Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2018-8406 | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability Microsoft / DirectX Graphics Kernel (DXGKRNL) | Mar 28, 2022 | Apr 18, 2022 | Known |
| CVE-2018-8440 | Microsoft Windows Privilege Escalation Vulnerability Microsoft / Windows | Mar 28, 2022 | Apr 18, 2022 | Known |
| CVE-2019-7483 | SonicWall SMA100 Directory Traversal Vulnerability SonicWall / SMA100 | Mar 28, 2022 | Apr 18, 2022 | |
| CVE-2021-20028 | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability SonicWall / Secure Remote Access (SRA) | Mar 28, 2022 | Apr 18, 2022 | Known |
| CVE-2021-26085 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability Atlassian / Confluence Server | Mar 28, 2022 | Apr 18, 2022 | Known |
| CVE-2021-34486 | Microsoft Windows Event Tracing Privilege Escalation Vulnerability Microsoft / Windows | Mar 28, 2022 | Apr 18, 2022 | |
| CVE-2021-38646 | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability Microsoft / Office | Mar 28, 2022 | Apr 18, 2022 | Known |
| CVE-2022-0543 | Debian-specific Redis Server Lua Sandbox Escape Vulnerability Redis / Debian-specific Redis Servers | Mar 28, 2022 | Apr 18, 2022 | |
| CVE-2022-1096 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Mar 28, 2022 | Apr 18, 2022 | |
| CVE-2005-2773 | HP OpenView Network Node Manager Remote Code Execution Vulnerability Hewlett Packard (HP) / OpenView Network Node Manager | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2009-0927 | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability Adobe / Reader and Acrobat | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2009-1151 | phpMyAdmin Remote Code Execution Vulnerability phpMyAdmin / phpMyAdmin | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2009-2055 | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability Cisco / IOS XR | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2010-2861 | Adobe ColdFusion Directory Traversal Vulnerability Adobe / ColdFusion | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2010-3035 | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability Cisco / IOS XR | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2010-4344 | Exim Heap-Based Buffer Overflow Vulnerability Exim / Exim | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2010-4345 | Exim Privilege Escalation Vulnerability Exim / Exim | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2012-1823 | PHP-CGI Query String Parameter Vulnerability PHP / PHP | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2013-2251 | Apache Struts Improper Input Validation Vulnerability Apache / Struts | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2013-4810 | HP Multiple Products Remote Code Execution Vulnerability Hewlett Packard (HP) / ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2013-5223 | D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability D-Link / DSL-2760U | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2014-0130 | Ruby on Rails Directory Traversal Vulnerability Rails / Ruby on Rails | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2014-3120 | Elasticsearch Remote Code Execution Vulnerability Elastic / Elasticsearch | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2014-6287 | Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability Rejetto / HTTP File Server (HFS) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2014-6324 | Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability Microsoft / Kerberos Key Distribution Center (KDC) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2014-6332 | Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability Microsoft / Windows | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2015-0666 | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability Cisco / Prime Data Center Network Manager (DCNM) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2015-1187 | D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability D-Link and TRENDnet / Multiple Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2015-1427 | Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability Elastic / Elasticsearch | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2015-3035 | TP-Link Multiple Archer Devices Directory Traversal Vulnerability TP-Link / Multiple Archer Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2015-4068 | Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability Arcserve / Unified Data Protection (UDP) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2016-0752 | Ruby on Rails Directory Traversal Vulnerability Rails / Ruby on Rails | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2016-10174 | NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability NETGEAR / WNR2000v5 Router | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2016-11021 | D-Link DCS-930L Devices OS Command Injection Vulnerability D-Link / DCS-930L Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2016-1555 | NETGEAR Multiple WAP Devices Command Injection Vulnerability NETGEAR / Wireless Access Point (WAP) Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2016-4171 | Adobe Flash Player Remote Code Execution Vulnerability Adobe / Flash Player | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2016-7892 | Adobe Flash Player Use-After-Free Vulnerability Adobe / Flash Player | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2017-0146 | Microsoft Windows SMB Remote Code Execution Vulnerability Microsoft / Windows | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2017-12615 | Apache Tomcat on Windows Remote Code Execution Vulnerability Apache / Tomcat | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2017-12617 | Apache Tomcat Remote Code Execution Vulnerability Apache / Tomcat | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2017-3881 | Cisco IOS and IOS XE Remote Code Execution Vulnerability Cisco / IOS and IOS XE | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2017-6316 | Citrix Multiple Products Remote Code Execution Vulnerability Citrix / NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2017-6334 | NETGEAR DGN2200 Devices OS Command Injection Vulnerability NETGEAR / DGN2200 Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2018-0125 | Cisco VPN Routers Remote Code Execution Vulnerability Cisco / VPN Routers | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2018-0147 | Cisco Secure Access Control System Java Deserialization Vulnerability Cisco / Secure Access Control System (ACS) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2018-11138 | Quest KACE System Management Appliance Remote Command Execution Vulnerability Quest / KACE System Management Appliance | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2018-1273 | VMware Tanzu Spring Data Commons Property Binder Vulnerability VMware Tanzu / Spring Data Commons | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2018-14839 | LG N1A1 NAS Remote Command Execution Vulnerability LG / N1A1 NAS | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2018-6961 | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability VMware / SD-WAN Edge | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2018-8373 | Microsoft Scripting Engine Memory Corruption Vulnerability Microsoft / Internet Explorer Scripting Engine | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2018-8414 | Microsoft Windows Shell Remote Code Execution Vulnerability Microsoft / Windows | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-0903 | Microsoft GDI Remote Code Execution Vulnerability Microsoft / Graphics Device Interface (GDI) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-1003030 | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Jenkins / Matrix Project Plugin | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-10068 | Kentico Xperience Deserialization of Untrusted Data Vulnerability Kentico / Xperience | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-11043 | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability PHP / FastCGI Process Manager (FPM) | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2019-12989 | Citrix SD-WAN and NetScaler SQL Injection Vulnerability Citrix / SD-WAN and NetScaler | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-12991 | Citrix SD-WAN and NetScaler Command Injection Vulnerability Citrix / SD-WAN and NetScaler | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-15107 | Webmin Command Injection Vulnerability Webmin / Webmin | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2019-16920 | D-Link Multiple Routers Command Injection Vulnerability D-Link / Multiple Routers | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-2616 | Oracle BI Publisher Unauthorized Access Vulnerability Oracle / BI Publisher (Formerly XML Publisher) | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2019-6340 | Drupal Core Remote Code Execution Vulnerability Drupal / Core | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-1631 | Juniper Junos OS Path Traversal Vulnerability Juniper / Junos OS | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-1956 | Apache Kylin OS Command Injection Vulnerability Apache / Kylin | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-2021 | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Palo Alto Networks / PAN-OS | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2020-2506 | QNAP Helpdesk Improper Access Control Vulnerability QNAP Systems / Helpdesk | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-25223 | Sophos SG UTM Remote Code Execution Vulnerability Sophos / SG UTM | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-5410 | VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability VMware Tanzu / Spring Cloud Configuration (Config) Server | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-7247 | OpenSMTPD Remote Code Execution Vulnerability OpenBSD / OpenSMTPD | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-9054 | Zyxel Multiple NAS Devices OS Command Injection Vulnerability Zyxel / Multiple Network-Attached Storage (NAS) Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2020-9377 | D-Link DIR-610 Devices Remote Command Execution D-Link / DIR-610 Devices | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2021-22941 | Citrix ShareFile Improper Access Control Vulnerability Citrix / ShareFile | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2021-42237 | Sitecore XP Remote Command Execution Vulnerability Sitecore / XP | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability Microsoft / Windows | Mar 25, 2022 | Apr 15, 2022 | Known |
| CVE-2022-26143 | MiCollab, MiVoice Business Express Access Control Vulnerability Mitel / MiCollab, MiVoice Business Express | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2022-26318 | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution WatchGuard / Firebox and XTM Appliances | Mar 25, 2022 | Apr 15, 2022 | |
| CVE-2015-2546 | Microsoft Win32k Memory Corruption Vulnerability Microsoft / Win32k | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2016-3309 | Microsoft Windows Kernel Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2017-0101 | Microsoft Windows Transaction Manager Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2018-8120 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-0543 | Microsoft Windows Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-0841 | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1064 | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1069 | Microsoft Task Scheduler Privilege Escalation Vulnerability Microsoft / Task Scheduler | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1129 | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1132 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Mar 15, 2022 | Apr 5, 2022 | |
| CVE-2019-1253 | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1315 | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1322 | Microsoft Windows Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2019-1405 | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability Microsoft / Windows | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2020-5135 | SonicWall SonicOS Buffer Overflow Vulnerability SonicWall / SonicOS | Mar 15, 2022 | Apr 5, 2022 | Known |
| CVE-2009-3960 | Adobe BlazeDS Information Disclosure Vulnerability Adobe / BlazeDS | Mar 7, 2022 | Sep 7, 2022 | Known |
| CVE-2013-0625 | Adobe ColdFusion Authentication Bypass Vulnerability Adobe / ColdFusion | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2013-0629 | Adobe ColdFusion Directory Traversal Vulnerability Adobe / ColdFusion | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2013-0631 | Adobe ColdFusion Information Disclosure Vulnerability Adobe / ColdFusion | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2016-6277 | NETGEAR Multiple Routers Remote Code Execution Vulnerability NETGEAR / Multiple Routers | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2017-6077 | NETGEAR DGN2200 Remote Code Execution Vulnerability NETGEAR / Wireless Router DGN2200 | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2019-11581 | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability Atlassian / Jira Server and Data Center | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2020-8218 | Pulse Connect Secure Code Injection Vulnerability Pulse Secure / Pulse Connect Secure | Mar 7, 2022 | Sep 7, 2022 | |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability VMware / vCenter Server and Cloud Foundation | Mar 7, 2022 | Mar 21, 2022 | |
| CVE-2022-26485 | Mozilla Firefox Use-After-Free Vulnerability Mozilla / Firefox | Mar 7, 2022 | Mar 21, 2022 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses