CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2021-30900 KEV |
[KEV] Vulnerability in Apple iOS, iPadOS, and macOS (CVE-2021-30900)
Vulnerability in Apple iOS, iPadOS, and macOS (CVE-2021-30900). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-39197 KEV |
[KEV] Vulnerability in Fortra Cobalt Strike (CVE-2022-39197)
Vulnerability in Fortra Cobalt Strike (CVE-2022-39197). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-42948 KEV |
[KEV] Cross-Site Scripting (XSS) in Fortra Cobalt Strike (CVE-2022-42948)
Cross-site scripting in Fortra Cobalt Strike (CVE-2022-42948). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-7494 KEV |
[KEV] Code Injection in Samba (CVE-2017-7494)
Code injection in Samba (CVE-2017-7494). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2013-3163 KEV |
[KEV] Code Injection in Microsoft Internet Explorer (CVE-2013-3163)
Code injection in Microsoft Internet Explorer (CVE-2013-3163). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-26360 KEV |
[KEV] Vulnerability in Adobe ColdFusion (CVE-2023-26360)
Vulnerability in Adobe ColdFusion (CVE-2023-26360). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-41328 KEV |
[KEV] Path Traversal in Fortinet FortiOS (CVE-2022-41328)
Path traversal in Fortinet FortiOS (CVE-2022-41328). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-24880 KEV |
[KEV] Authorization Flaw in Microsoft Windows (CVE-2023-24880)
Vulnerability in Microsoft Windows (CVE-2023-24880). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-23397 KEV |
[KEV] Vulnerability in Microsoft Office (CVE-2023-23397)
Vulnerability in Microsoft Office (CVE-2023-23397). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-5741 KEV |
[KEV] Unsafe Deserialization in Plex Media Server (CVE-2020-5741)
Vulnerability in Plex Media Server (CVE-2020-5741). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-39144 KEV |
[KEV] Vulnerability in com.thoughtworks.xstream:xstream (CVE-2021-39144)
Vulnerability in com.thoughtworks.xstream:xstream (CVE-2021-39144). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.4.18 or later.
|
|
| CVE-2022-35914 KEV |
[KEV] Vulnerability in Teclib GLPI (CVE-2022-35914)
Vulnerability in Teclib GLPI (CVE-2022-35914). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-33891 KEV |
[KEV] OS Command Injection in Apache Spark (CVE-2022-33891)
OS command injection in Apache Spark (CVE-2022-33891). Successful exploitation can lead to full system takeover. Exploitable via spark.acls.enable. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 3.2.2 or later.
|
|
| CVE-2022-28810 KEV |
[KEV] OS Command Injection in Zoho ManageEngine (CVE-2022-28810)
OS command injection in Zoho ManageEngine (CVE-2022-28810). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-36537 KEV |
[KEV] Vulnerability in ZK Framework AuUploader (CVE-2022-36537)
Vulnerability in ZK Framework AuUploader (CVE-2022-36537). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-40765 KEV |
[KEV] Command Injection in Mitel MiVoice Connect (CVE-2022-40765)
Command injection in Mitel MiVoice Connect (CVE-2022-40765). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-41223 KEV |
[KEV] Code Injection in Mitel MiVoice Connect (CVE-2022-41223)
Code injection in Mitel MiVoice Connect (CVE-2022-41223). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-47986 KEV |
[KEV] Unsafe Deserialization in IBM Aspera Faspex (CVE-2022-47986)
Vulnerability in IBM Aspera Faspex (CVE-2022-47986). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-46169 KEV |
[KEV] Vulnerability in Cacti (CVE-2022-46169)
Vulnerability in Cacti (CVE-2022-46169). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21823 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-21823)
Vulnerability in Microsoft Windows (CVE-2023-21823). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-23529 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-23529)
Vulnerability in Apple Multiple Products (CVE-2023-23529). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-23376 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-23376)
Vulnerability in Microsoft Windows (CVE-2023-23376). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21715 KEV |
[KEV] Authorization Flaw in Microsoft Office (CVE-2023-21715)
Vulnerability in Microsoft Office (CVE-2023-21715). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-0669 KEV |
[KEV] Unsafe Deserialization in Fortra GoAnywhere MFT (CVE-2023-0669)
Vulnerability in Fortra GoAnywhere MFT (CVE-2023-0669). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-24990 KEV |
[KEV] Vulnerability in TerraMaster OS (CVE-2022-24990)
Vulnerability in TerraMaster OS (CVE-2022-24990). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-2291 KEV |
[KEV] Vulnerability in Intel Ethernet Diagnostics Driver for Windows (CVE-2015-2291)
Vulnerability in Intel Ethernet Diagnostics Driver for Windows (CVE-2015-2291). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-22952 KEV |
[KEV] Vulnerability in SugarCRM Multiple Products (CVE-2023-22952)
Vulnerability in SugarCRM Multiple Products (CVE-2023-22952). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-21587 KEV |
[KEV] Vulnerability in Oracle E-Business Suite (CVE-2022-21587)
Vulnerability in Oracle E-Business Suite (CVE-2022-21587). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-11357 KEV |
[KEV] Vulnerability in Telerik User Interface (UI) for ASP.NET AJAX (CVE-2017-11357)
Vulnerability in Telerik User Interface (UI) for ASP.NET AJAX (CVE-2017-11357). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-47966 KEV |
[KEV] Vulnerability in Zoho ManageEngine (CVE-2022-47966)
Vulnerability in Zoho ManageEngine (CVE-2022-47966). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-44877 KEV |
[KEV] OS Command Injection in CWP Control Web Panel (CVE-2022-44877)
OS command injection in CWP Control Web Panel (CVE-2022-44877). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21674 KEV |
[KEV] Use-After-Free in Microsoft Windows (CVE-2023-21674)
Vulnerability in Microsoft Windows (CVE-2023-21674). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-41080 KEV |
[KEV] Vulnerability in Microsoft Exchange Server (CVE-2022-41080)
Vulnerability in Microsoft Exchange Server (CVE-2022-41080). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-18809 KEV |
[KEV] Path Traversal in TIBCO JasperReports (CVE-2018-18809)
Path traversal in TIBCO JasperReports (CVE-2018-18809). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-5430 KEV |
[KEV] Path Traversal in TIBCO JasperReports (CVE-2018-5430)
Path traversal in TIBCO JasperReports (CVE-2018-5430). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-42856 KEV |
[KEV] Vulnerability in Apple iOS (CVE-2022-42856)
Vulnerability in Apple iOS (CVE-2022-42856). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-26501 KEV |
[KEV] Vulnerability in Veeam Backup & Replication (CVE-2022-26501)
Vulnerability in Veeam Backup & Replication (CVE-2022-26501). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-26500 KEV |
[KEV] Path Traversal in Veeam Backup & Replication (CVE-2022-26500)
Path traversal in Veeam Backup & Replication (CVE-2022-26500). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-27518 KEV |
[KEV] Vulnerability in Citrix Application Delivery Controller (ADC) and Gateway (CVE-2022-27518)
Vulnerability in Citrix Application Delivery Controller (ADC) and Gateway (CVE-2022-27518). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-44698 KEV |
[KEV] Vulnerability in Microsoft Defender (CVE-2022-44698)
Vulnerability in Microsoft Defender (CVE-2022-44698). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-42475 KEV |
[KEV] Vulnerability in Fortinet FortiOS (CVE-2022-42475)
Vulnerability in Fortinet FortiOS (CVE-2022-42475). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-4262 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2022-4262)
Vulnerability in Google Chromium V8 (CVE-2022-4262). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-4135 KEV |
[KEV] Out-of-Bounds Write in Google Chromium GPU (CVE-2022-4135)
Out-of-bounds write in Google Chromium GPU (CVE-2022-4135). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-35587 KEV |
[KEV] Unsafe Deserialization in Oracle Fusion Middleware (CVE-2021-35587)
Vulnerability in Oracle Fusion Middleware (CVE-2021-35587). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-41049 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2022-41049)
Vulnerability in Microsoft Windows (CVE-2022-41049). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25370 KEV |
[KEV] Use-After-Free in Samsung Mobile Devices (CVE-2021-25370)
Vulnerability in Samsung Mobile Devices (CVE-2021-25370). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25369 KEV |
[KEV] Information Disclosure in Samsung Mobile Devices (CVE-2021-25369)
Vulnerability in Samsung Mobile Devices (CVE-2021-25369). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25337 KEV |
[KEV] Privilege Escalation in Samsung Mobile Devices (CVE-2021-25337)
Vulnerability in Samsung Mobile Devices (CVE-2021-25337). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-41128 KEV |
[KEV] Out-of-Bounds Write in Microsoft Windows (CVE-2022-41128)
Out-of-bounds write in Microsoft Windows (CVE-2022-41128). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-41125 KEV |
[KEV] Out-of-Bounds Write in Microsoft Windows (CVE-2022-41125)
Out-of-bounds write in Microsoft Windows (CVE-2022-41125). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
