Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2020-1027 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully… | Microsoft / Windows | May 23, 2022 | — | View → |
| CVE-2021-0920 | Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. | Android / Kernel | May 23, 2022 | — | View → |
| CVE-2021-1048 | Android kernel contains a use-after-free vulnerability that allows for privilege escalation. | Android / Kernel | May 23, 2022 | — | View → |
| CVE-2021-30883 | Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution. | Apple / Multiple Products | May 23, 2022 | — | View → |
| CVE-2022-20821 | Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open… | Cisco / IOS XR | May 23, 2022 | — | View → |
| CVE-2022-22947 | Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and… | VMware / Spring Cloud Gateway | May 16, 2022 | — | View → |
| CVE-2022-30525 | A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and… | Zyxel / Multiple Firewalls | May 16, 2022 | — | View → |
| CVE-2022-1388 | F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or… | F5 / BIG-IP | May 10, 2022 | Ransomware | View → |
| CVE-2014-0160 | The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain… | OpenSSL / OpenSSL | May 4, 2022 | — | View → |
| CVE-2014-0322 | Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code. | Microsoft / Internet Explorer | May 4, 2022 | — | View → |
| CVE-2014-4113 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Win32k | May 4, 2022 | — | View → |
| CVE-2019-8506 | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code… | Apple / Multiple Products | May 4, 2022 | — | View → |
| CVE-2021-1789 | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code… | Apple / Multiple Products | May 4, 2022 | — | View → |
| CVE-2019-1003029 | Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. | Jenkins / Script Security Plugin | Apr 25, 2022 | — | View → |
| CVE-2021-40450 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Win32k | Apr 25, 2022 | — | View → |
| CVE-2021-41357 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Win32k | Apr 25, 2022 | — | View → |
| CVE-2022-0847 | Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the… | Linux / Kernel | Apr 25, 2022 | — | View → |
| CVE-2022-21919 | Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Windows | Apr 25, 2022 | — | View → |
| CVE-2022-26904 | Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Windows | Apr 25, 2022 | — | View → |
| CVE-2022-29464 | Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. | WSO2 / Multiple Products | Apr 25, 2022 | Ransomware | View → |