Known exploited vulnerabilities
From CISA’s Known Exploited Vulnerabilities catalogue: flaws that attackers are using now, when each was added, and the date federal agencies were told to fix it by.
- In the catalogue
- 1781
- Added in the last 7 days
- 12
- Used in ransomware
- 361
The catalogue, newest first
| CVE | Vendor | Product | Name | Added | Fix due | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2017-0213 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2018-8405 | Microsoft | DirectX Graphics Kernel (DXGKRNL) | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2018-8406 | Microsoft | DirectX Graphics Kernel (DXGKRNL) | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2018-8440 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2019-7483 | SonicWall | SMA100 | SonicWall SMA100 Directory Traversal Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2021-20028 | SonicWall | Secure Remote Access (SRA) | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2021-26085 | Atlassian | Confluence Server | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2021-34486 | Microsoft | Windows | Microsoft Windows Event Tracing Privilege Escalation Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2021-38646 | Microsoft | Office | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Known |
| CVE-2022-0543 | Redis | Debian-specific Redis Servers | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown |
| CVE-2022-1096 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 28 Mar 2022 | 18 Apr 2022 | Unknown | |
| CVE-2005-2773 | Hewlett Packard (HP) | OpenView Network Node Manager | HP OpenView Network Node Manager Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2009-0927 | Adobe | Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2009-1151 | phpMyAdmin | phpMyAdmin | phpMyAdmin Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2009-2055 | Cisco | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2010-2861 | Adobe | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2010-3035 | Cisco | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2010-4344 | Exim | Exim | Exim Heap-Based Buffer Overflow Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2010-4345 | Exim | Exim | Exim Privilege Escalation Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2012-1823 | PHP | PHP | PHP-CGI Query String Parameter Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2013-2251 | Apache | Struts | Apache Struts Improper Input Validation Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2013-4810 | Hewlett Packard (HP) | ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management | HP Multiple Products Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2013-5223 | D-Link | DSL-2760U | D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2014-0130 | Rails | Ruby on Rails | Ruby on Rails Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2014-3120 | Elastic | Elasticsearch | Elasticsearch Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2014-6287 | Rejetto | HTTP File Server (HFS) | Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2014-6324 | Microsoft | Kerberos Key Distribution Center (KDC) | Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2014-6332 | Microsoft | Windows | Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2015-0666 | Cisco | Prime Data Center Network Manager (DCNM) | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2015-1187 | D-Link and TRENDnet | Multiple Devices | D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2015-1427 | Elastic | Elasticsearch | Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2015-3035 | TP-Link | Multiple Archer Devices | TP-Link Multiple Archer Devices Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2015-4068 | Arcserve | Unified Data Protection (UDP) | Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2016-0752 | Rails | Ruby on Rails | Ruby on Rails Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2016-10174 | NETGEAR | WNR2000v5 Router | NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2016-11021 | D-Link | DCS-930L Devices | D-Link DCS-930L Devices OS Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2016-1555 | NETGEAR | Wireless Access Point (WAP) Devices | NETGEAR Multiple WAP Devices Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2016-4171 | Adobe | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2016-7892 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2017-0146 | Microsoft | Windows | Microsoft Windows SMB Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2017-12615 | Apache | Tomcat | Apache Tomcat on Windows Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2017-12617 | Apache | Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2017-3881 | Cisco | IOS and IOS XE | Cisco IOS and IOS XE Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2017-6316 | Citrix | NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Citrix Multiple Products Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2017-6334 | NETGEAR | DGN2200 Devices | NETGEAR DGN2200 Devices OS Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2018-0125 | Cisco | VPN Routers | Cisco VPN Routers Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2018-0147 | Cisco | Secure Access Control System (ACS) | Cisco Secure Access Control System Java Deserialization Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2018-11138 | Quest | KACE System Management Appliance | Quest KACE System Management Appliance Remote Command Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2018-1273 | VMware Tanzu | Spring Data Commons | VMware Tanzu Spring Data Commons Property Binder Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2018-14839 | LG | N1A1 NAS | LG N1A1 NAS Remote Command Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2018-6961 | VMware | SD-WAN Edge | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2018-8373 | Microsoft | Internet Explorer Scripting Engine | Microsoft Scripting Engine Memory Corruption Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2018-8414 | Microsoft | Windows | Microsoft Windows Shell Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-0903 | Microsoft | Graphics Device Interface (GDI) | Microsoft GDI Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-1003030 | Jenkins | Matrix Project Plugin | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-10068 | Kentico | Xperience | Kentico Xperience Deserialization of Untrusted Data Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-11043 | PHP | FastCGI Process Manager (FPM) | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2019-12989 | Citrix | SD-WAN and NetScaler | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-12991 | Citrix | SD-WAN and NetScaler | Citrix SD-WAN and NetScaler Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-15107 | Webmin | Webmin | Webmin Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2019-16920 | D-Link | Multiple Routers | D-Link Multiple Routers Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-2616 | Oracle | BI Publisher (Formerly XML Publisher) | Oracle BI Publisher Unauthorized Access Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2019-6340 | Drupal | Core | Drupal Core Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-1631 | Juniper | Junos OS | Juniper Junos OS Path Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-1956 | Apache | Kylin | Apache Kylin OS Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-2021 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2020-2506 | QNAP Systems | Helpdesk | QNAP Helpdesk Improper Access Control Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-25223 | Sophos | SG UTM | Sophos SG UTM Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-5410 | VMware Tanzu | Spring Cloud Configuration (Config) Server | VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-7247 | OpenBSD | OpenSMTPD | OpenSMTPD Remote Code Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-9054 | Zyxel | Multiple Network-Attached Storage (NAS) Devices | Zyxel Multiple NAS Devices OS Command Injection Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2020-9377 | D-Link | DIR-610 Devices | D-Link DIR-610 Devices Remote Command Execution | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2021-22941 | Citrix | ShareFile | Citrix ShareFile Improper Access Control Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2021-42237 | Sitecore | XP | Sitecore XP Remote Command Execution Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2022-21999 | Microsoft | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Known |
| CVE-2022-26143 | Mitel | MiCollab, MiVoice Business Express | MiCollab, MiVoice Business Express Access Control Vulnerability | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2022-26318 | WatchGuard | Firebox and XTM Appliances | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | 25 Mar 2022 | 15 Apr 2022 | Unknown |
| CVE-2015-2546 | Microsoft | Win32k | Microsoft Win32k Memory Corruption Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2016-3309 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2017-0101 | Microsoft | Windows | Microsoft Windows Transaction Manager Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2018-8120 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-0543 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-0841 | Microsoft | Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1064 | Microsoft | Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1069 | Microsoft | Task Scheduler | Microsoft Task Scheduler Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1129 | Microsoft | Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1132 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Unknown |
| CVE-2019-1253 | Microsoft | Windows | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1315 | Microsoft | Windows | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1322 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2019-1405 | Microsoft | Windows | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2020-5135 | SonicWall | SonicOS | SonicWall SonicOS Buffer Overflow Vulnerability | 15 Mar 2022 | 5 Apr 2022 | Known |
| CVE-2009-3960 | Adobe | BlazeDS | Adobe BlazeDS Information Disclosure Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Known |
| CVE-2013-0625 | Adobe | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |
| CVE-2013-0629 | Adobe | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |
| CVE-2013-0631 | Adobe | ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |
| CVE-2016-6277 | NETGEAR | Multiple Routers | NETGEAR Multiple Routers Remote Code Execution Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |
| CVE-2017-6077 | NETGEAR | Wireless Router DGN2200 | NETGEAR DGN2200 Remote Code Execution Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |
| CVE-2019-11581 | Atlassian | Jira Server and Data Center | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |
| CVE-2020-8218 | Pulse Secure | Pulse Connect Secure | Pulse Connect Secure Code Injection Vulnerability | 7 Mar 2022 | 7 Sep 2022 | Unknown |