Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2020-9907 | Jun 27, 2022 | Jul 18, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2020-3837 | Jun 27, 2022 | Jul 18, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Use-After-Free CVE-2019-8605 | Jun 27, 2022 | Jul 18, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2018-4344 | Jun 27, 2022 | Jul 18, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution CVE-2022-30190 | Jun 14, 2022 | Jul 5, 2022 | Known |
| 8.8 High severity | SAP NetWeaver Unrestricted File Upload CVE-2021-38163 | Jun 9, 2022 | Jun 30, 2022 | Not reported |
| 5.3 Medium severity | SAP NetWeaver Information Disclosure CVE-2016-2388 | Jun 9, 2022 | Jun 30, 2022 | Not reported |
| 9.8 Critical severity | SAP NetWeaver SQL Injection CVE-2016-2386 | Jun 9, 2022 | Jun 30, 2022 | Not reported |
| 9.8 Critical severity | QNAP Photo Station Path Traversal CVE-2019-7195 | Jun 8, 2022 | Jun 22, 2022 | Known |
| 9.8 Critical severity | QNAP Photo Station Path Traversal CVE-2019-7194 | Jun 8, 2022 | Jun 22, 2022 | Known |
| 9.8 Critical severity | QNAP QTS Improper Input Validation CVE-2019-7193 | Jun 8, 2022 | Jun 22, 2022 | Known |
| 9.8 Critical severity | QNAP Photo Station Improper Access Control CVE-2019-7192 | Jun 8, 2022 | Jun 22, 2022 | Known |
| 6.5 Medium severity | Google Chromium V8 Out-of-Bounds Write CVE-2019-5825 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Cisco RV Series Routers Deserialization of Untrusted Data CVE-2019-15271 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Integer Overflow CVE-2018-6065 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Adobe Acrobat and Reader Double Free CVE-2018-4990 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Write CVE-2018-17480 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Remote Code Execution CVE-2018-17463 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 9.8 Critical severity | NETGEAR Multiple Devices Buffer Overflow CVE-2017-6862 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2017-5070 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Memory Corruption CVE-2017-5030 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Memory CVE-2016-5198 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Read CVE-2016-1646 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Buffer Overflow CVE-2013-1331 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Adobe Flash Player Integer Overflow CVE-2012-5054 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.1 High severity | Microsoft Internet Explorer Use-After-Free CVE-2012-4969 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Microsoft XML Core Services Memory Corruption CVE-2012-1889 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 6.1 Medium severity | Adobe Flash Player Cross-Site Scripting (XSS) CVE-2012-0767 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.1 High severity | Adobe Flash Player Memory Corruption CVE-2012-0754 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Authenticode Signature Verification Remote Code Execution CVE-2012-0151 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 9.8 Critical severity | Adobe Reader and Acrobat Universal 3D Memory Corruption CVE-2011-2462 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Adobe Flash Player Unspecified CVE-2011-0609 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.3 High severity | Adobe Acrobat and Reader Stack-Based Buffer Overflow CVE-2010-2883 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Microsoft PowerPoint Buffer Overflow CVE-2010-2572 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Adobe Flash Player Memory Corruption CVE-2010-1297 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Adobe Acrobat and Reader Use-After-Free CVE-2009-4324 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 8.8 High severity | Adobe Acrobat and Reader Universal 3D Remote Code Execution CVE-2009-3953 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Adobe Acrobat and Reader, Flash Player Unspecified CVE-2009-1862 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Buffer Overflow CVE-2009-0563 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Object Record Corruption CVE-2009-0557 | Jun 8, 2022 | Jun 22, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.