Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2022-03-28 | CVE-2013-2551 | Microsoft · Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 8.8 High | 2022-04-18 | known |
| 2022-03-28 | CVE-2013-2465 | Oracle · Java SE | Oracle Java SE Unspecified Vulnerability | 9.8 Critical | 2022-04-18 | known |
| 2022-03-28 | CVE-2013-1690 | Mozilla · Firefox and Thunderbird | Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability | 8.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2012-5076 | Oracle · Java SE | Oracle Java SE Sandbox Bypass Vulnerability | 9.8 Critical | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2012-2539 | Microsoft · Word | Microsoft Word Remote Code Execution Vulnerability | 7.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2012-2034 | Adobe · Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 7.5 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2012-0518 | Oracle · Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 4.7 Medium | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2011-2005 | Microsoft · Ancillary Function Driver (afd.sys) | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability | 7.8 High | 2022-04-18 | unknown |
| 2022-03-28 | CVE-2010-4398 | Microsoft · Windows | Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability | 7.8 High | 2022-04-21 | unknown |
| 2022-03-25 | CVE-2022-26318 | WatchGuard · Firebox and XTM Appliances | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2022-26143 | Mitel · MiCollab, MiVoice Business Express | MiCollab, MiVoice Business Express Access Control Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2022-21999 | Microsoft · Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 High | 2022-04-15 | known |
| 2022-03-25 | CVE-2021-42237 | Sitecore · XP | Sitecore XP Remote Command Execution Vulnerability | 9.8 Critical | 2022-04-15 | known |
| 2022-03-25 | CVE-2021-22941 | Citrix · ShareFile | Citrix ShareFile Improper Access Control Vulnerability | 9.8 Critical | 2022-04-15 | known |
| 2022-03-25 | CVE-2020-9377 | D-Link · DIR-610 Devices | D-Link DIR-610 Devices Remote Command Execution | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-9054 | Zyxel · Multiple Network-Attached Storage (NAS) Devices | Zyxel Multiple NAS Devices OS Command Injection Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-7247 | OpenBSD · OpenSMTPD | OpenSMTPD Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-5410 | VMware Tanzu · Spring Cloud Configuration (Config) Server | VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-25223 | Sophos · SG UTM | Sophos SG UTM Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-2506 | QNAP Systems · Helpdesk | QNAP Helpdesk Improper Access Control Vulnerability | 7.3 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-2021 | Palo Alto Networks · PAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 10.0 Critical | 2022-04-15 | known |
| 2022-03-25 | CVE-2020-1956 | Apache · Kylin | Apache Kylin OS Command Injection Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2020-1631 | Juniper · Junos OS | Juniper Junos OS Path Traversal Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-6340 | Drupal · Core | Drupal Core Remote Code Execution Vulnerability | 8.1 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-2616 | Oracle · BI Publisher (Formerly XML Publisher) | Oracle BI Publisher Unauthorized Access Vulnerability | 7.2 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-16920 | D-Link · Multiple Routers | D-Link Multiple Routers Command Injection Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-15107 | Webmin · Webmin | Webmin Command Injection Vulnerability | 9.8 Critical | 2022-04-15 | known |
| 2022-03-25 | CVE-2019-12991 | Citrix · SD-WAN and NetScaler | Citrix SD-WAN and NetScaler Command Injection Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-12989 | Citrix · SD-WAN and NetScaler | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-11043 | PHP · FastCGI Process Manager (FPM) | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability | 8.7 High | 2022-04-15 | known |
| 2022-03-25 | CVE-2019-10068 | Kentico · Xperience | Kentico Xperience Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-1003030 | Jenkins · Matrix Project Plugin | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability | 9.9 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2019-0903 | Microsoft · Graphics Device Interface (GDI) | Microsoft GDI Remote Code Execution Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2018-8414 | Microsoft · Windows | Microsoft Windows Shell Remote Code Execution Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2018-8373 | Microsoft · Internet Explorer Scripting Engine | Microsoft Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2018-6961 | VMware · SD-WAN Edge | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 8.1 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2018-14839 | LG · N1A1 NAS | LG N1A1 NAS Remote Command Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2018-1273 | VMware Tanzu · Spring Data Commons | VMware Tanzu Spring Data Commons Property Binder Vulnerability | 9.8 Critical | 2022-04-15 | known |
| 2022-03-25 | CVE-2018-11138 | Quest · KACE System Management Appliance | Quest KACE System Management Appliance Remote Command Execution Vulnerability | 9.8 Critical | 2022-04-15 | known |
| 2022-03-25 | CVE-2018-0147 | Cisco · Secure Access Control System (ACS) | Cisco Secure Access Control System Java Deserialization Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2018-0125 | Cisco · VPN Routers | Cisco VPN Routers Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2017-6334 | NETGEAR · DGN2200 Devices | NETGEAR DGN2200 Devices OS Command Injection Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2017-6316 | Citrix · NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Citrix Multiple Products Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2017-3881 | Cisco · IOS and IOS XE | Cisco IOS and IOS XE Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2017-12617 | Apache · Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 8.1 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2017-12615 | Apache · Tomcat | Apache Tomcat on Windows Remote Code Execution Vulnerability | 8.1 High | 2022-04-15 | known |
| 2022-03-25 | CVE-2017-0146 | Microsoft · Windows | Microsoft Windows SMB Remote Code Execution Vulnerability | 8.8 High | 2022-04-15 | known |
| 2022-03-25 | CVE-2016-7892 | Adobe · Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2016-4171 | Adobe · Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 7.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2016-1555 | NETGEAR · Wireless Access Point (WAP) Devices | NETGEAR Multiple WAP Devices Command Injection Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2016-11021 | D-Link · DCS-930L Devices | D-Link DCS-930L Devices OS Command Injection Vulnerability | 7.2 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2016-10174 | NETGEAR · WNR2000v5 Router | NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2016-0752 | Rails · Ruby on Rails | Ruby on Rails Directory Traversal Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2015-4068 | Arcserve · Unified Data Protection (UDP) | Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability | 9.1 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2015-3035 | TP-Link · Multiple Archer Devices | TP-Link Multiple Archer Devices Directory Traversal Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2015-1427 | Elastic · Elasticsearch | Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2015-1187 | D-Link and TRENDnet · Multiple Devices | D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2015-0666 | Cisco · Prime Data Center Network Manager (DCNM) | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2014-6332 | Microsoft · Windows | Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2014-6324 | Microsoft · Kerberos Key Distribution Center (KDC) | Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2014-6287 | Rejetto · HTTP File Server (HFS) | Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2014-3120 | Elastic · Elasticsearch | Elasticsearch Remote Code Execution Vulnerability | 8.1 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2014-0130 | Rails · Ruby on Rails | Ruby on Rails Directory Traversal Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2013-5223 | D-Link · DSL-2760U | D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability | 5.4 Medium | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2013-4810 | Hewlett Packard (HP) · ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management | HP Multiple Products Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2013-2251 | Apache · Struts | Apache Struts Improper Input Validation Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2012-1823 | PHP · PHP | PHP-CGI Query String Parameter Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2010-4345 | Exim · Exim | Exim Privilege Escalation Vulnerability | 7.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2010-4344 | Exim · Exim | Exim Heap-Based Buffer Overflow Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2010-3035 | Cisco · IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 7.5 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2010-2861 | Adobe · ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 7.5 High | 2022-04-15 | known |
| 2022-03-25 | CVE-2009-2055 | Cisco · IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 5.9 Medium | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2009-1151 | phpMyAdmin · phpMyAdmin | phpMyAdmin Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2009-0927 | Adobe · Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | 8.8 High | 2022-04-15 | unknown |
| 2022-03-25 | CVE-2005-2773 | Hewlett Packard (HP) · OpenView Network Node Manager | HP OpenView Network Node Manager Remote Code Execution Vulnerability | 9.8 Critical | 2022-04-15 | unknown |
| 2022-03-15 | CVE-2020-5135 | SonicWall · SonicOS | SonicWall SonicOS Buffer Overflow Vulnerability | 9.8 Critical | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1405 | Microsoft · Windows | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1322 | Microsoft · Windows | Microsoft Windows Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1315 | Microsoft · Windows | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1253 | Microsoft · Windows | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1132 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | unknown |
| 2022-03-15 | CVE-2019-1129 | Microsoft · Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1069 | Microsoft · Task Scheduler | Microsoft Task Scheduler Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-1064 | Microsoft · Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-0841 | Microsoft · Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2019-0543 | Microsoft · Windows | Microsoft Windows Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2018-8120 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.0 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2017-0101 | Microsoft · Windows | Microsoft Windows Transaction Manager Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2016-3309 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-04-05 | known |
| 2022-03-15 | CVE-2015-2546 | Microsoft · Win32k | Microsoft Win32k Memory Corruption Vulnerability | 8.2 High | 2022-04-05 | known |
| 2022-03-07 | CVE-2022-26486 | Mozilla · Firefox | Mozilla Firefox Use-After-Free Vulnerability | 9.6 Critical | 2022-03-21 | unknown |
| 2022-03-07 | CVE-2022-26485 | Mozilla · Firefox | Mozilla Firefox Use-After-Free Vulnerability | 8.8 High | 2022-03-21 | unknown |
| 2022-03-07 | CVE-2021-21973 | VMware · vCenter Server and Cloud Foundation | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 5.3 Medium | 2022-03-21 | unknown |
| 2022-03-07 | CVE-2020-8218 | Pulse Secure · Pulse Connect Secure | Pulse Connect Secure Code Injection Vulnerability | 7.2 High | 2022-09-07 | unknown |
| 2022-03-07 | CVE-2019-11581 | Atlassian · Jira Server and Data Center | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability | 9.8 Critical | 2022-09-07 | unknown |
| 2022-03-07 | CVE-2017-6077 | NETGEAR · Wireless Router DGN2200 | NETGEAR DGN2200 Remote Code Execution Vulnerability | 9.8 Critical | 2022-09-07 | unknown |
| 2022-03-07 | CVE-2016-6277 | NETGEAR · Multiple Routers | NETGEAR Multiple Routers Remote Code Execution Vulnerability | 8.8 High | 2022-09-07 | unknown |
| 2022-03-07 | CVE-2013-0631 | Adobe · ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | 7.5 High | 2022-09-07 | unknown |
| 2022-03-07 | CVE-2013-0629 | Adobe · ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 7.5 High | 2022-09-07 | unknown |
| 2022-03-07 | CVE-2013-0625 | Adobe · ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 9.8 Critical | 2022-09-07 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.