Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2022-02-22 | CVE-2022-23134 | Zabbix · Frontend | Zabbix Frontend Improper Access Control Vulnerability | 3.7 Low | 2022-03-08 | unknown |
| 2022-02-22 | CVE-2022-23131 | Zabbix · Frontend | Zabbix Frontend Authentication Bypass Vulnerability | 9.1 Critical | 2022-03-08 | unknown |
| 2022-02-15 | CVE-2022-24086 | Adobe · Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | 9.8 Critical | 2022-03-01 | unknown |
| 2022-02-15 | CVE-2022-0609 | Google · Chromium Animation | Google Chromium Animation Use-After-Free Vulnerability | 8.8 High | 2022-03-01 | unknown |
| 2022-02-15 | CVE-2019-0752 | Microsoft · Internet Explorer | Microsoft Internet Explorer Type Confusion Vulnerability | 7.5 High | 2022-08-15 | known |
| 2022-02-15 | CVE-2018-8174 | Microsoft · Windows | Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability | 7.5 High | 2022-08-15 | known |
| 2022-02-15 | CVE-2018-20250 | RARLAB · WinRAR | WinRAR Absolute Path Traversal Vulnerability | 7.8 High | 2022-08-15 | known |
| 2022-02-15 | CVE-2018-15982 | Adobe · Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 7.8 High | 2022-08-15 | known |
| 2022-02-15 | CVE-2017-9841 | PHPUnit · PHPUnit | PHPUnit Command Injection Vulnerability | 9.8 Critical | 2022-08-15 | unknown |
| 2022-02-15 | CVE-2014-1761 | Microsoft · Word | Microsoft Word Memory Corruption Vulnerability | 7.8 High | 2022-08-15 | unknown |
| 2022-02-15 | CVE-2013-3906 | Microsoft · Graphics Component | Microsoft Graphics Component Memory Corruption Vulnerability | 7.8 High | 2022-08-15 | unknown |
| 2022-02-11 | CVE-2022-22620 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability | 8.8 High | 2022-02-25 | unknown |
| 2022-02-10 | CVE-2021-36934 | Microsoft · Windows | Microsoft Windows SAM Local Privilege Escalation Vulnerability | 7.8 High | 2022-02-24 | unknown |
| 2022-02-10 | CVE-2020-0796 | Microsoft · SMBv3 | Microsoft SMBv3 Remote Code Execution Vulnerability | 10.0 Critical | 2022-08-10 | known |
| 2022-02-10 | CVE-2018-1000861 | Jenkins · Jenkins Stapler Web Framework | Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2017-9791 | Apache · Struts 1 | Apache Struts 1 Improper Input Validation Vulnerability | 9.8 Critical | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2017-8464 | Microsoft · Windows | Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability | 8.8 High | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2017-10271 | Oracle · WebLogic Server | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | 7.5 High | 2022-08-10 | known |
| 2022-02-10 | CVE-2017-0263 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2017-0262 | Microsoft · Office | Microsoft Office Remote Code Execution Vulnerability | 7.8 High | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2017-0145 | Microsoft · SMBv1 | Microsoft SMBv1 Remote Code Execution Vulnerability | 8.8 High | 2022-08-10 | known |
| 2022-02-10 | CVE-2017-0144 | Microsoft · SMBv1 | Microsoft SMBv1 Remote Code Execution Vulnerability | 8.8 High | 2022-08-10 | known |
| 2022-02-10 | CVE-2016-3088 | Apache · ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 9.8 Critical | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2015-2051 | D-Link · DIR-645 Router | D-Link DIR-645 Router Remote Code Execution Vulnerability | 8.8 High | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2015-1635 | Microsoft · HTTP.sys | Microsoft HTTP.sys Remote Code Execution Vulnerability | 9.8 Critical | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2015-1130 | Apple · OS X | Apple OS X Authentication Bypass Vulnerability | 7.8 High | 2022-08-10 | unknown |
| 2022-02-10 | CVE-2014-4404 | Apple · OS X | Apple OS X Heap-Based Buffer Overflow Vulnerability | 7.8 High | 2022-08-10 | unknown |
| 2022-02-04 | CVE-2022-21882 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.0 High | 2022-02-18 | known |
| 2022-01-28 | CVE-2022-22587 | Apple · iOS and macOS | Apple Memory Corruption Vulnerability | 9.8 Critical | 2022-02-11 | unknown |
| 2022-01-28 | CVE-2021-20038 | SonicWall · SMA 100 Appliances | SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability | 9.8 Critical | 2022-02-11 | known |
| 2022-01-28 | CVE-2020-5722 | Grandstream · UCM6200 | Grandstream Networks UCM6200 Series SQL Injection Vulnerability | 9.8 Critical | 2022-07-28 | unknown |
| 2022-01-28 | CVE-2020-0787 | Microsoft · Windows | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | 7.8 High | 2022-07-28 | known |
| 2022-01-28 | CVE-2017-5689 | Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability | 9.8 Critical | 2022-07-28 | unknown |
| 2022-01-28 | CVE-2014-7169 | GNU · Bourne-Again Shell (Bash) | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | 9.8 Critical | 2022-07-28 | unknown |
| 2022-01-28 | CVE-2014-6271 | GNU · Bourne-Again Shell (Bash) | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | 9.8 Critical | 2022-07-28 | unknown |
| 2022-01-28 | CVE-2014-1776 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 9.8 Critical | 2022-07-28 | unknown |
| 2022-01-21 | CVE-2021-35247 | SolarWinds · Serv-U | SolarWinds Serv-U Improper Input Validation Vulnerability | 4.3 Medium | 2022-02-04 | unknown |
| 2022-01-21 | CVE-2018-8453 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-07-21 | known |
| 2022-01-21 | CVE-2012-0391 | Apache · Struts 2 | Apache Struts 2 Improper Input Validation Vulnerability | 9.8 Critical | 2022-07-21 | unknown |
| 2022-01-21 | CVE-2006-1547 | Apache · Struts 1 | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | 7.5 High | 2022-07-21 | unknown |
| 2022-01-18 | CVE-2021-40870 | Aviatrix · Aviatrix Controller | Aviatrix Controller Unrestricted Upload of File | 9.8 Critical | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-33766 | Microsoft · Exchange Server | Microsoft Exchange Server Information Disclosure | 7.3 High | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-32648 | October CMS · October CMS | October CMS Improper Authentication | 8.2 High | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-25298 | Nagios · Nagios XI | Nagios XI OS Command Injection | 8.8 High | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-25297 | Nagios · Nagios XI | Nagios XI OS Command Injection | 8.8 High | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-25296 | Nagios · Nagios XI | Nagios XI OS Command Injection | 8.8 High | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-22991 | F5 · BIG-IP Traffic Management Microkernel | F5 BIG-IP Traffic Management Microkernel Buffer Overflow | 9.8 Critical | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2021-21975 | VMware · vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | 9.8 Critical | 2022-02-01 | known |
| 2022-01-18 | CVE-2021-21315 | Npm package · System Information Library for Node.JS | System Information Library for Node.JS Command Injection | 7.1 High | 2022-02-01 | unknown |
| 2022-01-18 | CVE-2020-14864 | Oracle · Intelligence Enterprise Edition | Oracle Business Intelligence Enterprise Edition Path Transversal | 7.5 High | 2022-07-18 | unknown |
| 2022-01-18 | CVE-2020-13927 | Apache · Airflow's Experimental API | Apache Airflow's Experimental API Authentication Bypass | 9.8 Critical | 2022-07-18 | unknown |
| 2022-01-18 | CVE-2020-13671 | Drupal · Drupal core | Drupal core Un-restricted Upload of File | 8.8 High | 2022-07-18 | unknown |
| 2022-01-18 | CVE-2020-11978 | Apache · Airflow | Apache Airflow Command Injection | 8.8 High | 2022-07-18 | unknown |
| 2022-01-10 | CVE-2021-36260 | Hikvision · Security cameras web server | Hikvision Improper Input Validation | 9.8 Critical | 2022-01-24 | unknown |
| 2022-01-10 | CVE-2021-27860 | FatPipe · WARP, IPVPN, and MPVPN software | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | 9.8 Critical | 2022-01-24 | unknown |
| 2022-01-10 | CVE-2021-22017 | VMware · vCenter Server | VMware vCenter Server Improper Access Control | 5.3 Medium | 2022-01-24 | unknown |
| 2022-01-10 | CVE-2020-6572 | Google · Chrome Media | Google Chrome Media Use-After-Free Vulnerability | 8.8 High | 2022-07-10 | unknown |
| 2022-01-10 | CVE-2019-9670 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | 9.8 Critical | 2022-07-10 | unknown |
| 2022-01-10 | CVE-2019-7609 | Elastic · Kibana | Kibana Arbitrary Code Execution | 9.8 Critical | 2022-07-10 | unknown |
| 2022-01-10 | CVE-2019-2725 | Oracle · WebLogic Server | Oracle WebLogic Server, Injection | 7.5 High | 2022-07-10 | known |
| 2022-01-10 | CVE-2019-1579 | Palo Alto Networks · PAN-OS | Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | 8.1 High | 2022-07-10 | known |
| 2022-01-10 | CVE-2019-1458 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-07-10 | known |
| 2022-01-10 | CVE-2019-10149 | Exim · Mail Transfer Agent (MTA) | Exim Mail Transfer Agent (MTA) Improper Input Validation | 9.0 Critical | 2022-07-10 | unknown |
| 2022-01-10 | CVE-2018-13383 | Fortinet · FortiOS and FortiProxy | Fortinet FortiOS and FortiProxy Out-of-bounds Write | 4.3 Medium | 2022-07-10 | known |
| 2022-01-10 | CVE-2018-13382 | Fortinet · FortiOS and FortiProxy | Fortinet FortiOS and FortiProxy Improper Authorization | 9.1 Critical | 2022-07-10 | known |
| 2022-01-10 | CVE-2017-1000486 | Primetek · Primefaces Application | Primetek Primefaces Remote Code Execution Vulnerability | 9.8 Critical | 2022-07-10 | unknown |
| 2022-01-10 | CVE-2015-7450 | IBM · WebSphere Application Server and Server Hypervisor Edition | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. | 9.8 Critical | 2022-07-10 | unknown |
| 2022-01-10 | CVE-2013-3900 | Microsoft · WinVerifyTrust function | Microsoft WinVerifyTrust function Remote Code Execution | 5.5 Medium | 2022-07-10 | unknown |
| 2021-12-15 | CVE-2021-43890 | Microsoft · Windows | Microsoft Windows AppX Installer Spoofing Vulnerability | 7.1 High | 2021-12-29 | known |
| 2021-12-15 | CVE-2021-4102 | Google · Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | 8.8 High | 2021-12-29 | unknown |
| 2021-12-10 | CVE-2021-44515 | Zoho · Desktop Central | Zoho Desktop Central Authentication Bypass Vulnerability | 9.8 Critical | 2021-12-24 | unknown |
| 2021-12-10 | CVE-2021-44228 | Apache · Log4j2 | Apache Log4j2 Remote Code Execution Vulnerability | 10.0 Critical | 2021-12-24 | known |
| 2021-12-10 | CVE-2021-44168 | Fortinet · FortiOS | Fortinet FortiOS Arbitrary File Download | 3.3 Low | 2021-12-24 | unknown |
| 2021-12-10 | CVE-2021-35394 | Realtek · Jungle Software Development Kit (SDK) | Realtek Jungle SDK Remote Code Execution Vulnerability | 9.8 Critical | 2021-12-24 | unknown |
| 2021-12-10 | CVE-2020-8816 | Pi-hole · AdminLTE | Pi-Hole AdminLTE Remote Code Execution Vulnerability | 9.1 Critical | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2020-17463 | Fuel CMS · Fuel CMS | Fuel CMS SQL Injection Vulnerability | 9.8 Critical | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2019-7238 | Sonatype · Nexus Repository Manager | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | 9.8 Critical | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2019-13272 | Linux · Kernel | Linux Kernel Improper Privilege Management Vulnerability | 7.8 High | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2019-10758 | MongoDB · mongo-express | MongoDB mongo-express Remote Code Execution Vulnerability | 9.9 Critical | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2019-0193 | Apache · Solr | Apache Solr DataImportHandler Code Injection Vulnerability | 7.2 High | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2017-17562 | Embedthis · GoAhead | Embedthis GoAhead Remote Code Execution Vulnerability | 8.1 High | 2022-06-10 | unknown |
| 2021-12-10 | CVE-2017-12149 | Red Hat · JBoss Application Server | Red Hat JBoss Application Server Remote Code Execution Vulnerability | 9.8 Critical | 2022-06-10 | known |
| 2021-12-10 | CVE-2010-1871 | Red Hat · JBoss Seam 2 | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability | 8.8 High | 2022-06-10 | unknown |
| 2021-12-01 | CVE-2021-44077 | Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | 9.8 Critical | 2021-12-15 | unknown |
| 2021-12-01 | CVE-2021-40438 | Apache · Apache | Apache HTTP Server-Side Request Forgery (SSRF) | 9.0 Critical | 2021-12-15 | known |
| 2021-12-01 | CVE-2021-37415 | Zoho · ManageEngine ServiceDesk Plus (SDP) | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | 9.8 Critical | 2021-12-15 | unknown |
| 2021-12-01 | CVE-2020-11261 | Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | 7.8 High | 2022-06-01 | unknown |
| 2021-12-01 | CVE-2018-14847 | MikroTik · RouterOS | MikroTik Router OS Directory Traversal Vulnerability | 9.1 Critical | 2022-06-01 | unknown |
| 2021-11-17 | CVE-2021-42321 | Microsoft · Exchange | Microsoft Exchange Server Remote Code Execution Vulnerability | 8.8 High | 2021-12-01 | known |
| 2021-11-17 | CVE-2021-42292 | Microsoft · Office | Microsoft Excel Security Feature Bypass | 7.8 High | 2021-12-01 | unknown |
| 2021-11-17 | CVE-2021-40449 | Microsoft · Windows | Microsoft Windows Win32k Privilege Escalation Vulnerability | 7.8 High | 2021-12-01 | known |
| 2021-11-17 | CVE-2021-22204 | Perl · Exiftool | ExifTool Remote Code Execution Vulnerability | 6.8 Medium | 2021-12-01 | unknown |
| 2021-11-03 | CVE-2021-42258 | BQE · BillQuick Web Suite | BQE BillQuick Web Suite SQL Injection Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-42013 | Apache · HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-41773 | Apache · HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 7.5 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-40539 | Zoho · ManageEngine | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-40444 | Microsoft · MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | 8.8 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-38649 | Microsoft · Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | 7.0 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-38648 | Microsoft · Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-38647 | Microsoft · Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | known |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.