Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2018-6882 | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject… | Synacor / Zimbra Collaboration Suite (ZCS) | Apr 19, 2022 | Ransomware | View → |
| CVE-2019-3568 | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to… | Meta Platforms / WhatsApp | Apr 19, 2022 | — | View → |
| CVE-2022-22718 | Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation. | Microsoft / Windows | Apr 19, 2022 | — | View → |
| CVE-2007-3010 | masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary… | Alcatel / OmniPCX Enterprise | Apr 15, 2022 | — | View → |
| CVE-2010-5330 | Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi. | Ubiquiti / AirOS | Apr 15, 2022 | — | View → |
| CVE-2014-0780 | InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords… | InduSoft / Web Studio | Apr 15, 2022 | — | View → |
| CVE-2016-4523 | The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS). | Trihedral / VTScada (formerly VTS) | Apr 15, 2022 | — | View → |
| CVE-2018-7841 | A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of… | Schneider Electric / U.motion Builder | Apr 15, 2022 | — | View → |
| CVE-2019-16057 | The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution. | D-Link / DNS-320 Storage Device | Apr 15, 2022 | Ransomware | View → |
| CVE-2019-3929 | Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker… | Crestron / Multiple Products | Apr 15, 2022 | — | View → |
| CVE-2022-1364 | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via… | Google / Chromium V8 | Apr 15, 2022 | — | View → |
| CVE-2022-22960 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper… | VMware / Multiple Products | Apr 15, 2022 | — | View → |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. | VMware / Workspace ONE Access and Identity Manager | Apr 14, 2022 | Ransomware | View → |
| CVE-2014-9163 | Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely. | Adobe / Flash Player | Apr 13, 2022 | — | View → |
| CVE-2015-0311 | Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code. | Adobe / Flash Player | Apr 13, 2022 | — | View → |
| CVE-2015-0313 | Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code. | Adobe / Flash Player | Apr 13, 2022 | — | View → |
| CVE-2015-2502 | Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a… | Microsoft / Internet Explorer | Apr 13, 2022 | — | View → |
| CVE-2015-3113 | Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code. | Adobe / Flash Player | Apr 13, 2022 | — | View → |
| CVE-2015-5122 | Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote… | Adobe / Flash Player | Apr 13, 2022 | — | View → |
| CVE-2015-5123 | Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote… | Adobe / Flash Player | Apr 13, 2022 | — | View → |