Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2021-22506 | Micro Focus Access Manager Information Leakage Vulnerability Micro Focus / Micro Focus Access Manager | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability Ivanti / Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2021-22894 | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability Ivanti / Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | |
| CVE-2021-22899 | Ivanti Pulse Connect Secure Command Injection Vulnerability Ivanti / Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | |
| CVE-2021-22900 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability Ivanti / Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | |
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability F5 / BIG-IP and BIG-IQ Centralized Management | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-23874 | McAfee Total Protection (MTP) Improper Privilege Management Vulnerability McAfee / McAfee Total Protection (MTP) | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability Atlassian / Confluence Server and Data Center | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-26411 | Microsoft Internet Explorer Memory Corruption Vulnerability Microsoft / Internet Explorer | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-26855 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2021-26857 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2021-26858 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2021-27059 | Microsoft Office Remote Code Execution Vulnerability Microsoft / Office | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-27065 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2021-27085 | Microsoft Internet Explorer Remote Code Execution Vulnerability Microsoft / Internet Explorer | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-27101 | Accellion FTA SQL Injection Vulnerability Accellion / FTA | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-27102 | Accellion FTA OS Command Injection Vulnerability Accellion / FTA | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-27103 | Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability Accellion / FTA | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-27104 | Accellion FTA OS Command Injection Vulnerability Accellion / FTA | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-27561 | Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability Yealink / Device Management | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-27562 | Arm Trusted Firmware Out-of-Bounds Write Vulnerability Arm / Trusted Firmware | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-28310 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-28550 | Adobe Acrobat and Reader Use-After-Free Vulnerability Adobe / Acrobat and Reader | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-28663 | Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability Arm / Mali Graphics Processing Unit (GPU) | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-28664 | Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability Arm / Mali Graphics Processing Unit (GPU) | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30116 | Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability Kaseya / Virtual System/Server Administrator (VSA) | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-30551 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30554 | Google Chromium WebGL Use-After-Free Vulnerability Google / Chromium WebGL | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30563 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30632 | Google Chromium V8 Out-of-Bounds Write Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30633 | Google Chromium Indexed DB API Use-After-Free Vulnerability Google / Chromium Indexed DB API | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30657 | Apple macOS Unspecified Vulnerability Apple / macOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30661 | Apple Multiple Products WebKit Storage Use-After-Free Vulnerability Apple / Multiple Products | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30663 | Apple Multiple Products WebKit Integer Overflow Vulnerability Apple / Multiple Products | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30665 | Apple Multiple Products WebKit Memory Corruption Vulnerability Apple / Multiple Products | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30666 | Apple iOS WebKit Buffer Overflow Vulnerability Apple / iOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30713 | Apple macOS Unspecified Vulnerability Apple / macOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30761 | Apple iOS WebKit Memory Corruption Vulnerability Apple / iOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30762 | Apple iOS WebKit Use-After-Free Vulnerability Apple / iOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30807 | Apple Multiple Products Memory Corruption Vulnerability Apple / Multiple Products | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30858 | Apple iOS, iPadOS, macOS Use-After-Free Vulnerability Apple / iOS, iPadOS, and macOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30860 | Apple Multiple Products Integer Overflow Vulnerability Apple / Multiple Products | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-30869 | Apple iOS, iPadOS, and macOS Type Confusion Vulnerability Apple / iOS, iPadOS, and macOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-31199 | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability Microsoft / Enhanced Cryptographic Provider | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-31201 | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability Microsoft / Enhanced Cryptographic Provider | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-31207 | Microsoft Exchange Server Security Feature Bypass Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-31755 | Tenda AC11 Router Stack Buffer Overflow Vulnerability Tenda / AC11 Router | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-31955 | Microsoft Windows Kernel Information Disclosure Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-31956 | Microsoft Windows NTFS Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-31979 | Microsoft Windows Kernel Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-33739 | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-33742 | Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-33771 | Microsoft Windows Kernel Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-34448 | Microsoft Windows Scripting Engine Memory Corruption Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-34523 | Microsoft Exchange Server Privilege Escalation Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-34527 | Microsoft Windows Print Spooler Remote Code Execution Vulnerability Microsoft / Windows | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2021-35211 | SolarWinds Serv-U Remote Code Execution Vulnerability SolarWinds / Serv-U | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-35395 | Realtek AP-Router SDK Buffer Overflow Vulnerability Realtek / AP-Router SDK | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-35464 | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability ForgeRock / Access Management (AM) | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-36741 | Trend Micro Multiple Products Improper Input Validation Vulnerability Trend Micro / Apex One, Apex One as a Service, and Worry-Free Business Security | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-36742 | Trend Micro Multiple Products Improper Input Validation Vulnerability Trend Micro / Apex One, Apex One as a Service, and Worry-Free Business Security | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-36942 | Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-36948 | Microsoft Windows Update Medic Service Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-36955 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-37973 | Google Chromium Portals Use-After-Free Vulnerability Google / Chromium Portals | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-37975 | Google Chromium V8 Use-After-Free Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-37976 | Google Chromium Information Disclosure Vulnerability Google / Chromium | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-38000 | Google Chromium Intents Improper Input Validation Vulnerability Google / Chromium Intents | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-38003 | Google Chromium V8 Memory Corruption Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-38645 | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability Microsoft / Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-38647 | Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability Microsoft / Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-38648 | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability Microsoft / Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-38649 | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability Microsoft / Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-40444 | Microsoft MSHTML Remote Code Execution Vulnerability Microsoft / MSHTML | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability Zoho / ManageEngine | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-41773 | Apache HTTP Server Path Traversal Vulnerability Apache / HTTP Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability Apache / HTTP Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-42258 | BQE BillQuick Web Suite SQL Injection Vulnerability BQE / BillQuick Web Suite | Nov 3, 2021 | Nov 17, 2021 | Known |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses