Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Google Pixel Out-of-Bounds Write CVE-2021-39793 | Apr 11, 2022 | May 2, 2022 | Not reported |
| 9.8 Critical severity | Checkbox Survey Deserialization of Untrusted Data CVE-2021-27852 | Apr 11, 2022 | May 2, 2022 | Not reported |
| 7.0 High severity | Linux Kernel Privilege Escalation CVE-2021-22600 | Apr 11, 2022 | May 2, 2022 | Not reported |
| 9.8 Critical severity | QNAP Network-Attached Storage (NAS) Command Injection CVE-2020-2509 | Apr 11, 2022 | May 2, 2022 | Not reported |
| 9.8 Critical severity | Telerik UI for ASP.NET AJAX Unrestricted File Upload CVE-2017-11317 | Apr 11, 2022 | May 2, 2022 | Not reported |
| 7.8 High severity | Sudo Heap-Based Buffer Overflow CVE-2021-3156 | Apr 6, 2022 | Apr 27, 2022 | Not reported |
| 9.8 Critical severity | Microsoft HTTP Protocol Stack Remote Code Execution CVE-2021-31166 | Apr 6, 2022 | Apr 27, 2022 | Not reported |
| 8.1 High severity | Microsoft SMBv1 Server Remote Code Execution CVE-2017-0148 | Apr 6, 2022 | Apr 27, 2022 | Known |
| 9.8 Critical severity | Spring Framework JDK 9+ Remote Code Execution CVE-2022-22965 | Apr 4, 2022 | Apr 25, 2022 | Not reported |
| 7.8 High severity | Apple macOS Out-of-Bounds Write CVE-2022-22675 | Apr 4, 2022 | Apr 25, 2022 | Not reported |
| 5.5 Medium severity | Apple macOS Out-of-Bounds Read CVE-2022-22674 | Apr 4, 2022 | Apr 25, 2022 | Not reported |
| 9.8 Critical severity | D-Link Multiple Routers Remote Code Execution CVE-2021-45382 | Apr 4, 2022 | Apr 25, 2022 | Not reported |
| 9.8 Critical severity | Trend Micro Apex Central Arbitrary File Upload CVE-2022-26871 | Mar 31, 2022 | Apr 21, 2022 | Not reported |
| 9.8 Critical severity | Sophos Firewall Authentication Bypass CVE-2022-1040 | Mar 31, 2022 | Apr 21, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows User Profile Service Privilege Escalation CVE-2021-34484 | Mar 31, 2022 | Apr 21, 2022 | Not reported |
| 9.8 Critical severity | QNAP NAS Improper Authorization CVE-2021-28799 | Mar 31, 2022 | Apr 21, 2022 | Known |
| 7.8 High severity | Dell dbutil Driver Insufficient Access Control CVE-2021-21551 | Mar 31, 2022 | Apr 21, 2022 | Not reported |
| 9.8 Critical severity | Dasan GPON Routers Command Injection CVE-2018-10562 | Mar 31, 2022 | Apr 21, 2022 | Known |
| 9.8 Critical severity | Dasan GPON Routers Authentication Bypass CVE-2018-10561 | Mar 31, 2022 | Apr 21, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2022-1096 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 10.0 Critical severity | Debian-specific Redis Server Lua Sandbox Escape CVE-2022-0543 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Access Connectivity Engine Remote Code Execution CVE-2021-38646 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.8 High severity | Microsoft Windows Event Tracing Privilege Escalation CVE-2021-34486 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 5.3 Medium severity | Atlassian Confluence Server Pre-Authorization Arbitrary File Read CVE-2021-26085 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 9.8 Critical severity | SonicWall Secure Remote Access (SRA) SQL Injection CVE-2021-20028 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.5 High severity | SonicWall SMA100 Directory Traversal CVE-2019-7483 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Privilege Escalation CVE-2018-8440 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.8 High severity | Microsoft DirectX Graphics Kernel Privilege Escalation CVE-2018-8406 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.8 High severity | Microsoft DirectX Graphics Kernel Privilege Escalation CVE-2018-8405 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.3 High severity | Microsoft Windows Privilege Escalation CVE-2017-0213 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 4.3 Medium severity | Microsoft Internet Explorer Information Disclosure CVE-2017-0059 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 8.1 High severity | Microsoft Edge and Internet Explorer Type Confusion CVE-2017-0037 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 8.8 High severity | Microsoft Edge Memory Corruption CVE-2016-7201 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 8.8 High severity | Microsoft Edge Memory Corruption CVE-2016-7200 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Memory Corruption CVE-2016-0189 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.8 High severity | Microsoft Windows CSRSS Security Feature Bypass CVE-2016-0151 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 7.8 High severity | Microsoft Windows Kernel Privilege Escalation CVE-2016-0040 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 9.3 High severity | Microsoft Windows Adobe Type Manager Library Remote Code Execution CVE-2015-2426 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Memory Corruption CVE-2015-2419 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 8.8 High severity | Microsoft Office Uninitialized Memory Use CVE-2015-1770 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.