Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2021-11-03 | CVE-2019-3398 | Atlassian · Confluence Server and Data Center | Atlassian Confluence Server and Data Center Path Traversal Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-3396 | Atlassian · Confluence Server and Data Server | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-2215 | Android · Android Kernel | Android Kernel Use-After-Free Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-20085 | TVT · NVMS-1000 | TVT NVMS-1000 Directory Traversal Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-19781 | Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-19356 | Netis · WF2419 Devices | Netis WF2419 Devices Remote Code Execution Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-18988 | TeamViewer · Desktop | TeamViewer Desktop Bypass Remote Login Vulnerability | 7.0 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-18935 | Progress · Telerik UI for ASP.NET AJAX | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-18187 | Trend Micro · OfficeScan | Trend Micro OfficeScan Directory Traversal Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-17558 | Apache · Solr | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-17026 | Mozilla · Firefox and Thunderbird | Mozilla Firefox And Thunderbird Type Confusion Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-16759 | vBulletin · vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-1653 | Cisco · Small Business RV320 and RV325 Routers | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-16256 | SIMalliance · Toolbox Browser | SIMalliance Toolbox Browser Command Injection Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-15949 | Nagios · Nagios XI | Nagios XI Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-15752 | Docker · Desktop Community Edition | Docker Desktop Community Edition Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-1429 | Microsoft · Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-1367 | Microsoft · Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-13608 | Citrix · StoreFront Server | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | 7.5 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-1215 | Microsoft · Windows | Microsoft Windows Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-1214 | Microsoft · Windows | Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-11634 | Citrix · Workspace Application and Receiver for Windows | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-11580 | Atlassian · Crowd and Crowd Data Center | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-11539 | Ivanti · Pulse Connect Secure and Pulse Policy Secure | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability | 8.0 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-11510 | Ivanti · Pulse Connect Secure | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | 9.9 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-0863 | Microsoft · Windows | Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-0859 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-0808 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-0803 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-0797 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-0708 | Microsoft · Remote Desktop Services | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-0604 | Microsoft · SharePoint | Microsoft SharePoint Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2019-0541 | Microsoft · MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2019-0211 | Apache · HTTP Server | Apache HTTP Server Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-8653 | Microsoft · Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-7600 | Drupal · Drupal Core | Drupal Core Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2018-6789 | Exim · Exim | Exim Buffer Overflow Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2018-4939 | Adobe · ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-4878 | Adobe · Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2018-2380 | SAP · Customer Relationship Management (CRM) | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | 6.6 Medium | 2022-05-03 | known |
| 2021-11-03 | CVE-2018-20062 | ThinkPHP · noneCms | ThinkPHP "noneCms" Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-18325 | DotNetNuke (DNN) · DotNetNuke (DNN) | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-15961 | Adobe · ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-15811 | DotNetNuke (DNN) · DotNetNuke (DNN) | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-14558 | Tenda · AC7, AC9, and AC10 Routers | Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-13379 | Fortinet · FortiOS | Fortinet FortiOS SSL VPN Path Traversal Vulnerability | 9.1 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2018-11776 | Apache · Struts | Apache Struts Remote Code Execution Vulnerability | 8.1 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-0802 | Microsoft · Office | Microsoft Office Memory Corruption Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2018-0798 | Microsoft · Office | Microsoft Office Memory Corruption Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-0296 | Cisco · Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2018-0171 | Cisco · IOS and IOS XE | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-9822 | DotNetNuke (DNN) · DotNetNuke (DNN) | DotNetNuke (DNN) Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2017-9805 | Apache · Struts | Apache Struts Deserialization of Untrusted Data Vulnerability | 8.1 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-9248 | Progress · ASP.NET AJAX and Sitefinity | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-8759 | Microsoft · .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-7269 | Microsoft · Internet Information Services (IIS) | Microsoft Windows Server Buffer Overflow Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-6327 | Symantec · Symantec Messaging Gateway | Symantec Messaging Gateway Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-5638 | Apache · Struts | Apache Struts Remote Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | known |
| 2021-11-03 | CVE-2017-16651 | Roundcube · Roundcube Webmail | Roundcube Webmail File Disclosure Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-11882 | Microsoft · Office | Microsoft Office Memory Corruption Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2017-11774 | Microsoft · Office | Microsoft Office Outlook Security Feature Bypass Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2017-0199 | Microsoft · Office and WordPad | Microsoft Office and WordPad Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2017-0143 | Microsoft · Windows | Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2016-9563 | SAP · NetWeaver | SAP NetWeaver XML External Entity (XXE) Vulnerability | 6.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-7255 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2016-4437 | Apache · Shiro | Apache Shiro Code Execution Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-3976 | SAP · NetWeaver | SAP NetWeaver Directory Traversal Vulnerability | 7.5 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-3718 | ImageMagick · ImageMagick | ImageMagick Server-Side Request Forgery (SSRF) Vulnerability | 5.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-3715 | ImageMagick · ImageMagick | ImageMagick Arbitrary File Deletion Vulnerability | 5.5 Medium | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-3643 | SolarWinds · Virtualization Manager | SolarWinds Virtualization Manager Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-3235 | Microsoft · Office | Microsoft Office OLE DLL Side Loading Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-0185 | Microsoft · Windows | Microsoft Windows Media Center Remote Code Execution Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2016-0167 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2015-4852 | Oracle · WebLogic Server | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2015-1641 | Microsoft · Office | Microsoft Office Memory Corruption Vulnerability | 7.8 High | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2014-1812 | Microsoft · Windows | Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability | 8.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2012-3152 | Oracle · Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 9.1 Critical | 2022-05-03 | unknown |
| 2021-11-03 | CVE-2012-0158 | Microsoft · MSCOMCTL.OCX | Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability | 8.8 High | 2022-05-03 | known |
| 2021-11-03 | CVE-2010-5326 | SAP · NetWeaver | SAP NetWeaver Remote Code Execution Vulnerability | 10.0 Critical | 2022-05-03 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.