Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | Apache Struts 2 Improper Input Validation CVE-2012-0391 | Jan 21, 2022 | Jul 21, 2022 | Not reported |
| 7.5 High severity | Apache Struts 1 ActionForm Denial-of-Service CVE-2006-1547 | Jan 21, 2022 | Jul 21, 2022 | Not reported |
| 9.8 Critical severity | Aviatrix Controller Unrestricted Upload of File CVE-2021-40870 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 7.5 High severity | Microsoft Exchange Server Information Disclosure CVE-2021-33766 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 9.1 Critical severity | October CMS Improper Authentication CVE-2021-32648 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 8.8 High severity | Nagios XI OS Command Injection CVE-2021-25298 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 8.8 High severity | Nagios XI OS Command Injection CVE-2021-25297 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 8.8 High severity | Nagios XI OS Command Injection CVE-2021-25296 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 9.8 Critical severity | F5 BIG-IP Traffic Management Microkernel Buffer Overflow CVE-2021-22991 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 7.5 High severity | VMware Server Side Request Forgery in vRealize Operations Manager API CVE-2021-21975 | Jan 18, 2022 | Feb 1, 2022 | Known |
| 7.8 High severity | System Information Library for Node.JS Command Injection CVE-2021-21315 | Jan 18, 2022 | Feb 1, 2022 | Not reported |
| 7.8 High severity | Oracle Business Intelligence Enterprise Edition Path Transversal CVE-2020-14864 | Jan 18, 2022 | Jul 18, 2022 | Not reported |
| 9.8 Critical severity | Apache Airflow's Experimental API Authentication Bypass CVE-2020-13927 | Jan 18, 2022 | Jul 18, 2022 | Not reported |
| 8.8 High severity | Drupal core Un-restricted Upload of File CVE-2020-13671 | Jan 18, 2022 | Jul 18, 2022 | Not reported |
| 8.8 High severity | Apache Airflow Command Injection CVE-2020-11978 | Jan 18, 2022 | Jul 18, 2022 | Not reported |
| 9.8 Critical severity | Hikvision Improper Input Validation CVE-2021-36260 | Jan 10, 2022 | Jan 24, 2022 | Not reported |
| 8.8 High severity | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit CVE-2021-27860 | Jan 10, 2022 | Jan 24, 2022 | Not reported |
| 5.3 Medium severity | VMware vCenter Server Improper Access Control CVE-2021-22017 | Jan 10, 2022 | Jan 24, 2022 | Not reported |
| 8.8 High severity | Google Chrome Media Use-After-Free CVE-2020-6572 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 9.8 Critical severity | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference CVE-2019-9670 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 10.0 Critical severity | Kibana Arbitrary Code Execution CVE-2019-7609 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 9.8 Critical severity | Oracle WebLogic Server, Injection CVE-2019-2725 | Jan 10, 2022 | Jul 10, 2022 | Known |
| 8.1 High severity | Palo Alto Networks PAN-OS Remote Code Execution CVE-2019-1579 | Jan 10, 2022 | Jul 10, 2022 | Known |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2019-1458 | Jan 10, 2022 | Jul 10, 2022 | Known |
| 9.8 Critical severity | Exim Mail Transfer Agent (MTA) Improper Input Validation CVE-2019-10149 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 6.5 Medium severity | Fortinet FortiOS and FortiProxy Out-of-bounds Write CVE-2018-13383 | Jan 10, 2022 | Jul 10, 2022 | Known |
| 7.5 High severity | Fortinet FortiOS and FortiProxy Improper Authorization CVE-2018-13382 | Jan 10, 2022 | Jul 10, 2022 | Known |
| 9.8 Critical severity | Primetek Primefaces Remote Code Execution CVE-2017-1000486 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 9.8 Critical severity | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. CVE-2015-7450 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 8.8 High severity | Microsoft WinVerifyTrust function Remote Code Execution CVE-2013-3900 | Jan 10, 2022 | Jul 10, 2022 | Not reported |
| 7.1 High severity | Microsoft Windows AppX Installer Spoofing CVE-2021-43890 | Dec 15, 2021 | Dec 29, 2021 | Known |
| 8.8 High severity | Google Chromium V8 Use-After-Free CVE-2021-4102 | Dec 15, 2021 | Dec 29, 2021 | Not reported |
| 9.8 Critical severity | Zoho Desktop Central Authentication Bypass CVE-2021-44515 | Dec 10, 2021 | Dec 24, 2021 | Not reported |
| 10.0 Critical severity | Apache Log4j2 Remote Code Execution CVE-2021-44228 | Dec 10, 2021 | Dec 24, 2021 | Known |
| 7.8 High severity | Fortinet FortiOS Arbitrary File Download CVE-2021-44168 | Dec 10, 2021 | Dec 24, 2021 | Not reported |
| 9.8 Critical severity | Realtek Jungle SDK Remote Code Execution CVE-2021-35394 | Dec 10, 2021 | Dec 24, 2021 | Not reported |
| 7.2 High severity | Pi-Hole AdminLTE Remote Code Execution CVE-2020-8816 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 9.8 Critical severity | Fuel CMS SQL Injection CVE-2020-17463 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 9.8 Critical severity | Sonatype Nexus Repository Manager Incorrect Access Control CVE-2019-7238 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 7.8 High severity | Linux Kernel Improper Privilege Management CVE-2019-13272 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.