Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2022-23131 | Zabbix Frontend Authentication Bypass Vulnerability Zabbix / Frontend | Feb 22, 2022 | Mar 8, 2022 | |
| CVE-2022-23134 | Zabbix Frontend Improper Access Control Vulnerability Zabbix / Frontend | Feb 22, 2022 | Mar 8, 2022 | |
| CVE-2013-3906 | Microsoft Graphics Component Memory Corruption Vulnerability Microsoft / Graphics Component | Feb 15, 2022 | Aug 15, 2022 | |
| CVE-2014-1761 | Microsoft Word Memory Corruption Vulnerability Microsoft / Word | Feb 15, 2022 | Aug 15, 2022 | |
| CVE-2017-9841 | PHPUnit Command Injection Vulnerability PHPUnit / PHPUnit | Feb 15, 2022 | Aug 15, 2022 | |
| CVE-2018-15982 | Adobe Flash Player Use-After-Free Vulnerability Adobe / Flash Player | Feb 15, 2022 | Aug 15, 2022 | Known |
| CVE-2018-20250 | WinRAR Absolute Path Traversal Vulnerability RARLAB / WinRAR | Feb 15, 2022 | Aug 15, 2022 | Known |
| CVE-2018-8174 | Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability Microsoft / Windows | Feb 15, 2022 | Aug 15, 2022 | Known |
| CVE-2019-0752 | Microsoft Internet Explorer Type Confusion Vulnerability Microsoft / Internet Explorer | Feb 15, 2022 | Aug 15, 2022 | Known |
| CVE-2022-0609 | Google Chromium Animation Use-After-Free Vulnerability Google / Chromium Animation | Feb 15, 2022 | Mar 1, 2022 | |
| CVE-2022-24086 | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability Adobe / Commerce and Magento Open Source | Feb 15, 2022 | Mar 1, 2022 | |
| CVE-2022-22620 | Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability Apple / iOS, iPadOS, and macOS | Feb 11, 2022 | Feb 25, 2022 | |
| CVE-2014-4404 | Apple OS X Heap-Based Buffer Overflow Vulnerability Apple / OS X | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2015-1130 | Apple OS X Authentication Bypass Vulnerability Apple / OS X | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2015-1635 | Microsoft HTTP.sys Remote Code Execution Vulnerability Microsoft / HTTP.sys | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2015-2051 | D-Link DIR-645 Router Remote Code Execution Vulnerability D-Link / DIR-645 Router | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2016-3088 | Apache ActiveMQ Improper Input Validation Vulnerability Apache / ActiveMQ | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2017-0144 | Microsoft SMBv1 Remote Code Execution Vulnerability Microsoft / SMBv1 | Feb 10, 2022 | Aug 10, 2022 | Known |
| CVE-2017-0145 | Microsoft SMBv1 Remote Code Execution Vulnerability Microsoft / SMBv1 | Feb 10, 2022 | Aug 10, 2022 | Known |
| CVE-2017-0262 | Microsoft Office Remote Code Execution Vulnerability Microsoft / Office | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2017-0263 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2017-10271 | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability Oracle / WebLogic Server | Feb 10, 2022 | Aug 10, 2022 | Known |
| CVE-2017-8464 | Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability Microsoft / Windows | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2017-9791 | Apache Struts 1 Improper Input Validation Vulnerability Apache / Struts 1 | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2018-1000861 | Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability Jenkins / Jenkins Stapler Web Framework | Feb 10, 2022 | Aug 10, 2022 | |
| CVE-2020-0796 | Microsoft SMBv3 Remote Code Execution Vulnerability Microsoft / SMBv3 | Feb 10, 2022 | Aug 10, 2022 | Known |
| CVE-2021-36934 | Microsoft Windows SAM Local Privilege Escalation Vulnerability Microsoft / Windows | Feb 10, 2022 | Feb 24, 2022 | |
| CVE-2022-21882 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Feb 4, 2022 | Feb 18, 2022 | Known |
| CVE-2014-1776 | Microsoft Internet Explorer Memory Corruption Vulnerability Microsoft / Internet Explorer | Jan 28, 2022 | Jul 28, 2022 | |
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability GNU / Bourne-Again Shell (Bash) | Jan 28, 2022 | Jul 28, 2022 | |
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability GNU / Bourne-Again Shell (Bash) | Jan 28, 2022 | Jul 28, 2022 | |
| CVE-2017-5689 | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability Intel / Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | Jan 28, 2022 | Jul 28, 2022 | |
| CVE-2020-0787 | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability Microsoft / Windows | Jan 28, 2022 | Jul 28, 2022 | Known |
| CVE-2020-5722 | Grandstream Networks UCM6200 Series SQL Injection Vulnerability Grandstream / UCM6200 | Jan 28, 2022 | Jul 28, 2022 | |
| CVE-2021-20038 | SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability SonicWall / SMA 100 Appliances | Jan 28, 2022 | Feb 11, 2022 | Known |
| CVE-2022-22587 | Apple Memory Corruption Vulnerability Apple / iOS and macOS | Jan 28, 2022 | Feb 11, 2022 | |
| CVE-2006-1547 | Apache Struts 1 ActionForm Denial-of-Service Vulnerability Apache / Struts 1 | Jan 21, 2022 | Jul 21, 2022 | |
| CVE-2012-0391 | Apache Struts 2 Improper Input Validation Vulnerability Apache / Struts 2 | Jan 21, 2022 | Jul 21, 2022 | |
| CVE-2018-8453 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Jan 21, 2022 | Jul 21, 2022 | Known |
| CVE-2021-35247 | SolarWinds Serv-U Improper Input Validation Vulnerability SolarWinds / Serv-U | Jan 21, 2022 | Feb 4, 2022 | |
| CVE-2020-11978 | Apache Airflow Command Injection Apache / Airflow | Jan 18, 2022 | Jul 18, 2022 | |
| CVE-2020-13671 | Drupal core Un-restricted Upload of File Drupal / Drupal core | Jan 18, 2022 | Jul 18, 2022 | |
| CVE-2020-13927 | Apache Airflow's Experimental API Authentication Bypass Apache / Airflow's Experimental API | Jan 18, 2022 | Jul 18, 2022 | |
| CVE-2020-14864 | Oracle Business Intelligence Enterprise Edition Path Transversal Oracle / Intelligence Enterprise Edition | Jan 18, 2022 | Jul 18, 2022 | |
| CVE-2021-21315 | System Information Library for Node.JS Command Injection Npm package / System Information Library for Node.JS | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-21975 | VMware Server Side Request Forgery in vRealize Operations Manager API VMware / vRealize Operations Manager API | Jan 18, 2022 | Feb 1, 2022 | Known |
| CVE-2021-22991 | F5 BIG-IP Traffic Management Microkernel Buffer Overflow F5 / BIG-IP Traffic Management Microkernel | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-25296 | Nagios XI OS Command Injection Nagios / Nagios XI | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-25297 | Nagios XI OS Command Injection Nagios / Nagios XI | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-25298 | Nagios XI OS Command Injection Nagios / Nagios XI | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-32648 | October CMS Improper Authentication October CMS / October CMS | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-33766 | Microsoft Exchange Server Information Disclosure Microsoft / Exchange Server | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2021-40870 | Aviatrix Controller Unrestricted Upload of File Aviatrix / Aviatrix Controller | Jan 18, 2022 | Feb 1, 2022 | |
| CVE-2013-3900 | Microsoft WinVerifyTrust function Remote Code Execution Microsoft / WinVerifyTrust function | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2015-7450 | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. IBM / WebSphere Application Server and Server Hypervisor Edition | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2017-1000486 | Primetek Primefaces Remote Code Execution Vulnerability Primetek / Primefaces Application | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2018-13382 | Fortinet FortiOS and FortiProxy Improper Authorization Fortinet / FortiOS and FortiProxy | Jan 10, 2022 | Jul 10, 2022 | Known |
| CVE-2018-13383 | Fortinet FortiOS and FortiProxy Out-of-bounds Write Fortinet / FortiOS and FortiProxy | Jan 10, 2022 | Jul 10, 2022 | Known |
| CVE-2019-10149 | Exim Mail Transfer Agent (MTA) Improper Input Validation Exim / Mail Transfer Agent (MTA) | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2019-1458 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Jan 10, 2022 | Jul 10, 2022 | Known |
| CVE-2019-1579 | Palo Alto Networks PAN-OS Remote Code Execution Vulnerability Palo Alto Networks / PAN-OS | Jan 10, 2022 | Jul 10, 2022 | Known |
| CVE-2019-2725 | Oracle WebLogic Server, Injection Oracle / WebLogic Server | Jan 10, 2022 | Jul 10, 2022 | Known |
| CVE-2019-7609 | Kibana Arbitrary Code Execution Elastic / Kibana | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2019-9670 | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference Synacor / Zimbra Collaboration Suite (ZCS) | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2020-6572 | Google Chrome Media Use-After-Free Vulnerability Google / Chrome Media | Jan 10, 2022 | Jul 10, 2022 | |
| CVE-2021-22017 | VMware vCenter Server Improper Access Control VMware / vCenter Server | Jan 10, 2022 | Jan 24, 2022 | |
| CVE-2021-27860 | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit FatPipe / WARP, IPVPN, and MPVPN software | Jan 10, 2022 | Jan 24, 2022 | |
| CVE-2021-36260 | Hikvision Improper Input Validation Hikvision / Security cameras web server | Jan 10, 2022 | Jan 24, 2022 | |
| CVE-2021-4102 | Google Chromium V8 Use-After-Free Vulnerability Google / Chromium V8 | Dec 15, 2021 | Dec 29, 2021 | |
| CVE-2021-43890 | Microsoft Windows AppX Installer Spoofing Vulnerability Microsoft / Windows | Dec 15, 2021 | Dec 29, 2021 | Known |
| CVE-2010-1871 | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability Red Hat / JBoss Seam 2 | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2017-12149 | Red Hat JBoss Application Server Remote Code Execution Vulnerability Red Hat / JBoss Application Server | Dec 10, 2021 | Jun 10, 2022 | Known |
| CVE-2017-17562 | Embedthis GoAhead Remote Code Execution Vulnerability Embedthis / GoAhead | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2019-0193 | Apache Solr DataImportHandler Code Injection Vulnerability Apache / Solr | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2019-10758 | MongoDB mongo-express Remote Code Execution Vulnerability MongoDB / mongo-express | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2019-13272 | Linux Kernel Improper Privilege Management Vulnerability Linux / Kernel | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2019-7238 | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability Sonatype / Nexus Repository Manager | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2020-17463 | Fuel CMS SQL Injection Vulnerability Fuel CMS / Fuel CMS | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2020-8816 | Pi-Hole AdminLTE Remote Code Execution Vulnerability Pi-hole / AdminLTE | Dec 10, 2021 | Jun 10, 2022 | |
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability Realtek / Jungle Software Development Kit (SDK) | Dec 10, 2021 | Dec 24, 2021 | |
| CVE-2021-44168 | Fortinet FortiOS Arbitrary File Download Fortinet / FortiOS | Dec 10, 2021 | Dec 24, 2021 | |
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability Apache / Log4j2 | Dec 10, 2021 | Dec 24, 2021 | Known |
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability Zoho / Desktop Central | Dec 10, 2021 | Dec 24, 2021 | |
| CVE-2018-14847 | MikroTik Router OS Directory Traversal Vulnerability MikroTik / RouterOS | Dec 1, 2021 | Jun 1, 2022 | |
| CVE-2020-11261 | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability Qualcomm / Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Dec 1, 2021 | Jun 1, 2022 | |
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability Zoho / ManageEngine ServiceDesk Plus (SDP) | Dec 1, 2021 | Dec 15, 2021 | |
| CVE-2021-40438 | Apache HTTP Server-Side Request Forgery (SSRF) Apache / Apache | Dec 1, 2021 | Dec 15, 2021 | Known |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability Zoho / ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Dec 1, 2021 | Dec 15, 2021 | |
| CVE-2021-22204 | ExifTool Remote Code Execution Vulnerability Perl / Exiftool | Nov 17, 2021 | Dec 1, 2021 | |
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability Microsoft / Windows | Nov 17, 2021 | Dec 1, 2021 | Known |
| CVE-2021-42292 | Microsoft Excel Security Feature Bypass Microsoft / Office | Nov 17, 2021 | Dec 1, 2021 | |
| CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange | Nov 17, 2021 | Dec 1, 2021 | Known |
| CVE-2010-5326 | SAP NetWeaver Remote Code Execution Vulnerability SAP / NetWeaver | Nov 3, 2021 | May 3, 2022 | |
| CVE-2012-0158 | Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability Microsoft / MSCOMCTL.OCX | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2012-3152 | Oracle Fusion Middleware Unspecified Vulnerability Oracle / Fusion Middleware | Nov 3, 2021 | May 3, 2022 | |
| CVE-2014-1812 | Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2015-1641 | Microsoft Office Memory Corruption Vulnerability Microsoft / Office | Nov 3, 2021 | May 3, 2022 | |
| CVE-2015-4852 | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability Oracle / WebLogic Server | Nov 3, 2021 | May 3, 2022 | |
| CVE-2016-0167 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2016-0185 | Microsoft Windows Media Center Remote Code Execution Vulnerability Microsoft / Windows | Nov 3, 2021 | May 3, 2022 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses