Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2021-11-03 | CVE-2021-38645 | Microsoft · Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-38003 | Google · Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-38000 | Google · Chromium Intents | Google Chromium Intents Improper Input Validation Vulnerability | 6.1 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-37976 | Google · Chromium | Google Chromium Information Disclosure Vulnerability | 6.5 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-37975 | Google · Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-37973 | Google · Chromium Portals | Google Chromium Portals Use-After-Free Vulnerability | 9.6 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-36955 | Microsoft · Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-36948 | Microsoft · Windows | Microsoft Windows Update Medic Service Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-36942 | Microsoft · Windows | Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability | 7.5 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-36742 | Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security | Trend Micro Multiple Products Improper Input Validation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-36741 | Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security | Trend Micro Multiple Products Improper Input Validation Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-35464 | ForgeRock · Access Management (AM) | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-35395 | Realtek · AP-Router SDK | Realtek AP-Router SDK Buffer Overflow Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-35211 | SolarWinds · Serv-U | SolarWinds Serv-U Remote Code Execution Vulnerability | 9.0 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-34527 | Microsoft · Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2021-34523 | Microsoft · Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | 9.0 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-34473 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 9.1 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-34448 | Microsoft · Windows | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | 6.8 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-33771 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-33742 | Microsoft · Windows | Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability | 7.5 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-33739 | Microsoft · Windows | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | 8.4 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-31979 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-31956 | Microsoft · Windows | Microsoft Windows NTFS Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-31955 | Microsoft · Windows | Microsoft Windows Kernel Information Disclosure Vulnerability | 5.5 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-31755 | Tenda · AC11 Router | Tenda AC11 Router Stack Buffer Overflow Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-31207 | Microsoft · Exchange Server | Microsoft Exchange Server Security Feature Bypass Vulnerability | 6.6 Medium | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-31201 | Microsoft · Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability | 5.2 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-31199 | Microsoft · Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability | 5.2 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30869 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Type Confusion Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30860 | Apple · Multiple Products | Apple Multiple Products Integer Overflow Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30858 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, macOS Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30807 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30762 | Apple · iOS | Apple iOS WebKit Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30761 | Apple · iOS | Apple iOS WebKit Memory Corruption Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30713 | Apple · macOS | Apple macOS Unspecified Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30666 | Apple · iOS | Apple iOS WebKit Buffer Overflow Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30665 | Apple · Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30663 | Apple · Multiple Products | Apple Multiple Products WebKit Integer Overflow Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30661 | Apple · Multiple Products | Apple Multiple Products WebKit Storage Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30657 | Apple · macOS | Apple macOS Unspecified Vulnerability | 5.5 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30633 | Google · Chromium Indexed DB API | Google Chromium Indexed DB API Use-After-Free Vulnerability | 9.6 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30632 | Google · Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30563 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30554 | Google · Chromium WebGL | Google Chromium WebGL Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30551 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-30116 | Kaseya · Virtual System/Server Administrator (VSA) | Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability | 10.0 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-28664 | Arm · Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-28663 | Arm · Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-28550 | Adobe · Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 9.6 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-28310 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-27562 | Arm · Trusted Firmware | Arm Trusted Firmware Out-of-Bounds Write Vulnerability | 5.5 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-27561 | Yealink · Device Management | Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-27104 | Accellion · FTA | Accellion FTA OS Command Injection Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-27103 | Accellion · FTA | Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-27102 | Accellion · FTA | Accellion FTA OS Command Injection Vulnerability | 7.8 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-27101 | Accellion · FTA | Accellion FTA SQL Injection Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-27085 | Microsoft · Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-27065 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2021-27059 | Microsoft · Office | Microsoft Office Remote Code Execution Vulnerability | 7.6 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-26858 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2021-26857 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2021-26855 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 9.1 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2021-26411 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 8.8 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-26084 | Atlassian · Confluence Server and Data Center | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-23874 | McAfee · McAfee Total Protection (MTP) | McAfee Total Protection (MTP) Improper Privilege Management Vulnerability | 8.2 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-22986 | F5 · BIG-IP and BIG-IQ Centralized Management | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-22900 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | 7.2 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2021-22899 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Command Injection Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2021-22894 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2021-22893 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | 10.0 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2021-22506 | Micro Focus · Micro Focus Access Manager | Micro Focus Access Manager Information Leakage Vulnerability | 7.5 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-22502 | Micro Focus · Operation Bridge Reporter (OBR) | Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-22205 | GitLab · Community and Enterprise Editions | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | 10.0 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-22005 | VMware · vCenter Server | VMware vCenter Server File Upload Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-21985 | VMware · vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-21972 | VMware · vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-21224 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-21220 | Google · Chromium V8 | Google Chromium V8 Improper Input Validation Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-21206 | Google · Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-21193 | Google · Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-21166 | Google · Chromium | Google Chromium Race Condition Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-21148 | Google · Chromium V8 | Google Chromium V8 Heap Buffer Overflow Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-21017 | Adobe · Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | 8.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-20090 | Arcadyan · Buffalo Firmware | Arcadyan Buffalo Firmware Path Traversal Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-20023 | SonicWall · SonicWall Email Security | SonicWall Email Security Path Traversal Vulnerability | 4.9 Medium | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-20022 | SonicWall · SonicWall Email Security | SonicWall Email Security Unrestricted Upload of File Vulnerability | 7.2 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-20021 | SonicWall · SonicWall Email Security | SonicWall Email Security Improper Privilege Management Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-20016 | SonicWall · SSLVPN SMA100 | SonicWall SSLVPN SMA100 SQL Injection Vulnerability | 9.8 Critical | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-1906 | Qualcomm · Multiple Chipsets | Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability | 6.2 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1905 | Qualcomm · Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 8.4 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2021-1879 | Apple · iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1871 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1870 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1782 | Apple · Multiple Products | Apple Multiple Products Race Condition Vulnerability | 7.0 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1732 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-1675 | Microsoft · Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | 7.8 High | 2021-11-17 | known |
| 2021-11-03 | CVE-2021-1647 | Microsoft · Defender | Microsoft Defender Remote Code Execution Vulnerability | 7.8 High | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1498 | Cisco · HyperFlex HX | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2021-1497 | Cisco · HyperFlex HX | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | 9.8 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2020-9859 | Apple · Multiple Products | Apple Multiple Products Code Execution Vulnerability | 7.8 High | 2022-05-03 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.