Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2018-20753 | Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. | Kaseya / Virtual System/Server Administrator (VSA) | Apr 13, 2022 | Ransomware | View → |
| CVE-2018-7602 | A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack… | Drupal / Core | Apr 13, 2022 | Ransomware | View → |
| CVE-2022-24521 | Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Windows | Apr 13, 2022 | Ransomware | View → |
| CVE-2017-11317 | Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code. | Telerik / User Interface (UI) for ASP.NET AJAX | Apr 11, 2022 | — | View → |
| CVE-2020-2509 | QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. | QNAP / QNAP Network-Attached Storage (NAS) | Apr 11, 2022 | — | View → |
| CVE-2021-22600 | Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user… | Linux / Kernel | Apr 11, 2022 | — | View → |
| CVE-2021-27852 | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute… | Checkbox / Checkbox Survey | Apr 11, 2022 | — | View → |
| CVE-2021-39793 | Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. | Google / Pixel | Apr 11, 2022 | — | View → |
| CVE-2021-42278 | Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Active Directory | Apr 11, 2022 | Ransomware | View → |
| CVE-2021-42287 | Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Active Directory | Apr 11, 2022 | Ransomware | View → |
| CVE-2022-23176 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged… | WatchGuard / Firebox and XTM | Apr 11, 2022 | — | View → |
| CVE-2017-0148 | The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. | Microsoft / SMBv1 server | Apr 6, 2022 | Ransomware | View → |
| CVE-2021-31166 | Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. | Microsoft / HTTP Protocol Stack | Apr 6, 2022 | — | View → |
| CVE-2021-3156 | Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. | Sudo / Sudo | Apr 6, 2022 | — | View → |
| CVE-2021-45382 | A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. | D-Link / Multiple Routers | Apr 4, 2022 | — | View → |
| CVE-2022-22674 | macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. | Apple / macOS | Apr 4, 2022 | — | View → |
| CVE-2022-22675 | macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel… | Apple / macOS | Apr 4, 2022 | — | View → |
| CVE-2022-22965 | Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. | VMware / Spring Framework | Apr 4, 2022 | — | View → |
| CVE-2018-10561 | Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker… | Dasan / Gigabit Passive Optical Network (GPON) Routers | Mar 31, 2022 | — | View → |
| CVE-2018-10562 | Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker… | Dasan / Gigabit Passive Optical Network (GPON) Routers | Mar 31, 2022 | Ransomware | View → |