Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability Ivanti / Endpoint Manager Mobile (EPMM) | Jul 31, 2023 | Aug 21, 2023 | |
| CVE-2023-37580 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Jul 27, 2023 | Aug 17, 2023 | |
| CVE-2023-38606 | Apple Multiple Products Kernel Unspecified Vulnerability Apple / Multiple Products | Jul 26, 2023 | Aug 16, 2023 | |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability Ivanti / Endpoint Manager Mobile (EPMM) | Jul 25, 2023 | Aug 15, 2023 | Known |
| CVE-2023-29298 | Adobe ColdFusion Improper Access Control Vulnerability Adobe / ColdFusion | Jul 20, 2023 | Aug 10, 2023 | |
| CVE-2023-38205 | Adobe ColdFusion Improper Access Control Vulnerability Adobe / ColdFusion | Jul 20, 2023 | Aug 10, 2023 | |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Citrix / NetScaler ADC and NetScaler Gateway | Jul 19, 2023 | Aug 9, 2023 | Known |
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability Microsoft / Windows | Jul 17, 2023 | Aug 29, 2023 | Known |
| CVE-2022-29303 | SolarView Compact Command Injection Vulnerability SolarView / Compact | Jul 13, 2023 | Aug 3, 2023 | |
| CVE-2023-37450 | Apple Multiple Products WebKit Code Execution Vulnerability Apple / Multiple Products | Jul 13, 2023 | Aug 3, 2023 | |
| CVE-2022-31199 | Netwrix Auditor Insecure Object Deserialization Vulnerability Netwrix / Auditor | Jul 11, 2023 | Aug 1, 2023 | Known |
| CVE-2023-32046 | Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability Microsoft / Windows | Jul 11, 2023 | Aug 1, 2023 | |
| CVE-2023-32049 | Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability Microsoft / Windows | Jul 11, 2023 | Aug 1, 2023 | |
| CVE-2023-35311 | Microsoft Outlook Security Feature Bypass Vulnerability Microsoft / Outlook | Jul 11, 2023 | Aug 1, 2023 | |
| CVE-2023-36874 | Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability Microsoft / Windows | Jul 11, 2023 | Aug 1, 2023 | |
| CVE-2021-29256 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability Arm / Mali Graphics Processing Unit (GPU) | Jul 7, 2023 | Jul 28, 2023 | |
| CVE-2019-17621 | D-Link DIR-859 Router Command Execution Vulnerability D-Link / DIR-859 Router | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2019-20500 | D-Link DWL-2600AP Access Point Command Injection Vulnerability D-Link / DWL-2600AP Access Point | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2021-25371 | Samsung Mobile Devices Unspecified Vulnerability Samsung / Mobile Devices | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2021-25372 | Samsung Mobile Devices Improper Boundary Check Vulnerability Samsung / Mobile Devices | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2021-25394 | Samsung Mobile Devices Race Condition Vulnerability Samsung / Mobile Devices | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2021-25395 | Samsung Mobile Devices Race Condition Vulnerability Samsung / Mobile Devices | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2021-25487 | Samsung Mobile Devices Out-of-Bounds Read Vulnerability Samsung / Mobile Devices | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2021-25489 | Samsung Mobile Devices Improper Input Validation Vulnerability Samsung / Mobile Devices | Jun 29, 2023 | Jul 20, 2023 | |
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability VMware / Tools | Jun 23, 2023 | Jul 14, 2023 | |
| CVE-2023-27992 | Zyxel Multiple NAS Devices Command Injection Vulnerability Zyxel / Multiple Network-Attached Storage (NAS) Devices | Jun 23, 2023 | Jul 14, 2023 | |
| CVE-2023-32434 | Apple Multiple Products Integer Overflow Vulnerability Apple / Multiple Products | Jun 23, 2023 | Jul 14, 2023 | |
| CVE-2023-32435 | Apple Multiple Products WebKit Memory Corruption Vulnerability Apple / Multiple Products | Jun 23, 2023 | Jul 14, 2023 | |
| CVE-2023-32439 | Apple Multiple Products WebKit Type Confusion Vulnerability Apple / Multiple Products | Jun 23, 2023 | Jul 14, 2023 | |
| CVE-2016-0165 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Jun 22, 2023 | Jul 13, 2023 | |
| CVE-2016-9079 | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability Mozilla / Firefox, Firefox ESR, and Thunderbird | Jun 22, 2023 | Jul 13, 2023 | |
| CVE-2020-12641 | Roundcube Webmail Remote Code Execution Vulnerability Roundcube / Roundcube Webmail | Jun 22, 2023 | Jul 13, 2023 | |
| CVE-2020-35730 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Roundcube / Roundcube Webmail | Jun 22, 2023 | Jul 13, 2023 | |
| CVE-2021-44026 | Roundcube Webmail SQL Injection Vulnerability Roundcube / Roundcube Webmail | Jun 22, 2023 | Jul 13, 2023 | |
| CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability VMware / Aria Operations for Networks | Jun 22, 2023 | Jul 13, 2023 | |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability Fortinet / FortiOS and FortiProxy SSL-VPN | Jun 13, 2023 | Jul 4, 2023 | Known |
| CVE-2023-3079 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Jun 7, 2023 | Jun 28, 2023 | |
| CVE-2023-33009 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability Zyxel / Multiple Firewalls | Jun 5, 2023 | Jun 26, 2023 | |
| CVE-2023-33010 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability Zyxel / Multiple Firewalls | Jun 5, 2023 | Jun 26, 2023 | |
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability Progress / MOVEit Transfer | Jun 2, 2023 | Jun 23, 2023 | Known |
| CVE-2023-28771 | Zyxel Multiple Firewalls OS Command Injection Vulnerability Zyxel / Multiple Firewalls | May 31, 2023 | Jun 21, 2023 | |
| CVE-2023-2868 | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability Barracuda Networks / Email Security Gateway (ESG) Appliance | May 26, 2023 | Jun 16, 2023 | |
| CVE-2023-28204 | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability Apple / Multiple Products | May 22, 2023 | Jun 12, 2023 | |
| CVE-2023-32373 | Apple Multiple Products WebKit Use-After-Free Vulnerability Apple / Multiple Products | May 22, 2023 | Jun 12, 2023 | |
| CVE-2023-32409 | Apple Multiple Products WebKit Sandbox Escape Vulnerability Apple / Multiple Products | May 22, 2023 | Jun 12, 2023 | |
| CVE-2004-1464 | Cisco IOS Denial-of-Service Vulnerability Cisco / IOS | May 19, 2023 | Jun 9, 2023 | |
| CVE-2016-6415 | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability Cisco / IOS, IOS XR, and IOS XE | May 19, 2023 | Jun 9, 2023 | |
| CVE-2023-21492 | Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability Samsung / Mobile Devices | May 19, 2023 | Jun 9, 2023 | |
| CVE-2010-3904 | Linux Kernel Improper Input Validation Vulnerability Linux / Kernel | May 12, 2023 | Jun 2, 2023 | |
| CVE-2014-0196 | Linux Kernel Race Condition Vulnerability Linux / Kernel | May 12, 2023 | Jun 2, 2023 | |
| CVE-2015-5317 | Jenkins User Interface (UI) Information Disclosure Vulnerability Jenkins / Jenkins User Interface (UI) | May 12, 2023 | Jun 2, 2023 | |
| CVE-2016-3427 | Oracle Java SE and JRockit Unspecified Vulnerability Oracle / Java SE and JRockit | May 12, 2023 | Jun 2, 2023 | |
| CVE-2016-8735 | Apache Tomcat Remote Code Execution Vulnerability Apache / Tomcat | May 12, 2023 | Jun 2, 2023 | |
| CVE-2021-3560 | Red Hat Polkit Incorrect Authorization Vulnerability Red Hat / Polkit | May 12, 2023 | Jun 2, 2023 | |
| CVE-2023-25717 | Multiple Ruckus Wireless Products CSRF and RCE Vulnerability Ruckus Wireless / Multiple Products | May 12, 2023 | Jun 2, 2023 | |
| CVE-2023-29336 | Microsoft Win32K Privilege Escalation Vulnerability Microsoft / Win32k | May 9, 2023 | May 30, 2023 | |
| CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability Apache / Log4j2 | May 1, 2023 | May 22, 2023 | Known |
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability TP-Link / Archer AX21 | May 1, 2023 | May 22, 2023 | |
| CVE-2023-21839 | Oracle WebLogic Server Unspecified Vulnerability Oracle / WebLogic Server | May 1, 2023 | May 22, 2023 | |
| CVE-2023-2136 | Google Chrome Skia Integer Overflow Vulnerability Google / Chromium Skia | Apr 21, 2023 | May 12, 2023 | |
| CVE-2023-27350 | PaperCut MF/NG Improper Access Control Vulnerability PaperCut / MF/NG | Apr 21, 2023 | May 12, 2023 | Known |
| CVE-2023-28432 | MinIO Information Disclosure Vulnerability MinIO / MinIO | Apr 21, 2023 | May 12, 2023 | |
| CVE-2017-6742 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability Cisco / IOS and IOS XE Software | Apr 19, 2023 | May 10, 2023 | |
| CVE-2019-8526 | Apple macOS Use-After-Free Vulnerability Apple / macOS | Apr 17, 2023 | May 8, 2023 | |
| CVE-2023-2033 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Apr 17, 2023 | May 8, 2023 | |
| CVE-2023-20963 | Android Framework Privilege Escalation Vulnerability Android / Framework | Apr 13, 2023 | May 4, 2023 | |
| CVE-2023-29492 | Novi Survey Insecure Deserialization Vulnerability Novi Survey / Novi Survey | Apr 13, 2023 | May 4, 2023 | |
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability Microsoft / Windows | Apr 11, 2023 | May 2, 2023 | Known |
| CVE-2023-28205 | Apple Multiple Products WebKit Use-After-Free Vulnerability Apple / Multiple Products | Apr 10, 2023 | May 1, 2023 | |
| CVE-2023-28206 | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability Apple / iOS, iPadOS, and macOS | Apr 10, 2023 | May 1, 2023 | |
| CVE-2019-1388 | Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability Microsoft / Windows | Apr 7, 2023 | Apr 28, 2023 | Known |
| CVE-2021-27876 | Veritas Backup Exec Agent File Access Vulnerability Veritas / Backup Exec Agent | Apr 7, 2023 | Apr 28, 2023 | Known |
| CVE-2021-27877 | Veritas Backup Exec Agent Improper Authentication Vulnerability Veritas / Backup Exec Agent | Apr 7, 2023 | Apr 28, 2023 | Known |
| CVE-2021-27878 | Veritas Backup Exec Agent Command Execution Vulnerability Veritas / Backup Exec Agent | Apr 7, 2023 | Apr 28, 2023 | Known |
| CVE-2023-26083 | Arm Mali GPU Kernel Driver Information Disclosure Vulnerability Arm / Mali Graphics Processing Unit (GPU) | Apr 7, 2023 | Apr 28, 2023 | |
| CVE-2022-27926 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Apr 3, 2023 | Apr 24, 2023 | |
| CVE-2013-3163 | Microsoft Internet Explorer Memory Corruption Vulnerability Microsoft / Internet Explorer | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2017-7494 | Samba Remote Code Execution Vulnerability Samba / Samba | Mar 30, 2023 | Apr 20, 2023 | Known |
| CVE-2021-30900 | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability Apple / iOS, iPadOS, and macOS | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2022-22706 | Arm Mali GPU Kernel Driver Unspecified Vulnerability Arm / Mali Graphics Processing Unit (GPU) | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2022-3038 | Google Chromium Network Service Use-After-Free Vulnerability Google / Chromium Network Service | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2022-38181 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability Arm / Mali Graphics Processing Unit (GPU) | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2022-39197 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability Fortra / Cobalt Strike | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2022-42948 | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability Fortra / Cobalt Strike | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2023-0266 | Linux Kernel Use-After-Free Vulnerability Linux / Kernel | Mar 30, 2023 | Apr 20, 2023 | |
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Adobe / ColdFusion | Mar 15, 2023 | Apr 5, 2023 | |
| CVE-2022-41328 | Fortinet FortiOS Path Traversal Vulnerability Fortinet / FortiOS | Mar 14, 2023 | Apr 4, 2023 | |
| CVE-2023-23397 | Microsoft Office Outlook Privilege Escalation Vulnerability Microsoft / Office | Mar 14, 2023 | Apr 4, 2023 | |
| CVE-2023-24880 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft / Windows | Mar 14, 2023 | Apr 4, 2023 | Known |
| CVE-2020-5741 | Plex Media Server Remote Code Execution Vulnerability Plex / Media Server | Mar 10, 2023 | Mar 31, 2023 | |
| CVE-2021-39144 | XStream Remote Code Execution Vulnerability XStream / XStream | Mar 10, 2023 | Mar 31, 2023 | |
| CVE-2022-28810 | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability Zoho / ManageEngine | Mar 7, 2023 | Mar 28, 2023 | |
| CVE-2022-33891 | Apache Spark Command Injection Vulnerability Apache / Spark | Mar 7, 2023 | Mar 28, 2023 | |
| CVE-2022-35914 | Teclib GLPI Remote Code Execution Vulnerability Teclib / GLPI | Mar 7, 2023 | Mar 28, 2023 | |
| CVE-2022-36537 | ZK Framework AuUploader Unspecified Vulnerability ZK Framework / AuUploader | Feb 27, 2023 | Mar 20, 2023 | Known |
| CVE-2022-40765 | Mitel MiVoice Connect Command Injection Vulnerability Mitel / MiVoice Connect | Feb 21, 2023 | Mar 14, 2023 | Known |
| CVE-2022-41223 | Mitel MiVoice Connect Code Injection Vulnerability Mitel / MiVoice Connect | Feb 21, 2023 | Mar 14, 2023 | Known |
| CVE-2022-47986 | IBM Aspera Faspex Code Execution Vulnerability IBM / Aspera Faspex | Feb 21, 2023 | Mar 14, 2023 | Known |
| CVE-2022-46169 | Cacti Command Injection Vulnerability Cacti / Cacti | Feb 16, 2023 | Mar 9, 2023 | |
| CVE-2023-21715 | Microsoft Office Publisher Security Feature Bypass Vulnerability Microsoft / Office | Feb 14, 2023 | Mar 7, 2023 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses