Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2013-3660 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 9.8 Critical severity | Adobe Reader and Acrobat Arbitrary Integer Overflow CVE-2013-2729 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Use-After-Free CVE-2013-2551 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 10.0 High severity | Oracle Java SE Unspecified CVE-2013-2465 | Mar 28, 2022 | Apr 18, 2022 | Known |
| 8.8 High severity | Mozilla Firefox and Thunderbird Denial-of-Service CVE-2013-1690 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 10.0 High severity | Oracle Java SE Sandbox Bypass CVE-2012-5076 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 9.3 High severity | Microsoft Word Remote Code Execution CVE-2012-2539 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 7.5 High severity | Adobe Flash Player Memory Corruption CVE-2012-2034 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 4.7 Medium severity | Oracle Fusion Middleware Unspecified CVE-2012-0518 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 7.8 High severity | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation CVE-2011-2005 | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Kernel Stack-Based Buffer Overflow CVE-2010-4398 | Mar 28, 2022 | Apr 21, 2022 | Not reported |
| 9.8 Critical severity | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution CVE-2022-26318 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | MiCollab, MiVoice Business Express Access Control CVE-2022-26143 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 4.6 Medium severity | Microsoft Windows Print Spooler Privilege Escalation CVE-2022-21999 | Mar 25, 2022 | Apr 15, 2022 | Known |
| 9.8 Critical severity | Sitecore XP Remote Command Execution CVE-2021-42237 | Mar 25, 2022 | Apr 15, 2022 | Known |
| 9.8 Critical severity | Citrix ShareFile Improper Access Control CVE-2021-22941 | Mar 25, 2022 | Apr 15, 2022 | Known |
| 8.8 High severity | D-Link DIR-610 Devices Remote Command Execution CVE-2020-9377 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | Zyxel Multiple NAS Devices OS Command Injection CVE-2020-9054 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | OpenSMTPD Remote Code Execution CVE-2020-7247 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 7.5 High severity | VMware Tanzu Spring Cloud Config Directory Traversal CVE-2020-5410 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | Sophos SG UTM Remote Code Execution CVE-2020-25223 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | QNAP Helpdesk Improper Access Control CVE-2020-2506 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 10.0 Critical severity | Palo Alto Networks PAN-OS Authentication Bypass CVE-2020-2021 | Mar 25, 2022 | Apr 15, 2022 | Known |
| 8.8 High severity | Apache Kylin OS Command Injection CVE-2020-1956 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | Juniper Junos OS Path Traversal CVE-2020-1631 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 8.1 High severity | Drupal Core Remote Code Execution CVE-2019-6340 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 7.2 High severity | Oracle BI Publisher Unauthorized Access CVE-2019-2616 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | D-Link Multiple Routers Command Injection CVE-2019-16920 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | Webmin Command Injection CVE-2019-15107 | Mar 25, 2022 | Apr 15, 2022 | Known |
| 8.8 High severity | Citrix SD-WAN and NetScaler Command Injection CVE-2019-12991 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | Citrix SD-WAN and NetScaler SQL Injection CVE-2019-12989 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | PHP FastCGI Process Manager (FPM) Buffer Overflow CVE-2019-11043 | Mar 25, 2022 | Apr 15, 2022 | Known |
| 9.8 Critical severity | Kentico Xperience Deserialization of Untrusted Data CVE-2019-10068 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.9 Critical severity | Jenkins Matrix Project Plugin Remote Code Execution CVE-2019-1003030 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 8.8 High severity | Microsoft GDI Remote Code Execution CVE-2019-0903 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 8.8 High severity | Microsoft Windows Shell Remote Code Execution CVE-2018-8414 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 7.5 High severity | Microsoft Scripting Engine Memory Corruption CVE-2018-8373 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 8.1 High severity | VMware SD-WAN Edge by VeloCloud Command Injection CVE-2018-6961 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | LG N1A1 NAS Remote Command Execution CVE-2018-14839 | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| 9.8 Critical severity | VMware Tanzu Spring Data Commons Property Binder CVE-2018-1273 | Mar 25, 2022 | Apr 15, 2022 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.