Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2023-07-31 | CVE-2023-35081 | Ivanti · Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | 7.2 High | 2023-08-21 | unknown |
| 2023-07-27 | CVE-2023-37580 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2023-08-17 | unknown |
| 2023-07-26 | CVE-2023-38606 | Apple · Multiple Products | Apple Multiple Products Kernel Unspecified Vulnerability | 5.5 Medium | 2023-08-16 | unknown |
| 2023-07-25 | CVE-2023-35078 | Ivanti · Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | 10.0 Critical | 2023-08-15 | known |
| 2023-07-20 | CVE-2023-38205 | Adobe · ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 7.5 High | 2023-08-10 | unknown |
| 2023-07-20 | CVE-2023-29298 | Adobe · ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 7.5 High | 2023-08-10 | unknown |
| 2023-07-19 | CVE-2023-3519 | Citrix · NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | 9.8 Critical | 2023-08-09 | known |
| 2023-07-17 | CVE-2023-36884 | Microsoft · Windows | Microsoft Windows Search Remote Code Execution Vulnerability | 7.5 High | 2023-08-29 | known |
| 2023-07-13 | CVE-2023-37450 | Apple · Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | 8.8 High | 2023-08-03 | unknown |
| 2023-07-13 | CVE-2022-29303 | SolarView · Compact | SolarView Compact Command Injection Vulnerability | 9.8 Critical | 2023-08-03 | unknown |
| 2023-07-11 | CVE-2023-36874 | Microsoft · Windows | Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability | 7.8 High | 2023-08-01 | unknown |
| 2023-07-11 | CVE-2023-35311 | Microsoft · Outlook | Microsoft Outlook Security Feature Bypass Vulnerability | 8.8 High | 2023-08-01 | unknown |
| 2023-07-11 | CVE-2023-32049 | Microsoft · Windows | Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability | 8.8 High | 2023-08-01 | unknown |
| 2023-07-11 | CVE-2023-32046 | Microsoft · Windows | Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability | 7.8 High | 2023-08-01 | unknown |
| 2023-07-11 | CVE-2022-31199 | Netwrix · Auditor | Netwrix Auditor Insecure Object Deserialization Vulnerability | 9.8 Critical | 2023-08-01 | known |
| 2023-07-07 | CVE-2021-29256 | Arm · Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 8.8 High | 2023-07-28 | unknown |
| 2023-06-29 | CVE-2021-25489 | Samsung · Mobile Devices | Samsung Mobile Devices Improper Input Validation Vulnerability | 3.3 Low | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2021-25487 | Samsung · Mobile Devices | Samsung Mobile Devices Out-of-Bounds Read Vulnerability | 7.3 High | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2021-25395 | Samsung · Mobile Devices | Samsung Mobile Devices Race Condition Vulnerability | 6.4 Medium | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2021-25394 | Samsung · Mobile Devices | Samsung Mobile Devices Race Condition Vulnerability | 6.4 Medium | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2021-25372 | Samsung · Mobile Devices | Samsung Mobile Devices Improper Boundary Check Vulnerability | 6.1 Medium | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2021-25371 | Samsung · Mobile Devices | Samsung Mobile Devices Unspecified Vulnerability | 6.1 Medium | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2019-20500 | D-Link · DWL-2600AP Access Point | D-Link DWL-2600AP Access Point Command Injection Vulnerability | 7.8 High | 2023-07-20 | unknown |
| 2023-06-29 | CVE-2019-17621 | D-Link · DIR-859 Router | D-Link DIR-859 Router Command Execution Vulnerability | 9.8 Critical | 2023-07-20 | unknown |
| 2023-06-23 | CVE-2023-32439 | Apple · Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 8.8 High | 2023-07-14 | unknown |
| 2023-06-23 | CVE-2023-32435 | Apple · Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 8.8 High | 2023-07-14 | unknown |
| 2023-06-23 | CVE-2023-32434 | Apple · Multiple Products | Apple Multiple Products Integer Overflow Vulnerability | 7.8 High | 2023-07-14 | unknown |
| 2023-06-23 | CVE-2023-27992 | Zyxel · Multiple Network-Attached Storage (NAS) Devices | Zyxel Multiple NAS Devices Command Injection Vulnerability | 9.8 Critical | 2023-07-14 | unknown |
| 2023-06-23 | CVE-2023-20867 | VMware · Tools | VMware Tools Authentication Bypass Vulnerability | 3.9 Low | 2023-07-14 | unknown |
| 2023-06-22 | CVE-2023-20887 | VMware · Aria Operations for Networks | Vmware Aria Operations for Networks Command Injection Vulnerability | 9.8 Critical | 2023-07-13 | unknown |
| 2023-06-22 | CVE-2021-44026 | Roundcube · Roundcube Webmail | Roundcube Webmail SQL Injection Vulnerability | 9.8 Critical | 2023-07-13 | unknown |
| 2023-06-22 | CVE-2020-35730 | Roundcube · Roundcube Webmail | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2023-07-13 | unknown |
| 2023-06-22 | CVE-2020-12641 | Roundcube · Roundcube Webmail | Roundcube Webmail Remote Code Execution Vulnerability | 9.8 Critical | 2023-07-13 | unknown |
| 2023-06-22 | CVE-2016-9079 | Mozilla · Firefox, Firefox ESR, and Thunderbird | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability | 7.5 High | 2023-07-13 | unknown |
| 2023-06-22 | CVE-2016-0165 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 High | 2023-07-13 | unknown |
| 2023-06-13 | CVE-2023-27997 | Fortinet · FortiOS and FortiProxy SSL-VPN | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | 9.2 Critical | 2023-07-04 | known |
| 2023-06-07 | CVE-2023-3079 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2023-06-28 | unknown |
| 2023-06-05 | CVE-2023-33010 | Zyxel · Multiple Firewalls | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | 9.8 Critical | 2023-06-26 | unknown |
| 2023-06-05 | CVE-2023-33009 | Zyxel · Multiple Firewalls | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | 9.8 Critical | 2023-06-26 | unknown |
| 2023-06-02 | CVE-2023-34362 | Progress · MOVEit Transfer | Progress MOVEit Transfer SQL Injection Vulnerability | 9.8 Critical | 2023-06-23 | known |
| 2023-05-31 | CVE-2023-28771 | Zyxel · Multiple Firewalls | Zyxel Multiple Firewalls OS Command Injection Vulnerability | 9.8 Critical | 2023-06-21 | unknown |
| 2023-05-26 | CVE-2023-2868 | Barracuda Networks · Email Security Gateway (ESG) Appliance | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | 9.4 Critical | 2023-06-16 | unknown |
| 2023-05-22 | CVE-2023-32409 | Apple · Multiple Products | Apple Multiple Products WebKit Sandbox Escape Vulnerability | 8.6 High | 2023-06-12 | unknown |
| 2023-05-22 | CVE-2023-32373 | Apple · Multiple Products | Apple Multiple Products WebKit Use-After-Free Vulnerability | 8.8 High | 2023-06-12 | unknown |
| 2023-05-22 | CVE-2023-28204 | Apple · Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | 6.5 Medium | 2023-06-12 | unknown |
| 2023-05-19 | CVE-2023-21492 | Samsung · Mobile Devices | Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability | 4.4 Medium | 2023-06-09 | unknown |
| 2023-05-19 | CVE-2016-6415 | Cisco · IOS, IOS XR, and IOS XE | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | 7.5 High | 2023-06-09 | unknown |
| 2023-05-19 | CVE-2004-1464 | Cisco · IOS | Cisco IOS Denial-of-Service Vulnerability | 5.9 Medium | 2023-06-09 | unknown |
| 2023-05-12 | CVE-2023-25717 | Ruckus Wireless · Multiple Products | Multiple Ruckus Wireless Products CSRF and RCE Vulnerability | 9.8 Critical | 2023-06-02 | unknown |
| 2023-05-12 | CVE-2021-3560 | Red Hat · Polkit | Red Hat Polkit Incorrect Authorization Vulnerability | 7.8 High | 2023-06-02 | unknown |
| 2023-05-12 | CVE-2016-8735 | Apache · Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 9.8 Critical | 2023-06-02 | unknown |
| 2023-05-12 | CVE-2016-3427 | Oracle · Java SE and JRockit | Oracle Java SE and JRockit Unspecified Vulnerability | 9.8 Critical | 2023-06-02 | unknown |
| 2023-05-12 | CVE-2015-5317 | Jenkins · Jenkins User Interface (UI) | Jenkins User Interface (UI) Information Disclosure Vulnerability | 7.5 High | 2023-06-02 | unknown |
| 2023-05-12 | CVE-2014-0196 | Linux · Kernel | Linux Kernel Race Condition Vulnerability | 5.5 Medium | 2023-06-02 | unknown |
| 2023-05-12 | CVE-2010-3904 | Linux · Kernel | Linux Kernel Improper Input Validation Vulnerability | 7.8 High | 2023-06-02 | unknown |
| 2023-05-09 | CVE-2023-29336 | Microsoft · Win32k | Microsoft Win32K Privilege Escalation Vulnerability | 7.8 High | 2023-05-30 | unknown |
| 2023-05-01 | CVE-2023-21839 | Oracle · WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 7.5 High | 2023-05-22 | unknown |
| 2023-05-01 | CVE-2023-1389 | TP-Link · Archer AX21 | TP-Link Archer AX-21 Command Injection Vulnerability | 8.8 High | 2023-05-22 | unknown |
| 2023-05-01 | CVE-2021-45046 | Apache · Log4j2 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | 9.0 Critical | 2023-05-22 | known |
| 2023-04-21 | CVE-2023-28432 | MinIO · MinIO | MinIO Information Disclosure Vulnerability | 7.5 High | 2023-05-12 | unknown |
| 2023-04-21 | CVE-2023-27350 | PaperCut · MF/NG | PaperCut MF/NG Improper Access Control Vulnerability | 9.8 Critical | 2023-05-12 | known |
| 2023-04-21 | CVE-2023-2136 | Google · Chromium Skia | Google Chrome Skia Integer Overflow Vulnerability | 9.6 Critical | 2023-05-12 | unknown |
| 2023-04-19 | CVE-2017-6742 | Cisco · IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 8.8 High | 2023-05-10 | unknown |
| 2023-04-17 | CVE-2023-2033 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2023-05-08 | unknown |
| 2023-04-17 | CVE-2019-8526 | Apple · macOS | Apple macOS Use-After-Free Vulnerability | 7.8 High | 2023-05-08 | unknown |
| 2023-04-13 | CVE-2023-29492 | Novi Survey · Novi Survey | Novi Survey Insecure Deserialization Vulnerability | 9.8 Critical | 2023-05-04 | unknown |
| 2023-04-13 | CVE-2023-20963 | Android · Framework | Android Framework Privilege Escalation Vulnerability | 7.8 High | 2023-05-04 | unknown |
| 2023-04-11 | CVE-2023-28252 | Microsoft · Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | 7.8 High | 2023-05-02 | known |
| 2023-04-10 | CVE-2023-28206 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability | 8.6 High | 2023-05-01 | unknown |
| 2023-04-10 | CVE-2023-28205 | Apple · Multiple Products | Apple Multiple Products WebKit Use-After-Free Vulnerability | 8.8 High | 2023-05-01 | unknown |
| 2023-04-07 | CVE-2023-26083 | Arm · Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Information Disclosure Vulnerability | 3.3 Low | 2023-04-28 | unknown |
| 2023-04-07 | CVE-2021-27878 | Veritas · Backup Exec Agent | Veritas Backup Exec Agent Command Execution Vulnerability | 8.8 High | 2023-04-28 | known |
| 2023-04-07 | CVE-2021-27877 | Veritas · Backup Exec Agent | Veritas Backup Exec Agent Improper Authentication Vulnerability | 8.2 High | 2023-04-28 | known |
| 2023-04-07 | CVE-2021-27876 | Veritas · Backup Exec Agent | Veritas Backup Exec Agent File Access Vulnerability | 8.1 High | 2023-04-28 | known |
| 2023-04-07 | CVE-2019-1388 | Microsoft · Windows | Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability | 7.8 High | 2023-04-28 | known |
| 2023-04-03 | CVE-2022-27926 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2023-04-24 | unknown |
| 2023-03-30 | CVE-2023-0266 | Linux · Kernel | Linux Kernel Use-After-Free Vulnerability | 7.9 High | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2022-42948 | Fortra · Cobalt Strike | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | 9.8 Critical | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2022-39197 | Fortra · Cobalt Strike | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2022-38181 | Arm · Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 8.8 High | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2022-3038 | Google · Chromium Network Service | Google Chromium Network Service Use-After-Free Vulnerability | 8.8 High | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2022-22706 | Arm · Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Unspecified Vulnerability | 7.8 High | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2021-30900 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | 7.8 High | 2023-04-20 | unknown |
| 2023-03-30 | CVE-2017-7494 | Samba · Samba | Samba Remote Code Execution Vulnerability | 9.8 Critical | 2023-04-20 | known |
| 2023-03-30 | CVE-2013-3163 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 8.8 High | 2023-04-20 | unknown |
| 2023-03-15 | CVE-2023-26360 | Adobe · ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 8.6 High | 2023-04-05 | unknown |
| 2023-03-14 | CVE-2023-24880 | Microsoft · Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 4.4 Medium | 2023-04-04 | known |
| 2023-03-14 | CVE-2023-23397 | Microsoft · Office | Microsoft Office Outlook Privilege Escalation Vulnerability | 9.8 Critical | 2023-04-04 | unknown |
| 2023-03-14 | CVE-2022-41328 | Fortinet · FortiOS | Fortinet FortiOS Path Traversal Vulnerability | 6.5 Medium | 2023-04-04 | unknown |
| 2023-03-10 | CVE-2021-39144 | XStream · XStream | XStream Remote Code Execution Vulnerability | 8.5 High | 2023-03-31 | unknown |
| 2023-03-10 | CVE-2020-5741 | Plex · Media Server | Plex Media Server Remote Code Execution Vulnerability | 7.2 High | 2023-03-31 | unknown |
| 2023-03-07 | CVE-2022-35914 | Teclib · GLPI | Teclib GLPI Remote Code Execution Vulnerability | 9.8 Critical | 2023-03-28 | unknown |
| 2023-03-07 | CVE-2022-33891 | Apache · Spark | Apache Spark Command Injection Vulnerability | 8.8 High | 2023-03-28 | unknown |
| 2023-03-07 | CVE-2022-28810 | Zoho · ManageEngine | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | 6.8 Medium | 2023-03-28 | unknown |
| 2023-02-27 | CVE-2022-36537 | ZK Framework · AuUploader | ZK Framework AuUploader Unspecified Vulnerability | 7.5 High | 2023-03-20 | known |
| 2023-02-21 | CVE-2022-47986 | IBM · Aspera Faspex | IBM Aspera Faspex Code Execution Vulnerability | 9.8 Critical | 2023-03-14 | known |
| 2023-02-21 | CVE-2022-41223 | Mitel · MiVoice Connect | Mitel MiVoice Connect Code Injection Vulnerability | 6.8 Medium | 2023-03-14 | known |
| 2023-02-21 | CVE-2022-40765 | Mitel · MiVoice Connect | Mitel MiVoice Connect Command Injection Vulnerability | 6.8 Medium | 2023-03-14 | known |
| 2023-02-16 | CVE-2022-46169 | Cacti · Cacti | Cacti Command Injection Vulnerability | 9.8 Critical | 2023-03-09 | unknown |
| 2023-02-14 | CVE-2023-23529 | Apple · Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 8.8 High | 2023-03-07 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.