Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2023-02-14 | CVE-2023-23376 | Microsoft · Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | 7.8 High | 2023-03-07 | known |
| 2023-02-14 | CVE-2023-21823 | Microsoft · Windows | Microsoft Windows Graphic Component Privilege Escalation Vulnerability | 7.8 High | 2023-03-07 | unknown |
| 2023-02-14 | CVE-2023-21715 | Microsoft · Office | Microsoft Office Publisher Security Feature Bypass Vulnerability | 7.3 High | 2023-03-07 | unknown |
| 2023-02-10 | CVE-2023-0669 | Fortra · GoAnywhere MFT | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | 7.2 High | 2023-03-03 | known |
| 2023-02-10 | CVE-2022-24990 | TerraMaster · TerraMaster OS | TerraMaster OS Remote Command Execution Vulnerability | 9.8 Critical | 2023-03-03 | known |
| 2023-02-10 | CVE-2015-2291 | Intel · Ethernet Diagnostics Driver for Windows | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability | 7.8 High | 2023-03-03 | known |
| 2023-02-02 | CVE-2023-22952 | SugarCRM · Multiple Products | Multiple SugarCRM Products Remote Code Execution Vulnerability | 8.8 High | 2023-02-23 | unknown |
| 2023-02-02 | CVE-2022-21587 | Oracle · E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | 9.8 Critical | 2023-02-23 | known |
| 2023-01-26 | CVE-2017-11357 | Telerik · User Interface (UI) for ASP.NET AJAX | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability | 9.8 Critical | 2023-02-16 | known |
| 2023-01-23 | CVE-2022-47966 | Zoho · ManageEngine | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | 9.8 Critical | 2023-02-13 | known |
| 2023-01-17 | CVE-2022-44877 | CWP · Control Web Panel | CWP Control Web Panel OS Command Injection Vulnerability | 9.8 Critical | 2023-02-07 | unknown |
| 2023-01-10 | CVE-2023-21674 | Microsoft · Windows | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | 8.8 High | 2023-01-31 | unknown |
| 2023-01-10 | CVE-2022-41080 | Microsoft · Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | 8.8 High | 2023-01-31 | known |
| 2022-12-29 | CVE-2018-5430 | TIBCO · JasperReports | TIBCO JasperReports Server Information Disclosure Vulnerability | 7.7 High | 2023-01-19 | unknown |
| 2022-12-29 | CVE-2018-18809 | TIBCO · JasperReports | TIBCO JasperReports Library Directory Traversal Vulnerability | 9.9 Critical | 2023-01-19 | unknown |
| 2022-12-14 | CVE-2022-42856 | Apple · iOS | Apple iOS Type Confusion Vulnerability | 8.8 High | 2023-01-04 | unknown |
| 2022-12-13 | CVE-2022-44698 | Microsoft · Defender | Microsoft Defender SmartScreen Security Feature Bypass Vulnerability | 5.4 Medium | 2023-01-03 | known |
| 2022-12-13 | CVE-2022-42475 | Fortinet · FortiOS | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | 9.3 Critical | 2023-01-03 | known |
| 2022-12-13 | CVE-2022-27518 | Citrix · Application Delivery Controller (ADC) and Gateway | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | 9.8 Critical | 2023-01-03 | unknown |
| 2022-12-13 | CVE-2022-26501 | Veeam · Backup & Replication | Veeam Backup & Replication Remote Code Execution Vulnerability | 9.8 Critical | 2023-01-03 | known |
| 2022-12-13 | CVE-2022-26500 | Veeam · Backup & Replication | Veeam Backup & Replication Remote Code Execution Vulnerability | 8.8 High | 2023-01-03 | known |
| 2022-12-05 | CVE-2022-4262 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2022-12-26 | unknown |
| 2022-11-28 | CVE-2022-4135 | Google · Chromium GPU | Google Chromium GPU Heap Buffer Overflow Vulnerability | 9.6 Critical | 2022-12-19 | unknown |
| 2022-11-28 | CVE-2021-35587 | Oracle · Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 9.8 Critical | 2022-12-19 | unknown |
| 2022-11-14 | CVE-2022-41049 | Microsoft · Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | 5.4 Medium | 2022-12-09 | unknown |
| 2022-11-08 | CVE-2022-41128 | Microsoft · Windows | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | 8.8 High | 2022-12-09 | unknown |
| 2022-11-08 | CVE-2022-41125 | Microsoft · Windows | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | 7.8 High | 2022-12-09 | unknown |
| 2022-11-08 | CVE-2022-41091 | Microsoft · Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | 5.4 Medium | 2022-12-09 | known |
| 2022-11-08 | CVE-2022-41073 | Microsoft · Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 High | 2022-12-09 | known |
| 2022-11-08 | CVE-2021-25370 | Samsung · Mobile Devices | Samsung Mobile Devices Memory Corruption Vulnerability | 6.1 Medium | 2022-11-29 | unknown |
| 2022-11-08 | CVE-2021-25369 | Samsung · Mobile Devices | Samsung Mobile Devices Improper Access Control Vulnerability | 6.2 Medium | 2022-11-29 | unknown |
| 2022-11-08 | CVE-2021-25337 | Samsung · Mobile Devices | Samsung Mobile Devices Improper Access Control Vulnerability | 4.4 Medium | 2022-11-29 | unknown |
| 2022-10-28 | CVE-2022-3723 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2022-11-18 | unknown |
| 2022-10-25 | CVE-2022-42827 | Apple · iOS and iPadOS | Apple iOS and iPadOS Out-of-Bounds Write Vulnerability | 7.8 High | 2022-11-15 | unknown |
| 2022-10-24 | CVE-2020-3433 | Cisco · AnyConnect Secure | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability | 7.8 High | 2022-11-14 | known |
| 2022-10-24 | CVE-2020-3153 | Cisco · AnyConnect Secure | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability | 6.5 Medium | 2022-11-14 | known |
| 2022-10-24 | CVE-2018-19323 | GIGABYTE · Multiple Products | GIGABYTE Multiple Products Privilege Escalation Vulnerability | 9.8 Critical | 2022-11-14 | known |
| 2022-10-24 | CVE-2018-19322 | GIGABYTE · Multiple Products | GIGABYTE Multiple Products Code Execution Vulnerability | 7.8 High | 2022-11-14 | known |
| 2022-10-24 | CVE-2018-19321 | GIGABYTE · Multiple Products | GIGABYTE Multiple Products Privilege Escalation Vulnerability | 7.8 High | 2022-11-14 | known |
| 2022-10-24 | CVE-2018-19320 | GIGABYTE · Multiple Products | GIGABYTE Multiple Products Unspecified Vulnerability | 7.8 High | 2022-11-14 | known |
| 2022-10-20 | CVE-2022-41352 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | 9.8 Critical | 2022-11-10 | known |
| 2022-10-20 | CVE-2021-3493 | Linux · Kernel | Linux Kernel Privilege Escalation Vulnerability | 8.8 High | 2022-11-10 | unknown |
| 2022-10-11 | CVE-2022-41033 | Microsoft · Windows COM+ Event System Service | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | 7.8 High | 2022-11-01 | unknown |
| 2022-10-11 | CVE-2022-40684 | Fortinet · Multiple Products | Fortinet Multiple Products Authentication Bypass Vulnerability | 9.8 Critical | 2022-11-01 | known |
| 2022-09-30 | CVE-2022-41082 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 8.0 High | 2022-10-21 | known |
| 2022-09-30 | CVE-2022-41040 | Microsoft · Exchange Server | Microsoft Exchange Server Server-Side Request Forgery Vulnerability | 8.8 High | 2022-10-21 | known |
| 2022-09-30 | CVE-2022-36804 | Atlassian · Bitbucket Server and Data Center | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | 8.8 High | 2022-10-21 | unknown |
| 2022-09-23 | CVE-2022-3236 | Sophos · Firewall | Sophos Firewall Code Injection Vulnerability | 9.8 Critical | 2022-10-14 | unknown |
| 2022-09-22 | CVE-2022-35405 | Zoho · ManageEngine | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | 9.8 Critical | 2022-10-13 | unknown |
| 2022-09-15 | CVE-2022-40139 | Trend Micro · Apex One and Apex One as a Service | Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability | 7.2 High | 2022-10-06 | unknown |
| 2022-09-15 | CVE-2013-6282 | Linux · Kernel | Linux Kernel Improper Input Validation Vulnerability | 8.8 High | 2022-10-06 | unknown |
| 2022-09-15 | CVE-2013-2597 | Code Aurora · ACDB Audio Driver | Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability | 8.4 High | 2022-10-06 | unknown |
| 2022-09-15 | CVE-2013-2596 | Linux · Kernel | Linux Kernel Integer Overflow Vulnerability | 7.8 High | 2022-10-06 | unknown |
| 2022-09-15 | CVE-2013-2094 | Linux · Kernel | Linux Kernel Privilege Escalation Vulnerability | 8.4 High | 2022-10-06 | unknown |
| 2022-09-15 | CVE-2010-2568 | Microsoft · Windows | Microsoft Windows Remote Code Execution Vulnerability | 7.8 High | 2022-10-06 | unknown |
| 2022-09-14 | CVE-2022-37969 | Microsoft · Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | 7.8 High | 2022-10-05 | known |
| 2022-09-14 | CVE-2022-32917 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | 7.8 High | 2022-10-05 | unknown |
| 2022-09-08 | CVE-2022-3075 | Google · Chromium Mojo | Google Chromium Mojo Insufficient Data Validation Vulnerability | 9.6 Critical | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2022-27593 | QNAP · Photo Station | QNAP Photo Station Externally Controlled Reference Vulnerability | 10.0 Critical | 2022-09-29 | known |
| 2022-09-08 | CVE-2022-26258 | D-Link · DIR-820L | D-Link DIR-820L Remote Code Execution Vulnerability | 9.8 Critical | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2020-9934 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Input Validation Vulnerability | 5.5 Medium | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2018-7445 | MikroTik · RouterOS | MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | 9.8 Critical | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2018-6530 | D-Link · Multiple Routers | D-Link Multiple Routers OS Command Injection Vulnerability | 9.8 Critical | 2022-09-29 | known |
| 2022-09-08 | CVE-2018-2628 | Oracle · WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 9.8 Critical | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2018-13374 | Fortinet · FortiOS and FortiADC | Fortinet FortiOS and FortiADC Improper Access Control Vulnerability | 4.3 Medium | 2022-09-29 | known |
| 2022-09-08 | CVE-2017-5521 | NETGEAR · Multiple Devices | NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability | 8.1 High | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2011-4723 | D-Link · DIR-300 Router | D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability | 5.7 Medium | 2022-09-29 | unknown |
| 2022-09-08 | CVE-2011-1823 | Android · Android OS | Android OS Privilege Escalation Vulnerability | 7.8 High | 2022-09-29 | unknown |
| 2022-08-25 | CVE-2022-26352 | dotCMS · dotCMS | dotCMS Unrestricted Upload of File Vulnerability | 9.8 Critical | 2022-09-15 | known |
| 2022-08-25 | CVE-2022-24706 | Apache · CouchDB | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | 9.8 Critical | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2022-24112 | Apache · APISIX | Apache APISIX Authentication Bypass Vulnerability | 9.8 Critical | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2022-22963 | VMware Tanzu · Spring Cloud | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | 9.8 Critical | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2022-2294 | WebRTC · WebRTC | WebRTC Heap Buffer Overflow Vulnerability | 8.8 High | 2022-09-15 | known |
| 2022-08-25 | CVE-2021-39226 | Grafana Labs · Grafana | Grafana Authentication Bypass Vulnerability | 9.8 Critical | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2021-38406 | Delta Electronics · DOPSoft 2 | Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability | 7.8 High | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2021-31010 | Apple · iOS, macOS, watchOS | Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability | 7.5 High | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2020-36193 | PEAR · Archive_Tar | PEAR Archive_Tar Improper Link Resolution Vulnerability | 7.5 High | 2022-09-15 | unknown |
| 2022-08-25 | CVE-2020-28949 | PEAR · Archive_Tar | PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability | 7.8 High | 2022-09-15 | unknown |
| 2022-08-22 | CVE-2022-0028 | Palo Alto Networks · PAN-OS | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | 8.6 High | 2022-09-12 | unknown |
| 2022-08-18 | CVE-2022-32894 | Apple · iOS and macOS | Apple iOS and macOS Out-of-Bounds Write Vulnerability | 7.8 High | 2022-09-08 | unknown |
| 2022-08-18 | CVE-2022-32893 | Apple · iOS and macOS | Apple iOS and macOS Out-of-Bounds Write Vulnerability | 8.8 High | 2022-09-08 | unknown |
| 2022-08-18 | CVE-2022-2856 | Google · Chromium Intents | Google Chromium Intents Insufficient Input Validation Vulnerability | 6.5 Medium | 2022-09-08 | unknown |
| 2022-08-18 | CVE-2022-26923 | Microsoft · Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 8.8 High | 2022-09-08 | unknown |
| 2022-08-18 | CVE-2022-22536 | SAP · Multiple Products | SAP Multiple Products HTTP Request Smuggling Vulnerability | 9.8 Critical | 2022-09-08 | unknown |
| 2022-08-18 | CVE-2022-21971 | Microsoft · Windows | Microsoft Windows Runtime Remote Code Execution Vulnerability | 7.8 High | 2022-09-08 | unknown |
| 2022-08-18 | CVE-2017-15944 | Palo Alto Networks · PAN-OS | Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | 9.8 Critical | 2022-09-08 | unknown |
| 2022-08-11 | CVE-2022-37042 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability | 9.8 Critical | 2022-09-01 | known |
| 2022-08-11 | CVE-2022-27925 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | 7.2 High | 2022-09-01 | known |
| 2022-08-09 | CVE-2022-34713 | Microsoft · Windows | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | 7.8 High | 2022-08-30 | unknown |
| 2022-08-09 | CVE-2022-30333 | RARLAB · UnRAR | RARLAB UnRAR Directory Traversal Vulnerability | 9.8 Critical | 2022-08-30 | known |
| 2022-08-04 | CVE-2022-27924 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability | 9.8 Critical | 2022-08-25 | known |
| 2022-07-29 | CVE-2022-26138 | Atlassian · Confluence | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | 9.8 Critical | 2022-08-19 | unknown |
| 2022-07-12 | CVE-2022-22047 | Microsoft · Windows | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | 7.8 High | 2022-08-02 | unknown |
| 2022-07-01 | CVE-2022-26925 | Microsoft · Windows | Microsoft Windows LSA Spoofing Vulnerability | 8.1 High | 2022-07-22 | unknown |
| 2022-06-27 | CVE-2022-29499 | Mitel · MiVoice Connect | Mitel MiVoice Connect Data Validation Vulnerability | 9.8 Critical | 2022-07-18 | known |
| 2022-06-27 | CVE-2021-4034 | Red Hat · Polkit | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability | 7.8 High | 2022-07-18 | known |
| 2022-06-27 | CVE-2021-30983 | Apple · iOS and iPadOS | Apple iOS and iPadOS Buffer Overflow Vulnerability | 7.8 High | 2022-07-18 | unknown |
| 2022-06-27 | CVE-2021-30533 | Google · Chromium PopupBlocker | Google Chromium PopupBlocker Security Bypass Vulnerability | 6.5 Medium | 2022-07-18 | unknown |
| 2022-06-27 | CVE-2020-9907 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2022-07-18 | unknown |
| 2022-06-27 | CVE-2020-3837 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2022-07-18 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.