Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.9 Critical severity | MongoDB mongo-express Remote Code Execution CVE-2019-10758 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 7.2 High severity | Apache Solr DataImportHandler Code Injection CVE-2019-0193 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 8.1 High severity | Embedthis GoAhead Remote Code Execution CVE-2017-17562 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 9.8 Critical severity | Red Hat JBoss Application Server Remote Code Execution CVE-2017-12149 | Dec 10, 2021 | Jun 10, 2022 | Known |
| 8.8 High severity | Red Hat Linux JBoss Seam 2 Remote Code Execution CVE-2010-1871 | Dec 10, 2021 | Jun 10, 2022 | Not reported |
| 9.8 Critical severity | Zoho ManageEngine ServiceDesk Plus Remote Code Execution CVE-2021-44077 | Dec 1, 2021 | Dec 15, 2021 | Not reported |
| 9.0 Critical severity | Apache HTTP Server-Side Request Forgery (SSRF) CVE-2021-40438 | Dec 1, 2021 | Dec 15, 2021 | Known |
| 9.8 Critical severity | Zoho ManageEngine ServiceDesk Authentication Bypass CVE-2021-37415 | Dec 1, 2021 | Dec 15, 2021 | Not reported |
| 7.8 High severity | Qualcomm Multiple Chipsets Improper Input Validation CVE-2020-11261 | Dec 1, 2021 | Jun 1, 2022 | Not reported |
| 9.1 Critical severity | MikroTik Router OS Directory Traversal CVE-2018-14847 | Dec 1, 2021 | Jun 1, 2022 | Not reported |
| 8.8 High severity | Microsoft Exchange Server Remote Code Execution CVE-2021-42321 | Nov 17, 2021 | Dec 1, 2021 | Known |
| 7.8 High severity | Microsoft Excel Security Feature Bypass CVE-2021-42292 | Nov 17, 2021 | Dec 1, 2021 | Not reported |
| 7.8 High severity | Microsoft Windows Win32k Privilege Escalation CVE-2021-40449 | Nov 17, 2021 | Dec 1, 2021 | Known |
| 7.8 High severity | ExifTool Remote Code Execution CVE-2021-22204 | Nov 17, 2021 | Dec 1, 2021 | Not reported |
| 9.8 Critical severity | BQE BillQuick Web Suite SQL Injection CVE-2021-42258 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | Apache HTTP Server Path Traversal CVE-2021-42013 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | Apache HTTP Server Path Traversal CVE-2021-41773 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | Zoho ManageEngine ADSelfService Plus Authentication Bypass CVE-2021-40539 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Microsoft MSHTML Remote Code Execution CVE-2021-40444 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Microsoft Open Management Infrastructure (OMI) Privilege Escalation CVE-2021-38649 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.8 High severity | Microsoft Open Management Infrastructure (OMI) Privilege Escalation CVE-2021-38648 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Microsoft Open Management Infrastructure (OMI) Remote Code Execution CVE-2021-38647 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Microsoft Open Management Infrastructure (OMI) Privilege Escalation CVE-2021-38645 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium V8 Memory Corruption CVE-2021-38003 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 6.1 Medium severity | Google Chromium Intents Improper Input Validation CVE-2021-38000 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 6.5 Medium severity | Google Chromium Information Disclosure CVE-2021-37976 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium V8 Use-After-Free CVE-2021-37975 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.6 Critical severity | Google Chromium Portals Use-After-Free CVE-2021-37973 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation CVE-2021-36955 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Microsoft Windows Update Medic Service Privilege Escalation CVE-2021-36948 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.5 High severity | Microsoft Windows Local Security Authority (LSA) Spoofing CVE-2021-36942 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Trend Micro Multiple Products Improper Input Validation CVE-2021-36742 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Trend Micro Multiple Products Improper Input Validation CVE-2021-36741 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | ForgeRock Access Management (AM) Core Server Remote Code Execution CVE-2021-35464 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | Realtek AP-Router SDK Buffer Overflow CVE-2021-35395 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 10.0 Critical severity | SolarWinds Serv-U Remote Code Execution CVE-2021-35211 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 8.8 High severity | Microsoft Windows Print Spooler Remote Code Execution CVE-2021-34527 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Microsoft Exchange Server Privilege Escalation CVE-2021-34523 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | Microsoft Exchange Server Remote Code Execution CVE-2021-34473 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 8.8 High severity | Microsoft Windows Scripting Engine Memory Corruption CVE-2021-34448 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.