Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.1 Critical severity | QNAP Photo Station Externally Controlled Reference CVE-2022-27593 | Sep 8, 2022 | Sep 29, 2022 | Known |
| 9.8 Critical severity | D-Link DIR-820L Remote Code Execution CVE-2022-26258 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 5.5 Medium severity | Apple iOS, iPadOS, and macOS Input Validation CVE-2020-9934 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 9.8 Critical severity | MikroTik RouterOS Stack-Based Buffer Overflow CVE-2018-7445 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 9.8 Critical severity | D-Link Multiple Routers OS Command Injection CVE-2018-6530 | Sep 8, 2022 | Sep 29, 2022 | Known |
| 9.8 Critical severity | Oracle WebLogic Server Unspecified CVE-2018-2628 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 4.3 Medium severity | Fortinet FortiOS and FortiADC Improper Access Control CVE-2018-13374 | Sep 8, 2022 | Sep 29, 2022 | Known |
| 8.1 High severity | NETGEAR Multiple Devices Exposure of Sensitive Information CVE-2017-5521 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 6.8 Medium severity | D-Link DIR-300 Router Cleartext Storage of a Password CVE-2011-4723 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 7.8 High severity | Android OS Privilege Escalation CVE-2011-1823 | Sep 8, 2022 | Sep 29, 2022 | Not reported |
| 9.8 Critical severity | dotCMS Unrestricted Upload of File CVE-2022-26352 | Aug 25, 2022 | Sep 15, 2022 | Known |
| 9.8 Critical severity | Apache CouchDB Insecure Default Initialization of Resource CVE-2022-24706 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 9.8 Critical severity | Apache APISIX Authentication Bypass CVE-2022-24112 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 9.8 Critical severity | VMware Tanzu Spring Cloud Function Remote Code Execution CVE-2022-22963 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 8.8 High severity | WebRTC Heap Buffer Overflow CVE-2022-2294 | Aug 25, 2022 | Sep 15, 2022 | Known |
| 7.3 High severity | Grafana Authentication Bypass CVE-2021-39226 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 7.8 High severity | Delta Electronics DOPSoft 2 Improper Input Validation CVE-2021-38406 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 7.5 High severity | Apple iOS, macOS, watchOS Sandbox Bypass CVE-2021-31010 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 7.5 High severity | PEAR Archive_Tar Improper Link Resolution CVE-2020-36193 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 7.8 High severity | PEAR Archive_Tar Deserialization of Untrusted Data CVE-2020-28949 | Aug 25, 2022 | Sep 15, 2022 | Not reported |
| 8.6 High severity | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service CVE-2022-0028 | Aug 22, 2022 | Sep 12, 2022 | Not reported |
| 7.8 High severity | Apple iOS and macOS Out-of-Bounds Write CVE-2022-32894 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 8.8 High severity | Apple iOS and macOS Out-of-Bounds Write CVE-2022-32893 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 6.5 Medium severity | Google Chromium Intents Insufficient Input Validation CVE-2022-2856 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 9.0 High severity | Microsoft Active Directory Domain Services Privilege Escalation CVE-2022-26923 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 10.0 Critical severity | SAP Multiple Products HTTP Request Smuggling CVE-2022-22536 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 9.3 High severity | Microsoft Windows Runtime Remote Code Execution CVE-2022-21971 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 9.8 Critical severity | Palo Alto Networks PAN-OS Remote Code Execution CVE-2017-15944 | Aug 18, 2022 | Sep 8, 2022 | Not reported |
| 9.8 Critical severity | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass CVE-2022-37042 | Aug 11, 2022 | Sep 1, 2022 | Known |
| 7.2 High severity | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload CVE-2022-27925 | Aug 11, 2022 | Sep 1, 2022 | Known |
| 7.8 High severity | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution CVE-2022-34713 | Aug 9, 2022 | Aug 30, 2022 | Not reported |
| 7.5 High severity | RARLAB UnRAR Directory Traversal CVE-2022-30333 | Aug 9, 2022 | Aug 30, 2022 | Known |
| 7.5 High severity | Synacor Zimbra Collaboration Suite (ZCS) Command Injection CVE-2022-27924 | Aug 4, 2022 | Aug 25, 2022 | Known |
| 9.8 Critical severity | Atlassian Questions For Confluence App Hard-coded Credentials CVE-2022-26138 | Jul 29, 2022 | Aug 19, 2022 | Not reported |
| 7.2 High severity | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation CVE-2022-22047 | Jul 12, 2022 | Aug 2, 2022 | Not reported |
| 5.9 Medium severity | Microsoft Windows LSA Spoofing CVE-2022-26925 | Jul 1, 2022 | Jul 22, 2022 | Not reported |
| 9.8 Critical severity | Mitel MiVoice Connect Data Validation CVE-2022-29499 | Jun 27, 2022 | Jul 18, 2022 | Known |
| 7.8 High severity | Red Hat Polkit Out-of-Bounds Read and Write CVE-2021-4034 | Jun 27, 2022 | Jul 18, 2022 | Known |
| 7.8 High severity | Apple iOS and iPadOS Buffer Overflow CVE-2021-30983 | Jun 27, 2022 | Jul 18, 2022 | Not reported |
| 6.5 Medium severity | Google Chromium PopupBlocker Security Bypass CVE-2021-30533 | Jun 27, 2022 | Jul 18, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.