Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | QNAP NAS File Station Command Injection CVE-2018-19949 | May 24, 2022 | Jun 14, 2022 | Known |
| 5.4 Medium severity | QNAP NAS File Station Cross-Site Scripting CVE-2018-19943 | May 24, 2022 | Jun 14, 2022 | Known |
| 9.8 Critical severity | Microsoft Windows Search Remote Code Execution CVE-2017-8543 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 7.8 High severity | Artifex Ghostscript Type Confusion CVE-2017-8291 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 9.8 Critical severity | Kaseya VSA SQL Injection CVE-2017-18362 | May 24, 2022 | Jun 14, 2022 | Known |
| 8.8 High severity | Microsoft Internet Explorer Privilege Escalation CVE-2017-0210 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Memory Corruption CVE-2017-0149 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 7.5 High severity | Microsoft Windows SMBv1 Information Disclosure CVE-2017-0147 | May 24, 2022 | Jun 14, 2022 | Known |
| 6.5 Medium severity | Microsoft XML Core Services Information Disclosure CVE-2017-0022 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation CVE-2017-0005 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 7.8 High severity | Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution CVE-2016-6367 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 8.8 High severity | Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow CVE-2016-6366 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 8.8 High severity | Apple iOS Webkit Memory Corruption CVE-2016-4657 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 7.8 High severity | Apple iOS Memory Corruption CVE-2016-4656 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 5.5 Medium severity | Apple iOS Information Disclosure CVE-2016-4655 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 6.5 Medium severity | Microsoft Internet Explorer and Edge Information Disclosure CVE-2016-3351 | May 24, 2022 | Jun 14, 2022 | Known |
| 6.5 Medium severity | Microsoft Internet Explorer Messaging API Information Disclosure CVE-2016-3298 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 4.3 Medium severity | Microsoft Internet Explorer Information Disclosure CVE-2016-0162 | May 24, 2022 | Jun 14, 2022 | Not reported |
| 6.5 Medium severity | Cisco IOS XR Open Port CVE-2022-20821 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2021-30883 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Android Kernel Use-After-Free CVE-2021-1048 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 6.4 Medium severity | Android Kernel Race Condition CVE-2021-0920 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Kernel Privilege Escalation CVE-2020-1027 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Microsoft Update Notification Manager Privilege Escalation CVE-2020-0638 | May 23, 2022 | Jun 13, 2022 | Known |
| 8.8 High severity | WebKitGTK Memory Corruption CVE-2019-8720 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Apple iOS Memory Corruption CVE-2019-7287 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2019-7286 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 6.5 Medium severity | Google Chrome Blink Use-After-Free CVE-2019-5786 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 8.2 High severity | WhatsApp Cross-Site Scripting CVE-2019-18426 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows AppX Deployment Extensions Privilege Escalation CVE-2019-1385 | May 23, 2022 | Jun 13, 2022 | Known |
| 8.8 High severity | Google Chrome WebAudio Use-After-Free CVE-2019-13720 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 10.0 Critical severity | Mozilla Firefox and Thunderbird Sandbox Escape CVE-2019-11708 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 8.8 High severity | Mozilla Firefox and Thunderbird Type Confusion CVE-2019-11707 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows AppX Deployment Service Privilege Escalation CVE-2019-1130 | May 23, 2022 | Jun 13, 2022 | Known |
| 7.8 High severity | Microsoft Windows Privilege Escalation CVE-2019-0880 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 6.5 Medium severity | Microsoft Windows SMB Information Disclosure CVE-2019-0703 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 6.5 Medium severity | Microsoft Internet Explorer Information Disclosure CVE-2019-0676 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2018-8589 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 7.8 High severity | Adobe Flash Player Stack-based Buffer Overflow CVE-2018-5002 | May 23, 2022 | Jun 13, 2022 | Not reported |
| 9.8 Critical severity | Zyxel Multiple Firewalls OS Command Injection CVE-2022-30525 | May 16, 2022 | Jun 6, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.