Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass CVE-2022-27518 | Dec 13, 2022 | Jan 3, 2023 | Not reported |
| 9.8 Critical severity | Veeam Backup & Replication Remote Code Execution CVE-2022-26501 | Dec 13, 2022 | Jan 3, 2023 | Known |
| 8.8 High severity | Veeam Backup & Replication Remote Code Execution CVE-2022-26500 | Dec 13, 2022 | Jan 3, 2023 | Known |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2022-4262 | Dec 5, 2022 | Dec 26, 2022 | Not reported |
| 9.6 Critical severity | Google Chromium GPU Heap Buffer Overflow CVE-2022-4135 | Nov 28, 2022 | Dec 19, 2022 | Not reported |
| 7.5 High severity | Oracle Fusion Middleware Unspecified CVE-2021-35587 | Nov 28, 2022 | Dec 19, 2022 | Not reported |
| 5.4 Medium severity | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass CVE-2022-41049 | Nov 14, 2022 | Dec 9, 2022 | Not reported |
| 8.8 High severity | Microsoft Windows Scripting Languages Remote Code Execution CVE-2022-41128 | Nov 8, 2022 | Dec 9, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows CNG Key Isolation Service Privilege Escalation CVE-2022-41125 | Nov 8, 2022 | Dec 9, 2022 | Not reported |
| 5.4 Medium severity | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass CVE-2022-41091 | Nov 8, 2022 | Dec 9, 2022 | Known |
| 7.8 High severity | Microsoft Windows Print Spooler Privilege Escalation CVE-2022-41073 | Nov 8, 2022 | Dec 9, 2022 | Known |
| 4.4 Medium severity | Samsung Mobile Devices Memory Corruption CVE-2021-25370 | Nov 8, 2022 | Nov 29, 2022 | Not reported |
| 5.5 Medium severity | Samsung Mobile Devices Improper Access Control CVE-2021-25369 | Nov 8, 2022 | Nov 29, 2022 | Not reported |
| 7.1 High severity | Samsung Mobile Devices Improper Access Control CVE-2021-25337 | Nov 8, 2022 | Nov 29, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2022-3723 | Oct 28, 2022 | Nov 18, 2022 | Not reported |
| 7.8 High severity | Apple iOS and iPadOS Out-of-Bounds Write CVE-2022-42827 | Oct 25, 2022 | Nov 15, 2022 | Not reported |
| 7.8 High severity | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking CVE-2020-3433 | Oct 24, 2022 | Nov 14, 2022 | Known |
| 6.5 Medium severity | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path CVE-2020-3153 | Oct 24, 2022 | Nov 14, 2022 | Known |
| 9.8 Critical severity | GIGABYTE Multiple Products Privilege Escalation CVE-2018-19323 | Oct 24, 2022 | Nov 14, 2022 | Known |
| 7.8 High severity | GIGABYTE Multiple Products Code Execution CVE-2018-19322 | Oct 24, 2022 | Nov 14, 2022 | Known |
| 7.8 High severity | GIGABYTE Multiple Products Privilege Escalation CVE-2018-19321 | Oct 24, 2022 | Nov 14, 2022 | Known |
| 7.8 High severity | GIGABYTE Multiple Products Unspecified CVE-2018-19320 | Oct 24, 2022 | Nov 14, 2022 | Known |
| 9.8 Critical severity | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload CVE-2022-41352 | Oct 20, 2022 | Nov 10, 2022 | Known |
| 7.8 High severity | Linux Kernel Privilege Escalation CVE-2021-3493 | Oct 20, 2022 | Nov 10, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows COM+ Event System Service Privilege Escalation CVE-2022-41033 | Oct 11, 2022 | Nov 1, 2022 | Not reported |
| 9.8 Critical severity | Fortinet Multiple Products Authentication Bypass CVE-2022-40684 | Oct 11, 2022 | Nov 1, 2022 | Known |
| 8.0 High severity | Microsoft Exchange Server Remote Code Execution CVE-2022-41082 | Sep 30, 2022 | Oct 21, 2022 | Known |
| 8.8 High severity | Microsoft Exchange Server Server-Side Request Forgery CVE-2022-41040 | Sep 30, 2022 | Oct 21, 2022 | Known |
| 8.8 High severity | Atlassian Bitbucket Server and Data Center Command Injection CVE-2022-36804 | Sep 30, 2022 | Oct 21, 2022 | Not reported |
| 9.8 Critical severity | Sophos Firewall Code Injection CVE-2022-3236 | Sep 23, 2022 | Oct 14, 2022 | Not reported |
| 9.8 Critical severity | Zoho ManageEngine Multiple Products Remote Code Execution CVE-2022-35405 | Sep 22, 2022 | Oct 13, 2022 | Not reported |
| 7.2 High severity | Trend Micro Apex One and Apex One as a Service Improper Validation CVE-2022-40139 | Sep 15, 2022 | Oct 6, 2022 | Not reported |
| 8.8 High severity | Linux Kernel Improper Input Validation CVE-2013-6282 | Sep 15, 2022 | Oct 6, 2022 | Not reported |
| 7.2 High severity | Code Aurora ACDB Audio Driver Stack-based Buffer Overflow CVE-2013-2597 | Sep 15, 2022 | Oct 6, 2022 | Not reported |
| 7.8 High severity | Linux Kernel Integer Overflow CVE-2013-2596 | Sep 15, 2022 | Oct 6, 2022 | Not reported |
| 7.2 High severity | Linux Kernel Privilege Escalation CVE-2013-2094 | Sep 15, 2022 | Oct 6, 2022 | Not reported |
| 9.3 High severity | Microsoft Windows Remote Code Execution CVE-2010-2568 | Sep 15, 2022 | Oct 6, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation CVE-2022-37969 | Sep 14, 2022 | Oct 5, 2022 | Known |
| 7.8 High severity | Apple iOS, iPadOS, and macOS Remote Code Execution CVE-2022-32917 | Sep 14, 2022 | Oct 5, 2022 | Not reported |
| 9.6 Critical severity | Google Chromium Mojo Insufficient Data Validation CVE-2022-3075 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.