CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2018-0175 KEV |
[KEV] Buffer Overflow in Cisco IOS, XR, and XE Software (CVE-2018-0175)
Vulnerability in Cisco IOS, XR, and XE Software (CVE-2018-0175). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-0179 KEV |
[KEV] Vulnerability in Cisco IOS Software (CVE-2018-0179)
Vulnerability in Cisco IOS Software (CVE-2018-0179). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-0180 KEV |
[KEV] Vulnerability in Cisco IOS Software (CVE-2018-0180)
Vulnerability in Cisco IOS Software (CVE-2018-0180). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-8298 KEV |
[KEV] Vulnerability in ChakraCore scripting engine (CVE-2018-8298)
Vulnerability in ChakraCore scripting engine (CVE-2018-8298). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-8581 KEV |
[KEV] Vulnerability in Microsoft Exchange Server (CVE-2018-8581)
Vulnerability in Microsoft Exchange Server (CVE-2018-8581). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-1297 KEV |
[KEV] Vulnerability in Microsoft Excel (CVE-2019-1297)
Vulnerability in Microsoft Excel (CVE-2019-1297). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-1652 KEV |
[KEV] Vulnerability in Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers (CVE-2019-1652)
Vulnerability in Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers (CVE-2019-1652). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-16928 KEV |
[KEV] Out-of-Bounds Write in Exim Internet Mailer (CVE-2019-16928)
Out-of-bounds write in Exim Internet Mailer (CVE-2019-16928). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-11899 KEV |
[KEV] Out-of-Bounds Read in Treck TCP/IP stack IPv6 (CVE-2020-11899)
Vulnerability in Treck TCP/IP stack IPv6 (CVE-2020-11899). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-1938 KEV |
[KEV] Privilege Escalation in org.apache.tomcat.embed:tomcat-embed-core (CVE-2020-1938)
Vulnerability in org.apache.tomcat.embed:tomcat-embed-core (CVE-2020-1938). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 7.0.100 or later.
|
|
| CVE-2021-41379 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2021-41379)
Vulnerability in Microsoft Windows (CVE-2021-41379). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-20699 KEV |
[KEV] Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20699)
Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20699). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-20700 KEV |
[KEV] Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20700)
Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20700). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-20701 KEV |
[KEV] Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20701)
Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20701). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-20703 KEV |
[KEV] Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20703)
Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20703). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-20708 KEV |
[KEV] Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20708)
Vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers (CVE-2022-20708). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-6352 KEV |
[KEV] Code Injection in Microsoft Windows (CVE-2014-6352)
Code injection in Microsoft Windows (CVE-2014-6352). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0222 KEV |
[KEV] Buffer Overflow in Microsoft Internet Explorer (CVE-2017-0222)
Vulnerability in Microsoft Internet Explorer (CVE-2017-0222). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-8570 KEV |
[KEV] Vulnerability in Microsoft Office (CVE-2017-8570)
Vulnerability in Microsoft Office (CVE-2017-8570). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-24682 KEV |
[KEV] Cross-Site Scripting (XSS) in Synacor Zimbra Collaborate Suite (ZCS) (CVE-2022-24682)
Cross-site scripting in Synacor Zimbra Collaborate Suite (ZCS) (CVE-2022-24682). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-23134 KEV |
[KEV] Vulnerability in Zabbix Frontend (CVE-2022-23134)
Vulnerability in Zabbix Frontend (CVE-2022-23134). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-23131 KEV |
[KEV] Vulnerability in Zabbix Frontend (CVE-2022-23131)
Vulnerability in Zabbix Frontend (CVE-2022-23131). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2013-3906 KEV |
[KEV] Code Injection in Microsoft Graphics Component (CVE-2013-3906)
Code injection in Microsoft Graphics Component (CVE-2013-3906). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-1761 KEV |
[KEV] Buffer Overflow in Microsoft Word (CVE-2014-1761)
Vulnerability in Microsoft Word (CVE-2014-1761). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-9841 KEV |
[KEV] Code Injection in Phpunit (CVE-2017-9841)
Code injection in Phpunit (CVE-2017-9841). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-15982 KEV |
[KEV] Use-After-Free in Adobe Flash Player (CVE-2018-15982)
Vulnerability in Adobe Flash Player (CVE-2018-15982). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-20250 KEV |
[KEV] Vulnerability in RARLAB WinRAR (CVE-2018-20250)
Vulnerability in RARLAB WinRAR (CVE-2018-20250). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-8174 KEV |
[KEV] Out-of-Bounds Write in Microsoft Windows (CVE-2018-8174)
Out-of-bounds write in Microsoft Windows (CVE-2018-8174). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-0752 KEV |
[KEV] Vulnerability in Microsoft Internet Explorer (CVE-2019-0752)
Vulnerability in Microsoft Internet Explorer (CVE-2019-0752). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-0609 KEV |
[KEV] Use-After-Free in Google Chromium Animation (CVE-2022-0609)
Vulnerability in Google Chromium Animation (CVE-2022-0609). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-24086 KEV |
[KEV] Vulnerability in Adobe Commerce and Magento Open Source (CVE-2022-24086)
Vulnerability in Adobe Commerce and Magento Open Source (CVE-2022-24086). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22620 KEV |
[KEV] Use-After-Free in Apple iOS, iPadOS, and macOS (CVE-2022-22620)
Vulnerability in Apple iOS, iPadOS, and macOS (CVE-2022-22620). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-4404 KEV |
[KEV] Buffer Overflow in Apple OS X (CVE-2014-4404)
Vulnerability in Apple OS X (CVE-2014-4404). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-1130 KEV |
[KEV] Vulnerability in Apple OS X (CVE-2015-1130)
Vulnerability in Apple OS X (CVE-2015-1130). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-1635 KEV |
[KEV] Code Injection in Microsoft HTTP.sys (CVE-2015-1635)
Code injection in Microsoft HTTP.sys (CVE-2015-1635). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-2051 KEV |
[KEV] Command Injection in D-Link DIR-645 Router (CVE-2015-2051)
Command injection in D-Link DIR-645 Router (CVE-2015-2051). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-3088 KEV |
[KEV] Vulnerability in Apache Activemq (CVE-2016-3088)
Vulnerability in Apache Activemq (CVE-2016-3088). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0144 KEV |
[KEV] Vulnerability in Microsoft SMBv1 (CVE-2017-0144)
Vulnerability in Microsoft SMBv1 (CVE-2017-0144). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0145 KEV |
[KEV] Vulnerability in Microsoft SMBv1 (CVE-2017-0145)
Vulnerability in Microsoft SMBv1 (CVE-2017-0145). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0262 KEV |
[KEV] Vulnerability in Microsoft Office (CVE-2017-0262)
Vulnerability in Microsoft Office (CVE-2017-0262). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0263 KEV |
[KEV] Use-After-Free in Microsoft Win32k (CVE-2017-0263)
Vulnerability in Microsoft Win32k (CVE-2017-0263). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-10271 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2017-10271)
Vulnerability in Oracle WebLogic Server (CVE-2017-10271). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-8464 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2017-8464)
Vulnerability in Microsoft Windows (CVE-2017-8464). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-9791 KEV |
[KEV] Vulnerability in Apache Struts 1 (CVE-2017-9791)
Vulnerability in Apache Struts 1 (CVE-2017-9791). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-1000861 KEV |
[KEV] Unsafe Deserialization in Jenkins Stapler Web Framework (CVE-2018-1000861)
Vulnerability in Jenkins Stapler Web Framework (CVE-2018-1000861). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-0796 KEV |
[KEV] Buffer Overflow in Microsoft SMBv3 (CVE-2020-0796)
Vulnerability in Microsoft SMBv3 (CVE-2020-0796). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-36934 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2021-36934)
Vulnerability in Microsoft Windows (CVE-2021-36934). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-21882 KEV |
[KEV] Out-of-Bounds Write in Microsoft Win32k (CVE-2022-21882)
Out-of-bounds write in Microsoft Win32k (CVE-2022-21882). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-7169 KEV |
[KEV] OS Command Injection in GNU Bourne-Again Shell (Bash) (CVE-2014-7169)
OS command injection in GNU Bourne-Again Shell (Bash) (CVE-2014-7169). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-6271 KEV |
[KEV] OS Command Injection in GNU Bourne-Again Shell (Bash) (CVE-2014-6271)
OS command injection in GNU Bourne-Again Shell (Bash) (CVE-2014-6271). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
