Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2021-3560 | Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing… | Red Hat / Polkit | May 12, 2023 | — | View → |
| CVE-2023-25717 | Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services… | Ruckus Wireless / Multiple Products | May 12, 2023 | — | View → |
| CVE-2023-29336 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. | Microsoft / Win32k | May 9, 2023 | — | View → |
| CVE-2021-45046 | Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread… | Apache / Log4j2 | May 1, 2023 | Ransomware | View → |
| CVE-2023-1389 | TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. | TP-Link / Archer AX21 | May 1, 2023 | — | View → |
| CVE-2023-21839 | Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to… | Oracle / WebLogic Server | May 1, 2023 | — | View → |
| CVE-2023-2136 | Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process,… | Google / Chromium Skia | Apr 21, 2023 | — | View → |
| CVE-2023-27350 | PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and… | PaperCut / MF/NG | Apr 21, 2023 | Ransomware | View → |
| CVE-2023-28432 | MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information… | MinIO / MinIO | Apr 21, 2023 | — | View → |
| CVE-2017-6742 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an… | Cisco / IOS and IOS XE Software | Apr 19, 2023 | — | View → |
| CVE-2019-8526 | Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. | Apple / macOS | Apr 17, 2023 | — | View → |
| CVE-2023-2033 | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via… | Google / Chromium V8 | Apr 17, 2023 | — | View → |
| CVE-2023-20963 | Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK… | Android / Framework | Apr 13, 2023 | — | View → |
| CVE-2023-29492 | Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context… | Novi Survey / Novi Survey | Apr 13, 2023 | — | View → |
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Windows | Apr 11, 2023 | Ransomware | View → |
| CVE-2023-28205 | Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing… | Apple / Multiple Products | Apr 10, 2023 | — | View → |
| CVE-2023-28206 | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with… | Apple / iOS, iPadOS, and macOS | Apr 10, 2023 | — | View → |
| CVE-2019-1388 | Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated… | Microsoft / Windows | Apr 7, 2023 | Ransomware | View → |
| CVE-2021-27876 | Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a… | Veritas / Backup Exec Agent | Apr 7, 2023 | Ransomware | View → |
| CVE-2021-27877 | Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the… | Veritas / Backup Exec Agent | Apr 7, 2023 | Ransomware | View → |