Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2021-40870 | Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via… | Aviatrix / Aviatrix Controller | Jan 18, 2022 | — | View → |
| CVE-2013-3900 | A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature… | Microsoft / WinVerifyTrust function | Jan 10, 2022 | — | View → |
| CVE-2015-7450 | Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products… | IBM / WebSphere Application Server and Server Hypervisor Edition | Jan 10, 2022 | — | View → |
| CVE-2017-1000486 | Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution | Primetek / Primefaces Application | Jan 10, 2022 | — | View → |
| CVE-2018-13382 | An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to… | Fortinet / FortiOS and FortiProxy | Jan 10, 2022 | Ransomware | View → |
| CVE-2018-13383 | A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. | Fortinet / FortiOS and FortiProxy | Jan 10, 2022 | Ransomware | View → |
| CVE-2019-10149 | Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. | Exim / Mail Transfer Agent (MTA) | Jan 10, 2022 | — | View → |
| CVE-2019-1458 | A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k… | Microsoft / Win32k | Jan 10, 2022 | Ransomware | View → |
| CVE-2019-1579 | Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. | Palo Alto Networks / PAN-OS | Jan 10, 2022 | Ransomware | View → |
| CVE-2019-2725 | Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). | Oracle / WebLogic Server | Jan 10, 2022 | Ransomware | View → |
| CVE-2019-7609 | Kibana contain an arbitrary code execution flaw in the Timelion visualizer. | Elastic / Kibana | Jan 10, 2022 | — | View → |
| CVE-2019-9670 | Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd… | Synacor / Zimbra Collaboration Suite (ZCS) | Jan 10, 2022 | — | View → |
| CVE-2020-6572 | Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. | Google / Chrome Media | Jan 10, 2022 | — | View → |
| CVE-2021-22017 | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | VMware / vCenter Server | Jan 10, 2022 | — | View → |
| CVE-2021-27860 | A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to… | FatPipe / WARP, IPVPN, and MPVPN software | Jan 10, 2022 | — | View → |
| CVE-2021-36260 | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. | Hikvision / Security cameras web server | Jan 10, 2022 | — | View → |
| CVE-2021-4102 | Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via… | Google / Chromium V8 | Dec 15, 2021 | — | View → |
| CVE-2021-43890 | Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. | Microsoft / Windows | Dec 15, 2021 | Ransomware | View → |
| CVE-2010-1871 | JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote… | Red Hat / JBoss Seam 2 | Dec 10, 2021 | — | View → |
| CVE-2017-12149 | The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via… | Red Hat / JBoss Application Server | Dec 10, 2021 | Ransomware | View → |