Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 8.8 High severity | Microsoft Internet Explorer Remote Code Execution CVE-2017-0222 | Feb 25, 2022 | Aug 25, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Code Injection CVE-2014-6352 | Feb 25, 2022 | Aug 25, 2022 | Not reported |
| 5.3 Medium severity | Zabbix Frontend Improper Access Control CVE-2022-23134 | Feb 22, 2022 | Mar 8, 2022 | Not reported |
| 9.8 Critical severity | Zabbix Frontend Authentication Bypass CVE-2022-23131 | Feb 22, 2022 | Mar 8, 2022 | Not reported |
| 10.0 High severity | Adobe Commerce and Magento Open Source Improper Input Validation CVE-2022-24086 | Feb 15, 2022 | Mar 1, 2022 | Not reported |
| 8.8 High severity | Google Chromium Animation Use-After-Free CVE-2022-0609 | Feb 15, 2022 | Mar 1, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Type Confusion CVE-2019-0752 | Feb 15, 2022 | Aug 15, 2022 | Known |
| 7.5 High severity | Microsoft Windows VBScript Engine Out-of-Bounds Write CVE-2018-8174 | Feb 15, 2022 | Aug 15, 2022 | Known |
| 7.8 High severity | WinRAR Absolute Path Traversal CVE-2018-20250 | Feb 15, 2022 | Aug 15, 2022 | Known |
| 7.8 High severity | Adobe Flash Player Use-After-Free CVE-2018-15982 | Feb 15, 2022 | Aug 15, 2022 | Known |
| 9.8 Critical severity | PHPUnit Command Injection CVE-2017-9841 | Feb 15, 2022 | Aug 15, 2022 | Not reported |
| 9.3 High severity | Microsoft Word Memory Corruption CVE-2014-1761 | Feb 15, 2022 | Aug 15, 2022 | Not reported |
| 7.8 High severity | Microsoft Graphics Component Memory Corruption CVE-2013-3906 | Feb 15, 2022 | Aug 15, 2022 | Not reported |
| 8.8 High severity | Apple iOS, iPadOS, and macOS Webkit Use-After-Free CVE-2022-22620 | Feb 11, 2022 | Feb 25, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows SAM Local Privilege Escalation CVE-2021-36934 | Feb 10, 2022 | Feb 24, 2022 | Not reported |
| 10.0 Critical severity | Microsoft SMBv3 Remote Code Execution CVE-2020-0796 | Feb 10, 2022 | Aug 10, 2022 | Known |
| 9.8 Critical severity | Jenkins Stapler Web Framework Deserialization of Untrusted Data CVE-2018-1000861 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 9.8 Critical severity | Apache Struts 1 Improper Input Validation CVE-2017-9791 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 8.8 High severity | Microsoft Windows Shell (.lnk) Remote Code Execution CVE-2017-8464 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 7.5 High severity | Oracle Corporation WebLogic Server Remote Code Execution CVE-2017-10271 | Feb 10, 2022 | Aug 10, 2022 | Known |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2017-0263 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Remote Code Execution CVE-2017-0262 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 8.8 High severity | Microsoft SMBv1 Remote Code Execution CVE-2017-0145 | Feb 10, 2022 | Aug 10, 2022 | Known |
| 8.8 High severity | Microsoft SMBv1 Remote Code Execution CVE-2017-0144 | Feb 10, 2022 | Aug 10, 2022 | Known |
| 9.8 Critical severity | Apache ActiveMQ Improper Input Validation CVE-2016-3088 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 8.8 High severity | D-Link DIR-645 Router Remote Code Execution CVE-2015-2051 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 10.0 High severity | Microsoft HTTP.sys Remote Code Execution CVE-2015-1635 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 7.8 High severity | Apple OS X Authentication Bypass CVE-2015-1130 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 7.8 High severity | Apple OS X Heap-Based Buffer Overflow CVE-2014-4404 | Feb 10, 2022 | Aug 10, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2022-21882 | Feb 4, 2022 | Feb 18, 2022 | Known |
| 9.8 Critical severity | Apple Memory Corruption CVE-2022-22587 | Jan 28, 2022 | Feb 11, 2022 | Not reported |
| 9.8 Critical severity | SonicWall SMA 100 Appliances Stack-Based Buffer Overflow CVE-2021-20038 | Jan 28, 2022 | Feb 11, 2022 | Known |
| 9.8 Critical severity | Grandstream Networks UCM6200 Series SQL Injection CVE-2020-5722 | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management CVE-2020-0787 | Jan 28, 2022 | Jul 28, 2022 | Known |
| 9.8 Critical severity | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation CVE-2017-5689 | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| 9.8 Critical severity | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution CVE-2014-7169 | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| 9.8 Critical severity | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution CVE-2014-6271 | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| 10.0 High severity | Microsoft Internet Explorer Memory Corruption CVE-2014-1776 | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| 5.3 Medium severity | SolarWinds Serv-U Improper Input Validation CVE-2021-35247 | Jan 21, 2022 | Feb 4, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2018-8453 | Jan 21, 2022 | Jul 21, 2022 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.