Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 6.1 Medium severity | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) CVE-2022-39197 | Mar 30, 2023 | Apr 20, 2023 | Not reported |
| 8.8 High severity | Arm Mali GPU Kernel Driver Use-After-Free CVE-2022-38181 | Mar 30, 2023 | Apr 20, 2023 | Not reported |
| 8.8 High severity | Google Chromium Network Service Use-After-Free CVE-2022-3038 | Mar 30, 2023 | Apr 20, 2023 | Not reported |
| 7.8 High severity | Arm Mali GPU Kernel Driver Unspecified CVE-2022-22706 | Mar 30, 2023 | Apr 20, 2023 | Not reported |
| 7.8 High severity | Apple iOS, iPadOS, and macOS Out-of-Bounds Write CVE-2021-30900 | Mar 30, 2023 | Apr 20, 2023 | Not reported |
| 9.8 Critical severity | Samba Remote Code Execution CVE-2017-7494 | Mar 30, 2023 | Apr 20, 2023 | Known |
| 8.8 High severity | Microsoft Internet Explorer Memory Corruption CVE-2013-3163 | Mar 30, 2023 | Apr 20, 2023 | Not reported |
| 9.8 Critical severity | Adobe ColdFusion Deserialization of Untrusted Data CVE-2023-26360 | Mar 15, 2023 | Apr 5, 2023 | Not reported |
| 4.4 Medium severity | Microsoft Windows SmartScreen Security Feature Bypass CVE-2023-24880 | Mar 14, 2023 | Apr 4, 2023 | Known |
| 9.8 Critical severity | Microsoft Office Outlook Privilege Escalation CVE-2023-23397 | Mar 14, 2023 | Apr 4, 2023 | Not reported |
| 7.1 High severity | Fortinet FortiOS Path Traversal CVE-2022-41328 | Mar 14, 2023 | Apr 4, 2023 | Not reported |
| 8.5 High severity | XStream Remote Code Execution CVE-2021-39144 | Mar 10, 2023 | Mar 31, 2023 | Not reported |
| 7.2 High severity | Plex Media Server Remote Code Execution CVE-2020-5741 | Mar 10, 2023 | Mar 31, 2023 | Not reported |
| 9.8 Critical severity | Teclib GLPI Remote Code Execution CVE-2022-35914 | Mar 7, 2023 | Mar 28, 2023 | Not reported |
| 8.8 High severity | Apache Spark Command Injection CVE-2022-33891 | Mar 7, 2023 | Mar 28, 2023 | Not reported |
| 6.8 Medium severity | Zoho ManageEngine ADSelfService Plus Remote Code Execution CVE-2022-28810 | Mar 7, 2023 | Mar 28, 2023 | Not reported |
| 7.5 High severity | ZK Framework AuUploader Unspecified CVE-2022-36537 | Feb 27, 2023 | Mar 20, 2023 | Known |
| 9.8 Critical severity | IBM Aspera Faspex Code Execution CVE-2022-47986 | Feb 21, 2023 | Mar 14, 2023 | Known |
| 6.8 Medium severity | Mitel MiVoice Connect Code Injection CVE-2022-41223 | Feb 21, 2023 | Mar 14, 2023 | Known |
| 6.8 Medium severity | Mitel MiVoice Connect Command Injection CVE-2022-40765 | Feb 21, 2023 | Mar 14, 2023 | Known |
| 9.8 Critical severity | Cacti Command Injection CVE-2022-46169 | Feb 16, 2023 | Mar 9, 2023 | Not reported |
| 8.8 High severity | Apple Multiple Products WebKit Type Confusion CVE-2023-23529 | Feb 14, 2023 | Mar 7, 2023 | Not reported |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation CVE-2023-23376 | Feb 14, 2023 | Mar 7, 2023 | Known |
| 7.8 High severity | Microsoft Windows Graphic Component Privilege Escalation CVE-2023-21823 | Feb 14, 2023 | Mar 7, 2023 | Not reported |
| 7.3 High severity | Microsoft Office Publisher Security Feature Bypass CVE-2023-21715 | Feb 14, 2023 | Mar 7, 2023 | Not reported |
| 7.2 High severity | Fortra GoAnywhere MFT Remote Code Execution CVE-2023-0669 | Feb 10, 2023 | Mar 3, 2023 | Known |
| 7.5 High severity | TerraMaster OS Remote Command Execution CVE-2022-24990 | Feb 10, 2023 | Mar 3, 2023 | Known |
| 7.8 High severity | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service CVE-2015-2291 | Feb 10, 2023 | Mar 3, 2023 | Known |
| 8.8 High severity | Multiple SugarCRM Products Remote Code Execution CVE-2023-22952 | Feb 2, 2023 | Feb 23, 2023 | Not reported |
| 9.8 Critical severity | Oracle E-Business Suite Unspecified CVE-2022-21587 | Feb 2, 2023 | Feb 23, 2023 | Known |
| 9.8 Critical severity | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference CVE-2017-11357 | Jan 26, 2023 | Feb 16, 2023 | Known |
| 9.8 Critical severity | Zoho ManageEngine Multiple Products Remote Code Execution CVE-2022-47966 | Jan 23, 2023 | Feb 13, 2023 | Known |
| 9.8 Critical severity | CWP Control Web Panel OS Command Injection CVE-2022-44877 | Jan 17, 2023 | Feb 7, 2023 | Not reported |
| 8.8 High severity | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation CVE-2023-21674 | Jan 10, 2023 | Jan 31, 2023 | Not reported |
| 9.8 Critical severity | Microsoft Exchange Server Privilege Escalation CVE-2022-41080 | Jan 10, 2023 | Jan 31, 2023 | Known |
| 8.8 High severity | TIBCO JasperReports Server Information Disclosure CVE-2018-5430 | Dec 29, 2022 | Jan 19, 2023 | Not reported |
| 6.5 Medium severity | TIBCO JasperReports Library Directory Traversal CVE-2018-18809 | Dec 29, 2022 | Jan 19, 2023 | Not reported |
| 8.8 High severity | Apple iOS Type Confusion CVE-2022-42856 | Dec 14, 2022 | Jan 4, 2023 | Not reported |
| 5.4 Medium severity | Microsoft Defender SmartScreen Security Feature Bypass CVE-2022-44698 | Dec 13, 2022 | Jan 3, 2023 | Known |
| 9.8 Critical severity | Fortinet FortiOS Heap-Based Buffer Overflow CVE-2022-42475 | Dec 13, 2022 | Jan 3, 2023 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.