOS, iPadOS, and macOS | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2022-26258 | D-Link DIR-820L Remote Code Execution Vulnerability D-Link / DIR-820L | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2022-27593 | QNAP Photo Station Externally Controlled Reference Vulnerability QNAP / Photo Station | Sep 8, 2022 | Sep 29, 2022 | Known |
| CVE-2022-3075 | Google Chromium Mojo Insufficient Data Validation Vulnerability Google / Chromium Mojo | Sep 8, 2022 | Sep 29, 2022 | |
| CVE-2020-28949 | PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability PEAR / Archive_Tar | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2020-36193 | PEAR Archive_Tar Improper Link Resolution Vulnerability PEAR / Archive_Tar | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2021-31010 | Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability Apple / iOS, macOS, watchOS | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2021-38406 | Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability Delta Electronics / DOPSoft 2 | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2021-39226 | Grafana Authentication Bypass Vulnerability Grafana Labs / Grafana | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2022-2294 | WebRTC Heap Buffer Overflow Vulnerability WebRTC / WebRTC | Aug 25, 2022 | Sep 15, 2022 | Known |
| CVE-2022-22963 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability VMware Tanzu / Spring Cloud | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2022-24112 | Apache APISIX Authentication Bypass Vulnerability Apache / APISIX | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2022-24706 | Apache CouchDB Insecure Default Initialization of Resource Vulnerability Apache / CouchDB | Aug 25, 2022 | Sep 15, 2022 | |
| CVE-2022-26352 | dotCMS Unrestricted Upload of File Vulnerability dotCMS / dotCMS | Aug 25, 2022 | Sep 15, 2022 | Known |
| CVE-2022-0028 | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability Palo Alto Networks / PAN-OS | Aug 22, 2022 | Sep 12, 2022 | |
| CVE-2017-15944 | Palo Alto Networks PAN-OS Remote Code Execution Vulnerability Palo Alto Networks / PAN-OS | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-21971 | Microsoft Windows Runtime Remote Code Execution Vulnerability Microsoft / Windows | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability SAP / Multiple Products | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-26923 | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability Microsoft / Active Directory | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-2856 | Google Chromium Intents Insufficient Input Validation Vulnerability Google / Chromium Intents | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-32893 | Apple iOS and macOS Out-of-Bounds Write Vulnerability Apple / iOS and macOS | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-32894 | Apple iOS and macOS Out-of-Bounds Write Vulnerability Apple / iOS and macOS | Aug 18, 2022 | Sep 8, 2022 | |
| CVE-2022-27925 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Aug 11, 2022 | Sep 1, 2022 | Known |
| CVE-2022-37042 | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Aug 11, 2022 | Sep 1, 2022 | Known |
| CVE-2022-30333 | RARLAB UnRAR Directory Traversal Vulnerability RARLAB / UnRAR | Aug 9, 2022 | Aug 30, 2022 | Known |
| CVE-2022-34713 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Microsoft / Windows | Aug 9, 2022 | Aug 30, 2022 | |
| CVE-2022-27924 | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Aug 4, 2022 | Aug 25, 2022 | Known |
| CVE-2022-26138 | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability Atlassian / Confluence | Jul 29, 2022 | Aug 19, 2022 | |
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability Microsoft / Windows | Jul 12, 2022 | Aug 2, 2022 | |
| CVE-2022-26925 | Microsoft Windows LSA Spoofing Vulnerability Microsoft / Windows | Jul 1, 2022 | Jul 22, 2022 | |
| CVE-2018-4344 | Apple Multiple Products Memory Corruption Vulnerability Apple / Multiple Products | Jun 27, 2022 | Jul 18, 2022 | |
| CVE-2019-8605 | Apple Multiple Products Use-After-Free Vulnerability Apple / Multiple Products | Jun 27, 2022 | Jul 18, 2022 | |
| CVE-2020-3837 | Apple Multiple Products Memory Corruption Vulnerability Apple / Multiple Products | Jun 27, 2022 | Jul 18, 2022 | |
| CVE-2020-9907 | Apple Multiple Products Memory Corruption Vulnerability Apple / Multiple Products | Jun 27, 2022 | Jul 18, 2022 | |
| CVE-2021-30533 | Google Chromium PopupBlocker Security Bypass Vulnerability Google / Chromium PopupBlocker | Jun 27, 2022 | Jul 18, 2022 | |
| CVE-2021-30983 | Apple iOS and iPadOS Buffer Overflow Vulnerability Apple / iOS and iPadOS | Jun 27, 2022 | Jul 18, 2022 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses