Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.5 High severity | Citrix StoreFront Server XML External Entity (XXE) Processing CVE-2019-13608 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Windows Privilege Escalation CVE-2019-1215 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Windows Privilege Common Log File System (CLFS) Escalation CVE-2019-1214 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Citrix Workspace Application and Receiver for Windows Remote Code Execution CVE-2019-11634 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Atlassian Crowd and Crowd Data Center Remote Code Execution CVE-2019-11580 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.2 High severity | Ivanti Pulse Connect Secure and Policy Secure Command Injection CVE-2019-11539 | Nov 3, 2021 | May 3, 2022 | Known |
| 10.0 Critical severity | Ivanti Pulse Connect Secure Arbitrary File Read CVE-2019-11510 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Windows Error Reporting (WER) Privilege Escalation CVE-2019-0863 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2019-0859 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2019-0808 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2019-0803 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2019-0797 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Microsoft Remote Desktop Services Remote Code Execution CVE-2019-0708 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Microsoft SharePoint Remote Code Execution CVE-2019-0604 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.8 High severity | Microsoft MSHTML Remote Code Execution CVE-2019-0541 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Apache HTTP Server Privilege Escalation CVE-2019-0211 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Microsoft Internet Explorer Scripting Engine Memory Corruption CVE-2018-8653 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Drupal Core Remote Code Execution CVE-2018-7600 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Exim Buffer Overflow CVE-2018-6789 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Adobe ColdFusion Deserialization of Untrusted Data CVE-2018-4939 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Adobe Flash Player Use-After-Free CVE-2018-4878 | Nov 3, 2021 | May 3, 2022 | Known |
| 6.6 Medium severity | SAP Customer Relationship Management (CRM) Path Traversal CVE-2018-2380 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | ThinkPHP "noneCms" Remote Code Execution CVE-2018-20062 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | DotNetNuke (DNN) Inadequate Encryption Strength CVE-2018-18325 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Adobe ColdFusion Unrestricted File Upload CVE-2018-15961 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | DotNetNuke (DNN) Inadequate Encryption Strength CVE-2018-15811 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Tenda AC7, AC9, and AC10 Routers Command Injection CVE-2018-14558 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Fortinet FortiOS SSL VPN Path Traversal CVE-2018-13379 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.1 High severity | Apache Struts Remote Code Execution CVE-2018-11776 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Memory Corruption CVE-2018-0802 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.8 High severity | Microsoft Office Memory Corruption CVE-2018-0798 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | Cisco Adaptive Security Appliance (ASA) Denial-of-Service CVE-2018-0296 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Cisco IOS and IOS XE Software Smart Install Remote Code Execution CVE-2018-0171 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | DotNetNuke (DNN) Remote Code Execution CVE-2017-9822 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.1 High severity | Apache Struts Deserialization of Untrusted Data CVE-2017-9805 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness CVE-2017-9248 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft .NET Framework Remote Code Execution CVE-2017-8759 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Microsoft Windows Server Buffer Overflow CVE-2017-7269 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Symantec Messaging Gateway Remote Code Execution CVE-2017-6327 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.8 Critical severity | Apache Struts Remote Code Execution CVE-2017-5638 | Nov 3, 2021 | May 3, 2022 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.