Known exploited vulnerabilities
From CISA’s Known Exploited Vulnerabilities catalogue: flaws that attackers are using now, when each was added, and the date federal agencies were told to fix it by.
- In the catalogue
- 1781
- Added in the last 7 days
- 12
- Used in ransomware
- 361
The catalogue, newest first
| CVE | Vendor | Product | Name | Added | Fix due | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2019-0676 | Microsoft | Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-0703 | Microsoft | Windows | Microsoft Windows SMB Information Disclosure Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-0880 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-1130 | Microsoft | Windows | Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability | 23 May 2022 | 13 Jun 2022 | Known |
| CVE-2019-11707 | Mozilla | Firefox and Thunderbird | Mozilla Firefox and Thunderbird Type Confusion Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-11708 | Mozilla | Firefox and Thunderbird | Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-13720 | Chrome WebAudio | Google Chrome WebAudio Use-After-Free Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown | |
| CVE-2019-1385 | Microsoft | Windows | Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability | 23 May 2022 | 13 Jun 2022 | Known |
| CVE-2019-18426 | Meta Platforms | WhatsApp Cross-Site Scripting Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown | |
| CVE-2019-5786 | Chrome Blink | Google Chrome Blink Use-After-Free Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown | |
| CVE-2019-7286 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-7287 | Apple | iOS | Apple iOS Memory Corruption Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2019-8720 | WebKitGTK | WebKitGTK | WebKitGTK Memory Corruption Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2020-0638 | Microsoft | Update Notification Manager | Microsoft Update Notification Manager Privilege Escalation Vulnerability | 23 May 2022 | 13 Jun 2022 | Known |
| CVE-2020-1027 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2021-0920 | Android | Kernel | Android Kernel Race Condition Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2021-1048 | Android | Kernel | Android Kernel Use-After-Free Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2021-30883 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2022-20821 | Cisco | IOS XR | Cisco IOS XR Open Port Vulnerability | 23 May 2022 | 13 Jun 2022 | Unknown |
| CVE-2022-22947 | VMware | Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | 16 May 2022 | 6 Jun 2022 | Unknown |
| CVE-2022-30525 | Zyxel | Multiple Firewalls | Zyxel Multiple Firewalls OS Command Injection Vulnerability | 16 May 2022 | 6 Jun 2022 | Unknown |
| CVE-2022-1388 | F5 | BIG-IP | F5 BIG-IP Missing Authentication Vulnerability | 10 May 2022 | 31 May 2022 | Known |
| CVE-2014-0160 | OpenSSL | OpenSSL | OpenSSL Information Disclosure Vulnerability | 4 May 2022 | 25 May 2022 | Unknown |
| CVE-2014-0322 | Microsoft | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 4 May 2022 | 25 May 2022 | Unknown |
| CVE-2014-4113 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 4 May 2022 | 25 May 2022 | Unknown |
| CVE-2019-8506 | Apple | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 4 May 2022 | 25 May 2022 | Unknown |
| CVE-2021-1789 | Apple | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 4 May 2022 | 25 May 2022 | Unknown |
| CVE-2019-1003029 | Jenkins | Script Security Plugin | Jenkins Script Security Plugin Sandbox Bypass Vulnerability | 25 Apr 2022 | 16 May 2022 | Unknown |
| CVE-2021-40450 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 25 Apr 2022 | 16 May 2022 | Unknown |
| CVE-2021-41357 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 25 Apr 2022 | 16 May 2022 | Unknown |
| CVE-2022-0847 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 25 Apr 2022 | 16 May 2022 | Unknown |
| CVE-2022-21919 | Microsoft | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 25 Apr 2022 | 16 May 2022 | Unknown |
| CVE-2022-26904 | Microsoft | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 25 Apr 2022 | 16 May 2022 | Unknown |
| CVE-2022-29464 | WSO2 | Multiple Products | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | 25 Apr 2022 | 16 May 2022 | Known |
| CVE-2018-6882 | Synacor | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 19 Apr 2022 | 10 May 2022 | Known |
| CVE-2019-3568 | Meta Platforms | WhatsApp VOIP Stack Buffer Overflow Vulnerability | 19 Apr 2022 | 10 May 2022 | Unknown | |
| CVE-2022-22718 | Microsoft | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 19 Apr 2022 | 10 May 2022 | Unknown |
| CVE-2007-3010 | Alcatel | OmniPCX Enterprise | Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2010-5330 | Ubiquiti | AirOS | Ubiquiti AirOS Command Injection Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2014-0780 | InduSoft | Web Studio | InduSoft Web Studio NTWebServer Directory Traversal Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2016-4523 | Trihedral | VTScada (formerly VTS) | Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2018-7841 | Schneider Electric | U.motion Builder | Schneider Electric U.motion Builder SQL Injection Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2019-16057 | D-Link | DNS-320 Storage Device | D-Link DNS-320 Remote Code Execution Vulnerability | 15 Apr 2022 | 6 May 2022 | Known |
| CVE-2019-3929 | Crestron | Multiple Products | Crestron Multiple Products Command Injection Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2022-1364 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown | |
| CVE-2022-22960 | VMware | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 15 Apr 2022 | 6 May 2022 | Unknown |
| CVE-2022-22954 | VMware | Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 14 Apr 2022 | 5 May 2022 | Known |
| CVE-2014-9163 | Adobe | Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2015-0311 | Adobe | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2015-0313 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2015-2502 | Microsoft | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2015-3113 | Adobe | Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2015-5122 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2015-5123 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 13 Apr 2022 | 4 May 2022 | Unknown |
| CVE-2018-20753 | Kaseya | Virtual System/Server Administrator (VSA) | Kaseya VSA Remote Code Execution Vulnerability | 13 Apr 2022 | 4 May 2022 | Known |
| CVE-2018-7602 | Drupal | Core | Drupal Core Remote Code Execution Vulnerability | 13 Apr 2022 | 4 May 2022 | Known |
| CVE-2022-24521 | Microsoft | Windows | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | 13 Apr 2022 | 4 May 2022 | Known |
| CVE-2017-11317 | Telerik | User Interface (UI) for ASP.NET AJAX | Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability | 11 Apr 2022 | 2 May 2022 | Unknown |
| CVE-2020-2509 | QNAP | QNAP Network-Attached Storage (NAS) | QNAP Network-Attached Storage (NAS) Command Injection Vulnerability | 11 Apr 2022 | 2 May 2022 | Unknown |
| CVE-2021-22600 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 11 Apr 2022 | 2 May 2022 | Unknown |
| CVE-2021-27852 | Checkbox | Checkbox Survey | Checkbox Survey Deserialization of Untrusted Data Vulnerability | 11 Apr 2022 | 2 May 2022 | Unknown |
| CVE-2021-39793 | Pixel | Google Pixel Out-of-Bounds Write Vulnerability | 11 Apr 2022 | 2 May 2022 | Unknown | |
| CVE-2021-42278 | Microsoft | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 11 Apr 2022 | 2 May 2022 | Known |
| CVE-2021-42287 | Microsoft | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 11 Apr 2022 | 2 May 2022 | Known |
| CVE-2022-23176 | WatchGuard | Firebox and XTM | WatchGuard Firebox and XTM Privilege Escalation Vulnerability | 11 Apr 2022 | 2 May 2022 | Unknown |
| CVE-2017-0148 | Microsoft | SMBv1 server | Microsoft SMBv1 Server Remote Code Execution Vulnerability | 6 Apr 2022 | 27 Apr 2022 | Known |
| CVE-2021-31166 | Microsoft | HTTP Protocol Stack | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | 6 Apr 2022 | 27 Apr 2022 | Unknown |
| CVE-2021-3156 | Sudo | Sudo | Sudo Heap-Based Buffer Overflow Vulnerability | 6 Apr 2022 | 27 Apr 2022 | Unknown |
| CVE-2021-45382 | D-Link | Multiple Routers | D-Link Multiple Routers Remote Code Execution Vulnerability | 4 Apr 2022 | 25 Apr 2022 | Unknown |
| CVE-2022-22674 | Apple | macOS | Apple macOS Out-of-Bounds Read Vulnerability | 4 Apr 2022 | 25 Apr 2022 | Unknown |
| CVE-2022-22675 | Apple | macOS | Apple macOS Out-of-Bounds Write Vulnerability | 4 Apr 2022 | 25 Apr 2022 | Unknown |
| CVE-2022-22965 | VMware | Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 4 Apr 2022 | 25 Apr 2022 | Unknown |
| CVE-2018-10561 | Dasan | Gigabit Passive Optical Network (GPON) Routers | Dasan GPON Routers Authentication Bypass Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Unknown |
| CVE-2018-10562 | Dasan | Gigabit Passive Optical Network (GPON) Routers | Dasan GPON Routers Command Injection Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Known |
| CVE-2021-21551 | Dell | dbutil Driver | Dell dbutil Driver Insufficient Access Control Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Unknown |
| CVE-2021-28799 | QNAP | Network Attached Storage (NAS) | QNAP NAS Improper Authorization Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Known |
| CVE-2021-34484 | Microsoft | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Unknown |
| CVE-2022-1040 | Sophos | Firewall | Sophos Firewall Authentication Bypass Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Unknown |
| CVE-2022-26871 | Trend Micro | Apex Central | Trend Micro Apex Central Arbitrary File Upload Vulnerability | 31 Mar 2022 | 21 Apr 2022 | Unknown |
| CVE-2010-4398 | Microsoft | Windows | Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability | 28 Mar 2022 | 21 Apr 2022 | Unknown |
| CVE-2011-2005 | Microsoft | Ancillary Function Driver (afd.sys) | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2012-0518 | Oracle | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2012-2034 | Adobe | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2012-2539 | Microsoft | Word | Microsoft Word Remote Code Execution Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2012-5076 | Oracle | Java SE | Oracle Java SE Sandbox Bypass Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2013-1690 | Mozilla | Firefox and Thunderbird | Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2013-2465 | Oracle | Java SE | Oracle Java SE Unspecified Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2013-2551 | Microsoft | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2013-2729 | Adobe | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2013-3660 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2015-1770 | Microsoft | Office | Microsoft Office Uninitialized Memory Use Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2015-2419 | Microsoft | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2015-2426 | Microsoft | Windows | Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2016-0040 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2016-0151 | Microsoft | Client-Server Run-time Subsystem (CSRSS) | Microsoft Windows CSRSS Security Feature Bypass Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2016-0189 | Microsoft | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2016-7200 | Microsoft | Edge | Microsoft Edge Memory Corruption Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2016-7201 | Microsoft | Edge | Microsoft Edge Memory Corruption Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2017-0037 | Microsoft | Edge and Internet Explorer | Microsoft Edge and Internet Explorer Type Confusion Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2017-0059 | Microsoft | Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |