Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2020-10189 | Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution. | Zoho / ManageEngine | Nov 3, 2021 | — | View → |
| CVE-2020-10199 | Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution. | Sonatype / Nexus Repository | Nov 3, 2021 | — | View → |
| CVE-2020-1020 | Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts… | Microsoft / Windows | Nov 3, 2021 | — | View → |
| CVE-2020-10221 | rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS… | rConfig / rConfig | Nov 3, 2021 | — | View → |
| CVE-2020-1040 | Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate… | Microsoft / Hyper-V RemoteFX | Nov 3, 2021 | — | View → |
| CVE-2020-1054 | Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in… | Microsoft / Win32k | Nov 3, 2021 | — | View → |
| CVE-2020-10987 | Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the… | Tenda / AC1900 Router AC15 Model | Nov 3, 2021 | — | View → |
| CVE-2020-1147 | Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to… | Microsoft / .NET Framework, SharePoint, Visual Studio | Nov 3, 2021 | — | View → |
| CVE-2020-11651 | SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method… | SaltStack / Salt | Nov 3, 2021 | — | View → |
| CVE-2020-11652 | SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to… | SaltStack / Salt | Nov 3, 2021 | — | View → |
| CVE-2020-11738 | WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that… | WordPress / Snap Creek Duplicator Plugin | Nov 3, 2021 | — | View → |
| CVE-2020-12271 | Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration… | Sophos / SFOS | Nov 3, 2021 | Ransomware | View → |
| CVE-2020-12812 | Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being… | Fortinet / FortiOS | Nov 3, 2021 | Ransomware | View → |
| CVE-2020-1350 | Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of… | Microsoft / Windows | Nov 3, 2021 | — | View → |
| CVE-2020-1380 | Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the… | Microsoft / Internet Explorer | Nov 3, 2021 | — | View → |
| CVE-2020-1464 | Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass… | Microsoft / Windows | Nov 3, 2021 | — | View → |
| CVE-2020-1472 | Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable… | Microsoft / Netlogon | Nov 3, 2021 | Ransomware | View → |
| CVE-2020-14750 | Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This… | Oracle / WebLogic Server | Nov 3, 2021 | — | View → |
| CVE-2020-14871 | Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality,… | Oracle / Solaris and Zettabyte File System (ZFS) | Nov 3, 2021 | — | View → |
| CVE-2020-14882 | Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this… | Oracle / WebLogic Server | Nov 3, 2021 | — | View → |