Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | D-Link DIR-825 R1 Devices Buffer Overflow CVE-2020-29557 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 5.5 Medium severity | Apple Multiple Products Memory Initialization CVE-2020-27950 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Type Confusion CVE-2020-27932 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2020-27930 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Netgear JGS516PE Devices Missing Function Level Access Control CVE-2020-26919 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Oracle Multiple Products Remote Code Execution CVE-2020-2555 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | D-Link DNS-320 Device Command Injection CVE-2020-25506 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | WordPress File Manager Plugin Remote Code Execution CVE-2020-25213 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Trend Micro Multiple Products Improper Access Control CVE-2020-24557 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Apache Struts Remote Code Execution CVE-2020-17530 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | vBulletin PHP Module Remote Code Execution CVE-2020-17496 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Microsoft Exchange Server Remote Code Execution CVE-2020-17144 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Kernel Privilege Escalation CVE-2020-17087 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | SaltStack Salt Shell Injection CVE-2020-16846 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.6 Critical severity | Google Chrome Use-After-Free CVE-2020-16017 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Incorrect Implementation Vulnerabililty CVE-2020-16013 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.6 Critical severity | Google Chrome for Android UI Heap Buffer Overflow CVE-2020-16010 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2020-16009 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.6 Critical severity | Google Chrome FreeType Heap Buffer Overflow CVE-2020-15999 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Ivanti MobileIron Multiple Products Remote Code Execution CVE-2020-15505 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.0 High severity | Oracle WebLogic Server Unspecified CVE-2020-14883 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 10.0 High severity | Oracle WebLogic Server Remote Code Execution CVE-2020-14882 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 10.0 High severity | Oracle Solaris and Zettabyte File System (ZFS) Unspecified CVE-2020-14871 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Oracle WebLogic Server Remote Code Execution CVE-2020-14750 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 10.0 Critical severity | Microsoft Netlogon Privilege Escalation CVE-2020-1472 | Nov 3, 2021 | May 3, 2022 | Known |
| 5.5 Medium severity | Microsoft Windows Spoofing CVE-2020-1464 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Scripting Engine Memory Corruption CVE-2020-1380 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 10.0 Critical severity | Microsoft Windows DNS Server Remote Code Execution CVE-2020-1350 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Fortinet FortiOS SSL VPN Improper Authentication CVE-2020-12812 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Sophos SFOS SQL Injection CVE-2020-12271 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.5 High severity | WordPress Snap Creek Duplicator Plugin File Download CVE-2020-11738 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.5 Medium severity | SaltStack Salt Path Traversal CVE-2020-11652 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | SaltStack Salt Authentication Bypass CVE-2020-11651 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution CVE-2020-1147 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Tenda AC1900 Router AC15 Model Remote Code Execution CVE-2020-10987 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2020-1054 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.0 Critical severity | Microsoft Hyper-V RemoteFX vGPU Remote Code Execution CVE-2020-1040 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | rConfig OS Command Injection CVE-2020-10221 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Microsoft Windows Adobe Font Manager Library Remote Code Execution CVE-2020-1020 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Sonatype Nexus Repository Remote Code Execution CVE-2020-10199 | Nov 3, 2021 | May 3, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.