Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2021-11-03 | CVE-2020-9819 | Apple · iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability | 4.3 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-9818 | Apple · iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8657 | EyesOfNetwork · EyesOfNetwork | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8655 | EyesOfNetwork · EyesOfNetwork | EyesOfNetwork Improper Privilege Management Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8644 | PlaySMS · PlaySMS | PlaySMS Server-Side Template Injection Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8599 | Trend Micro · Apex One and OfficeScan | Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8515 | DrayTek · Multiple Vigor Routers | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8468 | Trend Micro · Apex One, OfficeScan and Worry-Free Business Security Agents | Trend Micro Multiple Products Content Validation Escape Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8467 | Trend Micro · Apex One and OfficeScan | Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8260 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | 7.2 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8243 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | 7.2 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8196 | Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 4.3 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8195 | Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 6.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-8193 | Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | 6.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-7961 | Liferay · Liferay Portal | Liferay Portal Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-6820 | Mozilla · Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 8.1 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-6819 | Mozilla · Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 8.1 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-6418 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-6287 | SAP · NetWeaver | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-6207 | SAP · Solution Manager | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-5902 | F5 · BIG-IP | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-5849 | Unraid · Unraid | Unraid Authentication Bypass Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-5847 | Unraid · Unraid | Unraid Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-5735 | Amcrest · Cameras and Network Video Recorder (NVR) | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-4430 | IBM · Data Risk Manager | IBM Data Risk Manager Directory Traversal Vulnerability | 4.3 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-4428 | IBM · Data Risk Manager | IBM Data Risk Manager Remote Code Execution Vulnerability | 9.1 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-4427 | IBM · Data Risk Manager | IBM Data Risk Manager Security Bypass Vulnerability | 9.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-4006 | VMware · Multiple Products | Multiple VMware Products Command Injection Vulnerability | 9.1 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3992 | VMware · ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-3952 | VMware · vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3950 | VMware · Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3580 | Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-3569 | Cisco · IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 8.6 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3566 | Cisco · IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 8.6 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3452 | Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3161 | Cisco · Cisco IP Phones | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-3118 | Cisco · IOS XR | Cisco IOS XR Software Discovery Protocol Format String Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-29583 | Zyxel · Multiple Products | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-29557 | D-Link · DIR-825 R1 Devices | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-27950 | Apple · Multiple Products | Apple Multiple Products Memory Initialization Vulnerability | 5.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-27932 | Apple · Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-27930 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-26919 | NETGEAR · JGS516PE Devices | Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-2555 | Oracle · Multiple Products | Oracle Multiple Products Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-25506 | D-Link · DNS-320 Device | D-Link DNS-320 Device Command Injection Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-25213 | WordPress · File Manager Plugin | WordPress File Manager Plugin Remote Code Execution Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-24557 | Trend Micro · Apex One, OfficeScan, and Worry-Free Business Security | Trend Micro Multiple Products Improper Access Control Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-17530 | Apache · Struts | Apache Struts Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-17496 | vBulletin · vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-17144 | Microsoft · Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 8.4 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-17087 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-16846 | SaltStack · Salt | SaltStack Salt Shell Injection Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-16017 | Google · Chrome | Google Chrome Use-After-Free Vulnerability | 9.6 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-16013 | Google · Chromium V8 | Google Chromium V8 Incorrect Implementation Vulnerabililty | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-16010 | Google · Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | 9.6 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-16009 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-15999 | Google · Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | 9.6 Critical | 2021-11-17 | unknown |
| 2021-11-03 | CVE-2020-15505 | Ivanti · MobileIron Multiple Products | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-14883 | Oracle · WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 7.2 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-14882 | Oracle · WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-14871 | Oracle · Solaris and Zettabyte File System (ZFS) | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-14750 | Oracle · WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1472 | Microsoft · Netlogon | Microsoft Netlogon Privilege Escalation Vulnerability | 5.5 Medium | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-1464 | Microsoft · Windows | Microsoft Windows Spoofing Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1380 | Microsoft · Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1350 | Microsoft · Windows | Microsoft Windows DNS Server Remote Code Execution Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-12812 | Fortinet · FortiOS | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | 7.5 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-12271 | Sophos · SFOS | Sophos SFOS SQL Injection Vulnerability | 10.0 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-11738 | WordPress · Snap Creek Duplicator Plugin | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-11652 | SaltStack · Salt | SaltStack Salt Path Traversal Vulnerability | 6.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-11651 | SaltStack · Salt | SaltStack Salt Authentication Bypass Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1147 | Microsoft · .NET Framework, SharePoint, Visual Studio | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-10987 | Tenda · AC1900 Router AC15 Model | Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1054 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.0 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1040 | Microsoft · Hyper-V RemoteFX | Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability | 9.0 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-10221 | rConfig · rConfig | rConfig OS Command Injection Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-1020 | Microsoft · Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-10199 | Sonatype · Nexus Repository | Sonatype Nexus Repository Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-10189 | Zoho · ManageEngine | Zoho ManageEngine Desktop Central File Upload Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-10181 | Sumavision · Enhanced Multimedia Router (EMR) | Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-10148 | SolarWinds · Orion | SolarWinds Orion Authentication Bypass Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0986 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0968 | Microsoft · Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-0938 | Microsoft · Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0878 | Microsoft · Edge and Internet Explorer | Microsoft Edge and Internet Explorer Memory Corruption Vulnerability | 4.2 Medium | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-0688 | Microsoft · Exchange Server | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2020-0683 | Microsoft · Windows | Microsoft Windows Installer Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0674 | Microsoft · Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0646 | Microsoft · .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0601 | Microsoft · Windows | Microsoft Windows CryptoAPI Spoofing Vulnerability | 8.1 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0069 | MediaTek · Multiple Chipsets | Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2020-0041 | Android · Android Kernel | Android Kernel Out-of-Bounds Write Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-9978 | WordPress · Social Warfare Plugin | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-9082 | ThinkPHP · ThinkPHP | ThinkPHP Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-8394 | Zoho · ManageEngine | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-7481 | SonicWall · SMA100 | SonicWall SMA100 SQL Injection Vulnerability | 7.5 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-6223 | Apple · iOS and macOS | Apple iOS and macOS Group Facetime Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-5591 | Fortinet · FortiOS | Fortinet FortiOS Default Configuration Vulnerability | 6.5 Medium | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-5544 | VMware · VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-4716 | IBM · Planning Analytics | IBM Planning Analytics Remote Code Execution Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.