Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2020-14883 | Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and… | Oracle / WebLogic Server | Nov 3, 2021 | — | View → |
| CVE-2020-15505 | Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that… | Ivanti / MobileIron Multiple Products | Nov 3, 2021 | — | View → |
| CVE-2020-15999 | Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the… | Google / Chrome FreeType | Nov 3, 2021 | — | View → |
| CVE-2020-16009 | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via… | Google / Chromium V8 | Nov 3, 2021 | — | View → |
| CVE-2020-16010 | Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer… | Google / Chrome for Android UI | Nov 3, 2021 | — | View → |
| CVE-2020-16013 | Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap… | Google / Chromium V8 | Nov 3, 2021 | — | View → |
| CVE-2020-16017 | Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to… | Google / Chrome | Nov 3, 2021 | — | View → |
| CVE-2020-16846 | SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API… | SaltStack / Salt | Nov 3, 2021 | — | View → |
| CVE-2020-17087 | Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Windows | Nov 3, 2021 | — | View → |
| CVE-2020-17144 | Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution. | Microsoft / Exchange Server | Nov 3, 2021 | — | View → |
| CVE-2020-17496 | The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in… | vBulletin / vBulletin | Nov 3, 2021 | — | View → |
| CVE-2020-17530 | Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead… | Apache / Struts | Nov 3, 2021 | — | View → |
| CVE-2020-24557 | Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability… | Trend Micro / Apex One, OfficeScan, and Worry-Free Business Security | Nov 3, 2021 | — | View → |
| CVE-2020-25213 | WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and… | WordPress / File Manager Plugin | Nov 3, 2021 | — | View → |
| CVE-2020-25506 | D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution. | D-Link / DNS-320 Device | Nov 3, 2021 | — | View → |
| CVE-2020-2555 | Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3… | Oracle / Multiple Products | Nov 3, 2021 | — | View → |
| CVE-2020-26919 | Netgear JGS516PE devices contain a missing function level access control vulnerability. | NETGEAR / JGS516PE Devices | Nov 3, 2021 | — | View → |
| CVE-2020-27930 | Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when… | Apple / Multiple Products | Nov 3, 2021 | — | View → |
| CVE-2020-27932 | Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with… | Apple / Multiple Products | Nov 3, 2021 | — | View → |
| CVE-2020-27950 | Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose… | Apple / Multiple Products | Nov 3, 2021 | — | View → |