Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2018-19943 | A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. | QNAP / Network Attached Storage (NAS) | May 24, 2022 | Ransomware | View → |
| CVE-2018-19949 | A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands. | QNAP / Network Attached Storage (NAS) | May 24, 2022 | Ransomware | View → |
| CVE-2018-19953 | A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. | QNAP / Network Attached Storage (NAS) | May 24, 2022 | Ransomware | View → |
| CVE-2018-8611 | A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. | Microsoft / Windows | May 24, 2022 | — | View → |
| CVE-2018-5002 | Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution. | Adobe / Flash Player | May 23, 2022 | — | View → |
| CVE-2018-8589 | A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited… | Microsoft / Win32k | May 23, 2022 | — | View → |
| CVE-2019-0676 | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully… | Microsoft / Internet Explorer | May 23, 2022 | — | View → |
| CVE-2019-0703 | An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to… | Microsoft / Windows | May 23, 2022 | — | View → |
| CVE-2019-0880 | A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the… | Microsoft / Windows | May 23, 2022 | — | View → |
| CVE-2019-1130 | A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. | Microsoft / Windows | May 23, 2022 | Ransomware | View → |
| CVE-2019-11707 | Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues… | Mozilla / Firefox and Thunderbird | May 23, 2022 | — | View → |
| CVE-2019-11708 | Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. | Mozilla / Firefox and Thunderbird | May 23, 2022 | — | View → |
| CVE-2019-13720 | Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a… | Google / Chrome WebAudio | May 23, 2022 | — | View → |
| CVE-2019-1385 | A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management,… | Microsoft / Windows | May 23, 2022 | Ransomware | View → |
| CVE-2019-18426 | A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading. | Meta Platforms / WhatsApp | May 23, 2022 | — | View → |
| CVE-2019-5786 | Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory… | Google / Chrome Blink | May 23, 2022 | — | View → |
| CVE-2019-7286 | Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation. | Apple / Multiple Products | May 23, 2022 | — | View → |
| CVE-2019-7287 | Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution. | Apple / iOS | May 23, 2022 | — | View → |
| CVE-2019-8720 | WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. | WebKitGTK / WebKitGTK | May 23, 2022 | — | View → |
| CVE-2020-0638 | Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Update Notification Manager | May 23, 2022 | Ransomware | View → |