Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2022-05-23 | CVE-2020-1027 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2020-0638 | Microsoft · Update Notification Manager | Microsoft Update Notification Manager Privilege Escalation Vulnerability | 7.8 High | 2022-06-13 | known |
| 2022-05-23 | CVE-2019-8720 | WebKitGTK · WebKitGTK | WebKitGTK Memory Corruption Vulnerability | 8.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-7287 | Apple · iOS | Apple iOS Memory Corruption Vulnerability | 7.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-7286 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-5786 | Google · Chrome Blink | Google Chrome Blink Use-After-Free Vulnerability | 6.5 Medium | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-18426 | Meta Platforms · WhatsApp | WhatsApp Cross-Site Scripting Vulnerability | 8.2 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-1385 | Microsoft · Windows | Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability | 7.8 High | 2022-06-13 | known |
| 2022-05-23 | CVE-2019-13720 | Google · Chrome WebAudio | Google Chrome WebAudio Use-After-Free Vulnerability | 8.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-11708 | Mozilla · Firefox and Thunderbird | Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability | 10.0 Critical | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-11707 | Mozilla · Firefox and Thunderbird | Mozilla Firefox and Thunderbird Type Confusion Vulnerability | 8.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-1130 | Microsoft · Windows | Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability | 7.8 High | 2022-06-13 | known |
| 2022-05-23 | CVE-2019-0880 | Microsoft · Windows | Microsoft Windows Privilege Escalation Vulnerability | 7.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-0703 | Microsoft · Windows | Microsoft Windows SMB Information Disclosure Vulnerability | 6.5 Medium | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2019-0676 | Microsoft · Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | 6.5 Medium | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2018-8589 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-06-13 | unknown |
| 2022-05-23 | CVE-2018-5002 | Adobe · Flash Player | Adobe Flash Player Stack-based Buffer Overflow Vulnerability | 7.8 High | 2022-06-13 | unknown |
| 2022-05-16 | CVE-2022-30525 | Zyxel · Multiple Firewalls | Zyxel Multiple Firewalls OS Command Injection Vulnerability | 9.8 Critical | 2022-06-06 | unknown |
| 2022-05-16 | CVE-2022-22947 | VMware · Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | 10.0 Critical | 2022-06-06 | unknown |
| 2022-05-10 | CVE-2022-1388 | F5 · BIG-IP | F5 BIG-IP Missing Authentication Vulnerability | 9.8 Critical | 2022-05-31 | known |
| 2022-05-04 | CVE-2021-1789 | Apple · Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 8.8 High | 2022-05-25 | unknown |
| 2022-05-04 | CVE-2019-8506 | Apple · Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 8.8 High | 2022-05-25 | unknown |
| 2022-05-04 | CVE-2014-4113 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-25 | unknown |
| 2022-05-04 | CVE-2014-0322 | Microsoft · Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 8.8 High | 2022-05-25 | unknown |
| 2022-05-04 | CVE-2014-0160 | OpenSSL · OpenSSL | OpenSSL Information Disclosure Vulnerability | 7.5 High | 2022-05-25 | unknown |
| 2022-04-25 | CVE-2022-29464 | WSO2 · Multiple Products | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | 9.8 Critical | 2022-05-16 | known |
| 2022-04-25 | CVE-2022-26904 | Microsoft · Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7.0 High | 2022-05-16 | unknown |
| 2022-04-25 | CVE-2022-21919 | Microsoft · Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7.0 High | 2022-05-16 | unknown |
| 2022-04-25 | CVE-2022-0847 | Linux · Kernel | Linux Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-05-16 | unknown |
| 2022-04-25 | CVE-2021-41357 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-16 | unknown |
| 2022-04-25 | CVE-2021-40450 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-16 | unknown |
| 2022-04-25 | CVE-2019-1003029 | Jenkins · Script Security Plugin | Jenkins Script Security Plugin Sandbox Bypass Vulnerability | 9.9 Critical | 2022-05-16 | unknown |
| 2022-04-19 | CVE-2022-22718 | Microsoft · Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 High | 2022-05-10 | unknown |
| 2022-04-19 | CVE-2019-3568 | Meta Platforms · WhatsApp | WhatsApp VOIP Stack Buffer Overflow Vulnerability | 9.8 Critical | 2022-05-10 | unknown |
| 2022-04-19 | CVE-2018-6882 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2022-05-10 | known |
| 2022-04-15 | CVE-2022-22960 | VMware · Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 7.8 High | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2022-1364 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2019-3929 | Crestron · Multiple Products | Crestron Multiple Products Command Injection Vulnerability | 9.8 Critical | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2019-16057 | D-Link · DNS-320 Storage Device | D-Link DNS-320 Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-06 | known |
| 2022-04-15 | CVE-2018-7841 | Schneider Electric · U.motion Builder | Schneider Electric U.motion Builder SQL Injection Vulnerability | 9.8 Critical | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2016-4523 | Trihedral · VTScada (formerly VTS) | Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability | 7.5 High | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2014-0780 | InduSoft · Web Studio | InduSoft Web Studio NTWebServer Directory Traversal Vulnerability | 7.5 High | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2010-5330 | Ubiquiti · AirOS | Ubiquiti AirOS Command Injection Vulnerability | 9.8 Critical | 2022-05-06 | unknown |
| 2022-04-15 | CVE-2007-3010 | Alcatel · OmniPCX Enterprise | Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-06 | unknown |
| 2022-04-14 | CVE-2022-22954 | VMware · Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 9.8 Critical | 2022-05-05 | known |
| 2022-04-13 | CVE-2022-24521 | Microsoft · Windows | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | 7.8 High | 2022-05-04 | known |
| 2022-04-13 | CVE-2018-7602 | Drupal · Core | Drupal Core Remote Code Execution Vulnerability | 8.1 High | 2022-05-04 | known |
| 2022-04-13 | CVE-2018-20753 | Kaseya · Virtual System/Server Administrator (VSA) | Kaseya VSA Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-04 | known |
| 2022-04-13 | CVE-2015-5123 | Adobe · Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 7.8 High | 2022-05-04 | unknown |
| 2022-04-13 | CVE-2015-5122 | Adobe · Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 7.8 High | 2022-05-04 | unknown |
| 2022-04-13 | CVE-2015-3113 | Adobe · Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | 7.8 High | 2022-05-04 | unknown |
| 2022-04-13 | CVE-2015-2502 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 8.8 High | 2022-05-04 | unknown |
| 2022-04-13 | CVE-2015-0313 | Adobe · Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 7.8 High | 2022-05-04 | unknown |
| 2022-04-13 | CVE-2015-0311 | Adobe · Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 7.8 High | 2022-05-04 | unknown |
| 2022-04-13 | CVE-2014-9163 | Adobe · Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | 7.8 High | 2022-05-04 | unknown |
| 2022-04-11 | CVE-2022-23176 | WatchGuard · Firebox and XTM | WatchGuard Firebox and XTM Privilege Escalation Vulnerability | 8.8 High | 2022-05-02 | unknown |
| 2022-04-11 | CVE-2021-42287 | Microsoft · Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 7.5 High | 2022-05-02 | known |
| 2022-04-11 | CVE-2021-42278 | Microsoft · Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 7.5 High | 2022-05-02 | known |
| 2022-04-11 | CVE-2021-39793 | Google · Pixel | Google Pixel Out-of-Bounds Write Vulnerability | 7.8 High | 2022-05-02 | unknown |
| 2022-04-11 | CVE-2021-27852 | Checkbox · Checkbox Survey | Checkbox Survey Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-05-02 | unknown |
| 2022-04-11 | CVE-2021-22600 | Linux · Kernel | Linux Kernel Privilege Escalation Vulnerability | 6.6 Medium | 2022-05-02 | unknown |
| 2022-04-11 | CVE-2020-2509 | QNAP · QNAP Network-Attached Storage (NAS) | QNAP Network-Attached Storage (NAS) Command Injection Vulnerability | 9.8 Critical | 2022-05-02 | unknown |
| 2022-04-11 | CVE-2017-11317 | Telerik · User Interface (UI) for ASP.NET AJAX | Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability | 9.8 Critical | 2022-05-02 | unknown |
| 2022-04-06 | CVE-2021-3156 | Sudo · Sudo | Sudo Heap-Based Buffer Overflow Vulnerability | 7.8 High | 2022-04-27 | unknown |
| 2022-04-06 | CVE-2021-31166 | Microsoft · HTTP Protocol Stack | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-27 | unknown |
| 2022-04-06 | CVE-2017-0148 | Microsoft · SMBv1 server | Microsoft SMBv1 Server Remote Code Execution Vulnerability | 8.1 High | 2022-04-27 | known |
| 2022-04-04 | CVE-2022-22965 | VMware · Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-25 | unknown |
| 2022-04-04 | CVE-2022-22675 | Apple · macOS | Apple macOS Out-of-Bounds Write Vulnerability | 7.8 High | 2022-04-25 | unknown |
| 2022-04-04 | CVE-2022-22674 | Apple · macOS | Apple macOS Out-of-Bounds Read Vulnerability | 5.5 Medium | 2022-04-25 | unknown |
| 2022-04-04 | CVE-2021-45382 | D-Link · Multiple Routers | D-Link Multiple Routers Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-25 | unknown |
| 2022-03-31 | CVE-2022-26871 | Trend Micro · Apex Central | Trend Micro Apex Central Arbitrary File Upload Vulnerability | 9.8 Critical | 2022-04-21 | unknown |
| 2022-03-31 | CVE-2022-1040 | Sophos · Firewall | Sophos Firewall Authentication Bypass Vulnerability | 9.8 Critical | 2022-04-21 | unknown |
| 2022-03-31 | CVE-2021-34484 | Microsoft · Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7.8 High | 2022-04-21 | unknown |
| 2022-03-31 | CVE-2021-28799 | QNAP · Network Attached Storage (NAS) | QNAP NAS Improper Authorization Vulnerability | 10.0 Critical | 2022-04-21 | known |
| 2022-03-31 | CVE-2021-21551 | Dell · dbutil Driver | Dell dbutil Driver Insufficient Access Control Vulnerability | 8.8 High | 2022-04-21 | unknown |
| 2022-03-31 | CVE-2018-10562 | Dasan · Gigabit Passive Optical Network (GPON) Routers | Dasan GPON Routers Command Injection Vulnerability | 9.8 Critical | 2022-04-21 | known |
| 2022-03-31 | CVE-2018-10561 | Dasan · Gigabit Passive Optical Network (GPON) Routers | Dasan GPON Routers Authentication Bypass Vulnerability | 9.8 Critical | 2022-04-21 | unknown |
| 2022-03-28 | CVE-2022-1096 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2022-0543 | Redis · Debian-specific Redis Servers | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | 10.0 Critical | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2021-38646 | Microsoft · Office | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | 7.8 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2021-34486 | Microsoft · Windows | Microsoft Windows Event Tracing Privilege Escalation Vulnerability | 7.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2021-26085 | Atlassian · Confluence Server | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | 5.3 Medium | 2022-04-18 | known |
| 2022-03-28 | CVE-2021-20028 | SonicWall · Secure Remote Access (SRA) | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | 9.8 Critical | 2022-04-18 | known |
| 2022-03-28 | CVE-2019-7483 | SonicWall · SMA100 | SonicWall SMA100 Directory Traversal Vulnerability | 7.5 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2018-8440 | Microsoft · Windows | Microsoft Windows Privilege Escalation Vulnerability | 7.8 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2018-8406 | Microsoft · DirectX Graphics Kernel (DXGKRNL) | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2018-8405 | Microsoft · DirectX Graphics Kernel (DXGKRNL) | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2017-0213 | Microsoft · Windows | Microsoft Windows Privilege Escalation Vulnerability | 7.3 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2017-0059 | Microsoft · Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | 4.3 Medium | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2017-0037 | Microsoft · Edge and Internet Explorer | Microsoft Edge and Internet Explorer Type Confusion Vulnerability | 8.1 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2016-7201 | Microsoft · Edge | Microsoft Edge Memory Corruption Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2016-7200 | Microsoft · Edge | Microsoft Edge Memory Corruption Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2016-0189 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 7.5 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2016-0151 | Microsoft · Client-Server Run-time Subsystem (CSRSS) | Microsoft Windows CSRSS Security Feature Bypass Vulnerability | 7.8 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2016-0040 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2015-2426 | Microsoft · Windows | Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2015-2419 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2015-1770 | Microsoft · Office | Microsoft Office Uninitialized Memory Use Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2013-3660 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2013-2729 | Adobe · Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | 8.8 High | 2022-04-18 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.