Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | Zoho ManageEngine Desktop Central File Upload CVE-2020-10189 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Sumavision EMR Cross-Site Request Forgery (CSRF) CVE-2020-10181 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | SolarWinds Orion Authentication Bypass CVE-2020-10148 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Kernel Privilege Escalation CVE-2020-0986 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Scripting Engine Memory Corruption CVE-2020-0968 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Windows Adobe Font Manager Library Remote Code Execution CVE-2020-0938 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Microsoft Edge and Internet Explorer Memory Corruption CVE-2020-0878 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.8 High severity | Microsoft Exchange Server Validation Key Remote Code Execution CVE-2020-0688 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Windows Installer Privilege Escalation CVE-2020-0683 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Scripting Engine Memory Corruption CVE-2020-0674 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Microsoft .NET Framework Remote Code Execution CVE-2020-0646 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.1 High severity | Microsoft Windows CryptoAPI Spoofing CVE-2020-0601 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Mediatek Multiple Chipsets Insufficient Input Validation CVE-2020-0069 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Android Kernel Out-of-Bounds Write CVE-2020-0041 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.1 Medium severity | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) CVE-2019-9978 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | ThinkPHP Remote Code Execution CVE-2019-9082 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.5 Medium severity | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload CVE-2019-8394 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | SonicWall SMA100 SQL Injection CVE-2019-7481 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.5 High severity | Apple iOS and macOS Group Facetime CVE-2019-6223 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.5 Medium severity | Fortinet FortiOS Default Configuration CVE-2019-5591 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow CVE-2019-5544 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | IBM Planning Analytics Remote Code Execution CVE-2019-4716 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Atlassian Confluence Server and Data Center Path Traversal CVE-2019-3398 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Atlassian Confluence Server and Data Center Server-Side Template Injection CVE-2019-3396 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Android Kernel Use-After-Free CVE-2019-2215 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | TVT NVMS-1000 Directory Traversal CVE-2019-20085 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution CVE-2019-19781 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.5 High severity | Netis WF2419 Devices Remote Code Execution CVE-2019-19356 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.0 High severity | TeamViewer Desktop Bypass Remote Login CVE-2019-18988 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data CVE-2019-18935 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.5 High severity | Trend Micro OfficeScan Directory Traversal CVE-2019-18187 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution CVE-2019-17558 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Mozilla Firefox And Thunderbird Type Confusion CVE-2019-17026 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | vBulletin PHP Module Remote Code Execution CVE-2019-16759 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Cisco Small Business RV320 and RV325 Routers Information Disclosure CVE-2019-1653 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | SIMalliance Toolbox Browser Command Injection CVE-2019-16256 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Nagios XI Remote Code Execution CVE-2019-15949 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Docker Desktop Community Edition Privilege Escalation CVE-2019-15752 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Scripting Engine Memory Corruption CVE-2019-1429 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Scripting Engine Memory Corruption CVE-2019-1367 | Nov 3, 2021 | May 3, 2022 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.