Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 10.0 Critical severity | VMware Spring Cloud Gateway Code Injection CVE-2022-22947 | May 16, 2022 | Jun 6, 2022 | Not reported |
| 9.8 Critical severity | F5 BIG-IP Missing Authentication CVE-2022-1388 | May 10, 2022 | May 31, 2022 | Known |
| 8.8 High severity | Apple Multiple Products Type Confusion CVE-2021-1789 | May 4, 2022 | May 25, 2022 | Not reported |
| 8.8 High severity | Apple Multiple Products Type Confusion CVE-2019-8506 | May 4, 2022 | May 25, 2022 | Not reported |
| 7.2 High severity | Microsoft Win32k Privilege Escalation CVE-2014-4113 | May 4, 2022 | May 25, 2022 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Use-After-Free CVE-2014-0322 | May 4, 2022 | May 25, 2022 | Not reported |
| 7.5 High severity | OpenSSL Information Disclosure CVE-2014-0160 | May 4, 2022 | May 25, 2022 | Not reported |
| 9.8 Critical severity | WSO2 Multiple Products Unrestrictive Upload of File CVE-2022-29464 | Apr 25, 2022 | May 16, 2022 | Known |
| 4.4 Medium severity | Microsoft Windows User Profile Service Privilege Escalation CVE-2022-26904 | Apr 25, 2022 | May 16, 2022 | Not reported |
| 6.9 Medium severity | Microsoft Windows User Profile Service Privilege Escalation CVE-2022-21919 | Apr 25, 2022 | May 16, 2022 | Not reported |
| 7.8 High severity | Linux Kernel Privilege Escalation CVE-2022-0847 | Apr 25, 2022 | May 16, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2021-41357 | Apr 25, 2022 | May 16, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2021-40450 | Apr 25, 2022 | May 16, 2022 | Not reported |
| 9.9 Critical severity | Jenkins Script Security Plugin Sandbox Bypass CVE-2019-1003029 | Apr 25, 2022 | May 16, 2022 | Not reported |
| 7.2 High severity | Microsoft Windows Print Spooler Privilege Escalation CVE-2022-22718 | Apr 19, 2022 | May 10, 2022 | Not reported |
| 9.8 Critical severity | WhatsApp VOIP Stack Buffer Overflow CVE-2019-3568 | Apr 19, 2022 | May 10, 2022 | Not reported |
| 6.1 Medium severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) CVE-2018-6882 | Apr 19, 2022 | May 10, 2022 | Known |
| 7.8 High severity | VMware Multiple Products Privilege Escalation CVE-2022-22960 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2022-1364 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 9.8 Critical severity | Crestron Multiple Products Command Injection CVE-2019-3929 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 9.8 Critical severity | D-Link DNS-320 Remote Code Execution CVE-2019-16057 | Apr 15, 2022 | May 6, 2022 | Known |
| 9.8 Critical severity | Schneider Electric U.motion Builder SQL Injection CVE-2018-7841 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 7.5 High severity | Trihedral VTScada (formerly VTS) Denial-of-Service CVE-2016-4523 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 9.8 Critical severity | InduSoft Web Studio NTWebServer Directory Traversal CVE-2014-0780 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 9.8 Critical severity | Ubiquiti AirOS Command Injection CVE-2010-5330 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 9.8 Critical severity | Alcatel OmniPCX Enterprise Remote Code Execution CVE-2007-3010 | Apr 15, 2022 | May 6, 2022 | Not reported |
| 9.8 Critical severity | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection CVE-2022-22954 | Apr 14, 2022 | May 5, 2022 | Known |
| 4.6 Medium severity | Microsoft Windows CLFS Driver Privilege Escalation CVE-2022-24521 | Apr 13, 2022 | May 4, 2022 | Known |
| 9.8 Critical severity | Drupal Core Remote Code Execution CVE-2018-7602 | Apr 13, 2022 | May 4, 2022 | Known |
| 9.8 Critical severity | Kaseya VSA Remote Code Execution CVE-2018-20753 | Apr 13, 2022 | May 4, 2022 | Known |
| 9.8 Critical severity | Adobe Flash Player Use-After-Free CVE-2015-5123 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 9.8 Critical severity | Adobe Flash Player Use-After-Free CVE-2015-5122 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 9.8 Critical severity | Adobe Flash Player Heap-Based Buffer Overflow CVE-2015-3113 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Memory Corruption CVE-2015-2502 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 9.8 Critical severity | Adobe Flash Player Use-After-Free CVE-2015-0313 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 9.8 Critical severity | Adobe Flash Player Remote Code Execution CVE-2015-0311 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 10.0 High severity | Adobe Flash Player Stack-Based Buffer Overflow CVE-2014-9163 | Apr 13, 2022 | May 4, 2022 | Not reported |
| 8.8 High severity | WatchGuard Firebox and XTM Privilege Escalation CVE-2022-23176 | Apr 11, 2022 | May 2, 2022 | Not reported |
| 8.8 High severity | Microsoft Active Directory Domain Services Privilege Escalation CVE-2021-42287 | Apr 11, 2022 | May 2, 2022 | Known |
| 7.5 High severity | Microsoft Active Directory Domain Services Privilege Escalation CVE-2021-42278 | Apr 11, 2022 | May 2, 2022 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.