Known exploited vulnerabilities
From CISA’s Known Exploited Vulnerabilities catalogue: flaws that attackers are using now, when each was added, and the date federal agencies were told to fix it by.
- In the catalogue
- 1781
- Added in the last 7 days
- 12
- Used in ransomware
- 361
The catalogue, newest first
| CVE | Vendor | Product | Name | Added | Fix due | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2016-0167 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2016-0185 | Microsoft | Windows | Microsoft Windows Media Center Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-3235 | Microsoft | Office | Microsoft Office OLE DLL Side Loading Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-3643 | SolarWinds | Virtualization Manager | SolarWinds Virtualization Manager Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-3715 | ImageMagick | ImageMagick | ImageMagick Arbitrary File Deletion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-3718 | ImageMagick | ImageMagick | ImageMagick Server-Side Request Forgery (SSRF) Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-3976 | SAP | NetWeaver | SAP NetWeaver Directory Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-4437 | Apache | Shiro | Apache Shiro Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2016-7255 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2016-9563 | SAP | NetWeaver | SAP NetWeaver XML External Entity (XXE) Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-0143 | Microsoft | Windows | Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2017-0199 | Microsoft | Office and WordPad | Microsoft Office and WordPad Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2017-11774 | Microsoft | Office | Microsoft Office Outlook Security Feature Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-11882 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2017-16651 | Roundcube | Roundcube Webmail | Roundcube Webmail File Disclosure Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-5638 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2017-6327 | Symantec | Symantec Messaging Gateway | Symantec Messaging Gateway Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-7269 | Microsoft | Internet Information Services (IIS) | Microsoft Windows Server Buffer Overflow Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-8759 | Microsoft | .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-9248 | Progress | ASP.NET AJAX and Sitefinity | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-9805 | Apache | Struts | Apache Struts Deserialization of Untrusted Data Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2017-9822 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-0171 | Cisco | IOS and IOS XE | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-0296 | Cisco | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-0798 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-0802 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-11776 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-13379 | Fortinet | FortiOS | Fortinet FortiOS SSL VPN Path Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-14558 | Tenda | AC7, AC9, and AC10 Routers | Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-15811 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-15961 | Adobe | ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-18325 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-20062 | ThinkPHP | noneCms | ThinkPHP "noneCms" Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-2380 | SAP | Customer Relationship Management (CRM) | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-4878 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-4939 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2018-6789 | Exim | Exim | Exim Buffer Overflow Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-7600 | Drupal | Drupal Core | Drupal Core Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2018-8653 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-0211 | Apache | HTTP Server | Apache HTTP Server Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-0541 | Microsoft | MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-0604 | Microsoft | SharePoint | Microsoft SharePoint Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-0708 | Microsoft | Remote Desktop Services | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-0797 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-0803 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-0808 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-0859 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-0863 | Microsoft | Windows | Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-11510 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-11539 | Ivanti | Pulse Connect Secure and Pulse Policy Secure | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-11580 | Atlassian | Crowd and Crowd Data Center | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-11634 | Citrix | Workspace Application and Receiver for Windows | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-1214 | Microsoft | Windows | Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-1215 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-13608 | Citrix | StoreFront Server | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-1367 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-1429 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-15752 | Docker | Desktop Community Edition | Docker Desktop Community Edition Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-15949 | Nagios | Nagios XI | Nagios XI Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-16256 | SIMalliance | Toolbox Browser | SIMalliance Toolbox Browser Command Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-1653 | Cisco | Small Business RV320 and RV325 Routers | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-16759 | vBulletin | vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-17026 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Type Confusion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-17558 | Apache | Solr | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-18187 | Trend Micro | OfficeScan | Trend Micro OfficeScan Directory Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-18935 | Progress | Telerik UI for ASP.NET AJAX | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-18988 | TeamViewer | Desktop | TeamViewer Desktop Bypass Remote Login Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-19356 | Netis | WF2419 Devices | Netis WF2419 Devices Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-19781 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-20085 | TVT | NVMS-1000 | TVT NVMS-1000 Directory Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-2215 | Android | Android Kernel | Android Kernel Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-3396 | Atlassian | Confluence Server and Data Server | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-3398 | Atlassian | Confluence Server and Data Center | Atlassian Confluence Server and Data Center Path Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-4716 | IBM | Planning Analytics | IBM Planning Analytics Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-5544 | VMware | VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-5591 | Fortinet | FortiOS | Fortinet FortiOS Default Configuration Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-6223 | Apple | iOS and macOS | Apple iOS and macOS Group Facetime Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-7481 | SonicWall | SMA100 | SonicWall SMA100 SQL Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2019-8394 | Zoho | ManageEngine | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-9082 | ThinkPHP | ThinkPHP | ThinkPHP Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2019-9978 | WordPress | Social Warfare Plugin | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0041 | Android | Android Kernel | Android Kernel Out-of-Bounds Write Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0069 | MediaTek | Multiple Chipsets | Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0601 | Microsoft | Windows | Microsoft Windows CryptoAPI Spoofing Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0646 | Microsoft | .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0674 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0683 | Microsoft | Windows | Microsoft Windows Installer Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0688 | Microsoft | Exchange Server | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-0878 | Microsoft | Edge and Internet Explorer | Microsoft Edge and Internet Explorer Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-0938 | Microsoft | Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-0968 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-0986 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-10148 | SolarWinds | Orion | SolarWinds Orion Authentication Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-10181 | Sumavision | Enhanced Multimedia Router (EMR) | Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-10189 | Zoho | ManageEngine | Zoho ManageEngine Desktop Central File Upload Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-10199 | Sonatype | Nexus Repository | Sonatype Nexus Repository Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1020 | Microsoft | Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-10221 | rConfig | rConfig | rConfig OS Command Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1040 | Microsoft | Hyper-V RemoteFX | Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1054 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |