Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | Cisco HyperFlex HX Installer Virtual Machine Command Injection CVE-2021-1497 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.8 High severity | Apple Multiple Products Code Execution CVE-2020-9859 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 4.3 Medium severity | Apple iOS, iPadOS, and watchOS Memory Corruption CVE-2020-9819 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write CVE-2020-9818 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | EyesOfNetwork Use of Hard-Coded Credentials CVE-2020-8657 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | EyesOfNetwork Improper Privilege Management CVE-2020-8655 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | PlaySMS Server-Side Template Injection CVE-2020-8644 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Trend Micro Apex One and OfficeScan Authentication Bypass CVE-2020-8599 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Multiple DrayTek Vigor Routers Web Management Page CVE-2020-8515 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Trend Micro Multiple Products Content Validation Escape CVE-2020-8468 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Trend Micro Apex One and OfficeScan Remote Code Execution CVE-2020-8467 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.2 High severity | Ivanti Pulse Connect Secure Code Execution CVE-2020-8260 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.2 High severity | Ivanti Pulse Connect Secure Code Execution CVE-2020-8243 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 4.3 Medium severity | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure CVE-2020-8196 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.5 Medium severity | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure CVE-2020-8195 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.5 Medium severity | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass CVE-2020-8193 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Liferay Portal Deserialization of Untrusted Data CVE-2020-7961 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.1 High severity | Mozilla Firefox And Thunderbird Use-After-Free CVE-2020-6820 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.1 High severity | Mozilla Firefox And Thunderbird Use-After-Free CVE-2020-6819 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2020-6418 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 10.0 Critical severity | SAP NetWeaver Missing Authentication for Critical Function CVE-2020-6287 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | SAP Solution Manager Missing Authentication for Critical Function CVE-2020-6207 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution CVE-2020-5902 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.5 High severity | Unraid Authentication Bypass CVE-2020-5849 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Unraid Remote Code Execution CVE-2020-5847 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Amcrest Cameras and NVR Stack-based Buffer Overflow CVE-2020-5735 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 4.3 Medium severity | IBM Data Risk Manager Directory Traversal CVE-2020-4430 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.1 Critical severity | IBM Data Risk Manager Remote Code Execution CVE-2020-4428 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | IBM Data Risk Manager Security Bypass CVE-2020-4427 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.1 Critical severity | Multiple VMware Products Command Injection CVE-2020-4006 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | VMware ESXi OpenSLP Use-After-Free CVE-2020-3992 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | VMware vCenter Server Information Disclosure CVE-2020-3952 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | VMware Multiple Products Privilege Escalation CVE-2020-3950 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.1 Medium severity | Cisco ASA and FTD Cross-Site Scripting (XSS) CVE-2020-3580 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.6 High severity | Cisco IOS XR Software DVMRP Memory Exhaustion CVE-2020-3569 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.6 High severity | Cisco IOS XR Software DVMRP Memory Exhaustion CVE-2020-3566 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Cisco ASA and FTD Read-Only Path Traversal CVE-2020-3452 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service CVE-2020-3161 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Cisco IOS XR Software Discovery Protocol Format String CVE-2020-3118 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Zyxel Multiple Products Use of Hard-Coded Credentials CVE-2020-29583 | Nov 3, 2021 | May 3, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.