Known exploited vulnerabilities
From CISA’s Known Exploited Vulnerabilities catalogue: flaws that attackers are using now, when each was added, and the date federal agencies were told to fix it by.
- In the catalogue
- 1781
- Added in the last 7 days
- 12
- Used in ransomware
- 361
The catalogue, newest first
| CVE | Vendor | Product | Name | Added | Fix due | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2020-10987 | Tenda | AC1900 Router AC15 Model | Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1147 | Microsoft | .NET Framework, SharePoint, Visual Studio | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-11651 | SaltStack | Salt | SaltStack Salt Authentication Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-11652 | SaltStack | Salt | SaltStack Salt Path Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-11738 | WordPress | Snap Creek Duplicator Plugin | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-12271 | Sophos | SFOS | Sophos SFOS SQL Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-12812 | Fortinet | FortiOS | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-1350 | Microsoft | Windows | Microsoft Windows DNS Server Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1380 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1464 | Microsoft | Windows | Microsoft Windows Spoofing Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-1472 | Microsoft | Netlogon | Microsoft Netlogon Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-14750 | Oracle | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-14871 | Oracle | Solaris and Zettabyte File System (ZFS) | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-14882 | Oracle | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-14883 | Oracle | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-15505 | Ivanti | MobileIron Multiple Products | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-15999 | Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2020-16009 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown | |
| CVE-2020-16010 | Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown | |
| CVE-2020-16013 | Chromium V8 | Google Chromium V8 Incorrect Implementation Vulnerabililty | 3 Nov 2021 | 3 May 2022 | Unknown | |
| CVE-2020-16017 | Chrome | Google Chrome Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown | |
| CVE-2020-16846 | SaltStack | Salt | SaltStack Salt Shell Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-17087 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-17144 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-17496 | vBulletin | vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-17530 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-24557 | Trend Micro | Apex One, OfficeScan, and Worry-Free Business Security | Trend Micro Multiple Products Improper Access Control Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-25213 | WordPress | File Manager Plugin | WordPress File Manager Plugin Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-25506 | D-Link | DNS-320 Device | D-Link DNS-320 Device Command Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-2555 | Oracle | Multiple Products | Oracle Multiple Products Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-26919 | NETGEAR | JGS516PE Devices | Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-27930 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-27932 | Apple | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-27950 | Apple | Multiple Products | Apple Multiple Products Memory Initialization Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-29557 | D-Link | DIR-825 R1 Devices | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-29583 | Zyxel | Multiple Products | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3118 | Cisco | IOS XR | Cisco IOS XR Software Discovery Protocol Format String Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3161 | Cisco | Cisco IP Phones | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3452 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3566 | Cisco | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3569 | Cisco | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3580 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-3950 | VMware | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3952 | VMware | vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-3992 | VMware | ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-4006 | VMware | Multiple Products | Multiple VMware Products Command Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-4427 | IBM | Data Risk Manager | IBM Data Risk Manager Security Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-4428 | IBM | Data Risk Manager | IBM Data Risk Manager Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-4430 | IBM | Data Risk Manager | IBM Data Risk Manager Directory Traversal Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-5735 | Amcrest | Cameras and Network Video Recorder (NVR) | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-5847 | Unraid | Unraid | Unraid Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-5849 | Unraid | Unraid | Unraid Authentication Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-5902 | F5 | BIG-IP | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Known |
| CVE-2020-6207 | SAP | Solution Manager | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-6287 | SAP | NetWeaver | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-6418 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown | |
| CVE-2020-6819 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-6820 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-7961 | Liferay | Liferay Portal | Liferay Portal Deserialization of Untrusted Data Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8193 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8195 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8196 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8243 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8260 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8467 | Trend Micro | Apex One and OfficeScan | Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8468 | Trend Micro | Apex One, OfficeScan and Worry-Free Business Security Agents | Trend Micro Multiple Products Content Validation Escape Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8515 | DrayTek | Multiple Vigor Routers | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8599 | Trend Micro | Apex One and OfficeScan | Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8644 | PlaySMS | PlaySMS | PlaySMS Server-Side Template Injection Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8655 | EyesOfNetwork | EyesOfNetwork | EyesOfNetwork Improper Privilege Management Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-8657 | EyesOfNetwork | EyesOfNetwork | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-9818 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-9819 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2020-9859 | Apple | Multiple Products | Apple Multiple Products Code Execution Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2021-1497 | Cisco | HyperFlex HX | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1498 | Cisco | HyperFlex HX | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1647 | Microsoft | Defender | Microsoft Defender Remote Code Execution Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1675 | Microsoft | Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-1732 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-1782 | Apple | Multiple Products | Apple Multiple Products Race Condition Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1870 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1871 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1879 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-1905 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 3 Nov 2021 | 3 May 2022 | Unknown |
| CVE-2021-1906 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-20016 | SonicWall | SSLVPN SMA100 | SonicWall SSLVPN SMA100 SQL Injection Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-20021 | SonicWall | SonicWall Email Security | SonicWall Email Security Improper Privilege Management Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-20022 | SonicWall | SonicWall Email Security | SonicWall Email Security Unrestricted Upload of File Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-20023 | SonicWall | SonicWall Email Security | SonicWall Email Security Path Traversal Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-20090 | Arcadyan | Buffalo Firmware | Arcadyan Buffalo Firmware Path Traversal Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-21017 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown |
| CVE-2021-21148 | Chromium V8 | Google Chromium V8 Heap Buffer Overflow Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2021-21166 | Chromium | Google Chromium Race Condition Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2021-21193 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2021-21206 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2021-21220 | Chromium V8 | Google Chromium V8 Improper Input Validation Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2021-21224 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Unknown | |
| CVE-2021-21972 | VMware | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-21985 | VMware | vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |
| CVE-2021-22005 | VMware | vCenter Server | VMware vCenter Server File Upload Vulnerability | 3 Nov 2021 | 17 Nov 2021 | Known |