Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2021-27059 | Microsoft Office contains an unspecified vulnerability that allows for remote code execution. | Microsoft / Office | Nov 3, 2021 | — | View → |
| CVE-2021-27065 | Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the… | Microsoft / Exchange Server | Nov 3, 2021 | Ransomware | View → |
| CVE-2021-27085 | Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution. | Microsoft / Internet Explorer | Nov 3, 2021 | — | View → |
| CVE-2021-27101 | Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. | Accellion / FTA | Nov 3, 2021 | Ransomware | View → |
| CVE-2021-27102 | Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. | Accellion / FTA | Nov 3, 2021 | Ransomware | View → |
| CVE-2021-27103 | Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. | Accellion / FTA | Nov 3, 2021 | Ransomware | View → |
| CVE-2021-27104 | Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. | Accellion / FTA | Nov 3, 2021 | Ransomware | View → |
| CVE-2021-27561 | Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution. | Yealink / Device Management | Nov 3, 2021 | — | View → |
| CVE-2021-27562 | Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite… | Arm / Trusted Firmware | Nov 3, 2021 | — | View → |
| CVE-2021-28310 | Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Win32k | Nov 3, 2021 | — | View → |
| CVE-2021-28550 | Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in… | Adobe / Acrobat and Reader | Nov 3, 2021 | — | View → |
| CVE-2021-28663 | Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make… | Arm / Mali Graphics Processing Unit (GPU) | Nov 3, 2021 | — | View → |
| CVE-2021-28664 | Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain… | Arm / Mali Graphics Processing Unit (GPU) | Nov 3, 2021 | — | View → |
| CVE-2021-30116 | Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the… | Kaseya / Virtual System/Server Administrator (VSA) | Nov 3, 2021 | Ransomware | View → |
| CVE-2021-30551 | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via… | Google / Chromium V8 | Nov 3, 2021 | — | View → |
| CVE-2021-30554 | Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a… | Google / Chromium WebGL | Nov 3, 2021 | — | View → |
| CVE-2021-30563 | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via… | Google / Chromium V8 | Nov 3, 2021 | — | View → |
| CVE-2021-30632 | Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap… | Google / Chromium V8 | Nov 3, 2021 | — | View → |
| CVE-2021-30633 | Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer… | Google / Chromium Indexed DB API | Nov 3, 2021 | — | View → |
| CVE-2021-30657 | Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks. | Apple / macOS | Nov 3, 2021 | — | View → |