CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2022-26904 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2022-26904)
Vulnerability in Microsoft Windows (CVE-2022-26904). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-29464 KEV |
[KEV] Path Traversal in WSO2 Multiple Products (CVE-2022-29464)
Path traversal in WSO2 Multiple Products (CVE-2022-29464). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22718 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2022-22718)
Vulnerability in Microsoft Windows (CVE-2022-22718). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-3568 KEV |
[KEV] Vulnerability in Meta Platforms WhatsApp (CVE-2019-3568)
Vulnerability in Meta Platforms WhatsApp (CVE-2019-3568). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-6882 KEV |
[KEV] Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2018-6882)
Cross-site scripting in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2018-6882). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2007-3010 KEV |
[KEV] Vulnerability in Alcatel OmniPCX Enterprise (CVE-2007-3010)
Vulnerability in Alcatel OmniPCX Enterprise (CVE-2007-3010). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-5330 KEV |
[KEV] Command Injection in Ubiquiti AirOS (CVE-2010-5330)
Command injection in Ubiquiti AirOS (CVE-2010-5330). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-0780 KEV |
[KEV] Path Traversal in InduSoft Web Studio (CVE-2014-0780)
Path traversal in InduSoft Web Studio (CVE-2014-0780). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-4523 KEV |
[KEV] Buffer Overflow in Trihedral VTScada (formerly VTS) (CVE-2016-4523)
Vulnerability in Trihedral VTScada (formerly VTS) (CVE-2016-4523). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-7841 KEV |
[KEV] SQL Injection in Schneider Electric U.motion Builder (CVE-2018-7841)
SQL injection in Schneider Electric U.motion Builder (CVE-2018-7841). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-16057 KEV |
[KEV] OS Command Injection in D-Link DNS-320 Storage Device (CVE-2019-16057)
OS command injection in D-Link DNS-320 Storage Device (CVE-2019-16057). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-3929 KEV |
[KEV] Cross-Site Scripting (XSS) in Crestron Multiple Products (CVE-2019-3929)
Cross-site scripting in Crestron Multiple Products (CVE-2019-3929). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-1364 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2022-1364)
Vulnerability in Google Chromium V8 (CVE-2022-1364). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22960 KEV |
[KEV] Vulnerability in VMware Multiple Products (CVE-2022-22960)
Vulnerability in VMware Multiple Products (CVE-2022-22960). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22954 KEV |
[KEV] Code Injection in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954)
Code injection in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-9163 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2014-9163)
Vulnerability in Adobe Flash Player (CVE-2014-9163). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-0311 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2015-0311)
Vulnerability in Adobe Flash Player (CVE-2015-0311). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-0313 KEV |
[KEV] Use-After-Free in Adobe Flash Player (CVE-2015-0313)
Vulnerability in Adobe Flash Player (CVE-2015-0313). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-2502 KEV |
[KEV] Buffer Overflow in Microsoft Internet Explorer (CVE-2015-2502)
Vulnerability in Microsoft Internet Explorer (CVE-2015-2502). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-3113 KEV |
[KEV] Buffer Overflow in Adobe Flash Player (CVE-2015-3113)
Vulnerability in Adobe Flash Player (CVE-2015-3113). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-5122 KEV |
[KEV] Use-After-Free in Adobe Flash Player (CVE-2015-5122)
Vulnerability in Adobe Flash Player (CVE-2015-5122). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-5123 KEV |
[KEV] Use-After-Free in Adobe Flash Player (CVE-2015-5123)
Vulnerability in Adobe Flash Player (CVE-2015-5123). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-20753 KEV |
[KEV] Vulnerability in Kaseya Virtual System/Server Administrator (VSA) (CVE-2018-20753)
Vulnerability in Kaseya Virtual System/Server Administrator (VSA) (CVE-2018-20753). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-7602 KEV |
[KEV] Code Injection in Drupal Core (CVE-2018-7602)
Code injection in Drupal Core (CVE-2018-7602). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-24521 KEV |
[KEV] Out-of-Bounds Write in Microsoft Windows (CVE-2022-24521)
Out-of-bounds write in Microsoft Windows (CVE-2022-24521). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-11317 KEV |
[KEV] Vulnerability in Telerik User Interface (UI) for ASP.NET AJAX (CVE-2017-11317)
Vulnerability in Telerik User Interface (UI) for ASP.NET AJAX (CVE-2017-11317). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-2509 KEV |
[KEV] Command Injection in QNAP Network-Attached Storage (NAS) (CVE-2020-2509)
Command injection in QNAP Network-Attached Storage (NAS) (CVE-2020-2509). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22600 KEV |
[KEV] Vulnerability in Linux Kernel (CVE-2021-22600)
Vulnerability in Linux Kernel (CVE-2021-22600). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to :2022-05-05 or later.
|
|
| CVE-2021-27852 KEV |
[KEV] Unsafe Deserialization in Checkbox Survey (CVE-2021-27852)
Vulnerability in Checkbox Survey (CVE-2021-27852). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-39793 KEV |
[KEV] Out-of-Bounds Write in Google Pixel (CVE-2021-39793)
Out-of-bounds write in Google Pixel (CVE-2021-39793). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-42278 KEV |
[KEV] Vulnerability in Microsoft Active Directory (CVE-2021-42278)
Vulnerability in Microsoft Active Directory (CVE-2021-42278). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-42287 KEV |
[KEV] Privilege Escalation in Microsoft Active Directory (CVE-2021-42287)
Vulnerability in Microsoft Active Directory (CVE-2021-42287). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-23176 KEV |
[KEV] Vulnerability in WatchGuard Firebox and XTM (CVE-2022-23176)
Vulnerability in WatchGuard Firebox and XTM (CVE-2022-23176). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0148 KEV |
[KEV] Vulnerability in Microsoft SMBv1 server (CVE-2017-0148)
Vulnerability in Microsoft SMBv1 server (CVE-2017-0148). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-31166 KEV |
[KEV] Use-After-Free in Microsoft HTTP Protocol Stack (CVE-2021-31166)
Vulnerability in Microsoft HTTP Protocol Stack (CVE-2021-31166). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-3156 KEV |
[KEV] Vulnerability in Sudo (CVE-2021-3156)
Vulnerability in Sudo (CVE-2021-3156). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-45382 KEV |
[KEV] OS Command Injection in D-Link Multiple Routers (CVE-2021-45382)
OS command injection in D-Link Multiple Routers (CVE-2021-45382). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22674 KEV |
[KEV] Vulnerability in Apple macOS (CVE-2022-22674)
Vulnerability in Apple macOS (CVE-2022-22674). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22675 KEV |
[KEV] Vulnerability in Apple macOS (CVE-2022-22675)
Vulnerability in Apple macOS (CVE-2022-22675). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22965 KEV |
[KEV] Code Injection in VMware Spring Framework (CVE-2022-22965)
Code injection in VMware Spring Framework (CVE-2022-22965). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-10561 KEV |
[KEV] Authentication Bypass in Dasan Gigabit Passive Optical Network (GPON) Routers (CVE-2018-10561)
Authentication bypass in Dasan Gigabit Passive Optical Network (GPON) Routers (CVE-2018-10561). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-10562 KEV |
[KEV] OS Command Injection in Dasan Gigabit Passive Optical Network (GPON) Routers (CVE-2018-10562)
OS command injection in Dasan Gigabit Passive Optical Network (GPON) Routers (CVE-2018-10562). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-21551 KEV |
[KEV] Vulnerability in Dell dbutil Driver (CVE-2021-21551)
Vulnerability in Dell dbutil Driver (CVE-2021-21551). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-28799 KEV |
[KEV] Vulnerability in QNAP Network Attached Storage (NAS) (CVE-2021-28799)
Vulnerability in QNAP Network Attached Storage (NAS) (CVE-2021-28799). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-34484 KEV |
[KEV] Privilege Escalation in Microsoft Windows (CVE-2021-34484)
Vulnerability in Microsoft Windows (CVE-2021-34484). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-1040 KEV |
[KEV] Vulnerability in Sophos Firewall (CVE-2022-1040)
Vulnerability in Sophos Firewall (CVE-2022-1040). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-26871 KEV |
[KEV] Vulnerability in Trend Micro Apex Central (CVE-2022-26871)
Vulnerability in Trend Micro Apex Central (CVE-2022-26871). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-4398 KEV |
[KEV] Buffer Overflow in Microsoft Windows (CVE-2010-4398)
Vulnerability in Microsoft Windows (CVE-2010-4398). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2011-2005 KEV |
[KEV] Vulnerability in Microsoft Ancillary Function Driver (afd.sys) (CVE-2011-2005)
Vulnerability in Microsoft Ancillary Function Driver (afd.sys) (CVE-2011-2005). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2012-0518 KEV |
[KEV] Open Redirect in Oracle Fusion Middleware (CVE-2012-0518)
Vulnerability in Oracle Fusion Middleware (CVE-2012-0518). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
