DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2022-22071
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Date Added to KEV: 2023-12-05
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2023-12-26
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/commit/586840fde350d7b8563df9889c8ce397e2c20dda', '  https://nvd.nist.gov/vuln/detail/CVE-2022-22071']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30807
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30807']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5410
Vendor/Project: VMware Tanzu
Product: Spring Cloud Configuration (Config) Server
Vulnerability Name: VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-5410']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20399
Vendor/Project: Cisco
Product: NX-OS
Vulnerability Name: Cisco NX-OS Command Injection Vulnerability
Date Added to KEV: 2024-07-02
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP', '   https://nvd.nist.gov/vuln/detail/CVE-2024-20399']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-49138
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2024-12-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-49138']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1789
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Type Confusion Vulnerability
Date Added to KEV: 2022-05-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1789']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-3153
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-3153']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-8506
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Type Confusion Vulnerability
Date Added to KEV: 2022-05-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-8506']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-33766
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Information Disclosure
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-33766']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-3910
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
Date Added to KEV: 2026-03-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-3910']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-8068
Vendor/Project: Citrix
Product: Session Recording
Vulnerability Name: Citrix Session Recording Improper Privilege Management Vulnerability
Date Added to KEV: 2025-08-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/external/article/691941/citrix-session-recording-security-bullet.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-8068']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7836
Vendor/Project: SKYSEA
Product: Client View
Vulnerability Name: SKYSEA Client View Improper Authentication Vulnerability
Date Added to KEV: 2025-10-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.skyseaclientview.net/news/161221/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2016-7836']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-31199
Vendor/Project: Netwrix
Product: Auditor
Vulnerability Name: Netwrix Auditor Insecure Object Deserialization Vulnerability
Date Added to KEV: 2023-07-11
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-08-01
Known Ransomware Campaign Use: Known
Notes: ['Patch application requires login to customer portal: https://security.netwrix.com/Account/SignIn?ReturnUrl=%2FAdvisories%2FADV-2022-003', '  https://nvd.nist.gov/vuln/detail/CVE-2022-31199']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-1856
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-1856']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-16256
Vendor/Project: SIMalliance
Product: Toolbox Browser
Vulnerability Name: SIMalliance Toolbox Browser Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-16256']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-12812
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-12812']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3950
Vendor/Project: VMware
Product: Multiple Products
Vulnerability Name: VMware Multiple Products Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3950']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-66376
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Date Added to KEV: 2026-03-18
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-66376']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-2568
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Remote Code Execution Vulnerability
Date Added to KEV: 2022-09-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046', ' https://nvd.nist.gov/vuln/detail/CVE-2010-2568']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-25223
Vendor/Project: Sophos
Product: SG UTM
Vulnerability Name: Sophos SG UTM Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-25223']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8599
Vendor/Project: Trend Micro
Product: Apex One and OfficeScan
Vulnerability Name: Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8599']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-35247
Vendor/Project: SolarWinds
Product: Serv-U
Vulnerability Name: SolarWinds Serv-U Improper Input Validation Vulnerability
Date Added to KEV: 2022-01-21
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-35247']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-4345
Vendor/Project: Exim
Product: Exim
Vulnerability Name: Exim Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-4345']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41049
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Date Added to KEV: 2022-11-14
Required Action: Apply updates per vendor instructions.
Due Date: 2022-12-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41049', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41049']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-27926
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2023-04-03
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Security_Center', '  https://nvd.nist.gov/vuln/detail/CVE-2022-27926']
Severity: Critical
Known Exploited Vulnerability: CVE-2008-0655
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Unspecified Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2008-0655']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-0557
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Object Record Corruption Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-0557']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-54313
Vendor/Project: Prettier
Product: eslint-config-prettier
Vulnerability Name: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
Date Added to KEV: 2026-01-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-12
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions ', ' https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-54313']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-0411
Vendor/Project: 7-Zip
Product: 7-Zip
Vulnerability Name: 7-Zip Mark of the Web Bypass Vulnerability
Date Added to KEV: 2025-02-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.7-zip.org/history.txt ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-0411']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8243
Vendor/Project: Ivanti
Product: Pulse Connect Secure
Vulnerability Name: Ivanti Pulse Connect Secure Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ["Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8243"]
Severity: Critical
Known Exploited Vulnerability: CVE-2020-10199
Vendor/Project: Sonatype
Product: Nexus Repository
Vulnerability Name: Sonatype Nexus Repository Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-10199']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3718
Vendor/Project: ImageMagick
Product: ImageMagick
Vulnerability Name: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3718']
Severity: Critical
Known Exploited Vulnerability: CVE-2004-1464
Vendor/Project: Cisco
Product: IOS
Vulnerability Name: Cisco IOS Denial-of-Service Vulnerability
Date Added to KEV: 2023-05-19
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040827-telnet', ' https://nvd.nist.gov/vuln/detail/CVE-2004-1464']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-2856
Vendor/Project: Google
Product: Chromium Intents
Vulnerability Name: Google Chromium Intents Insufficient Input Validation Vulnerability
Date Added to KEV: 2022-08-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-2856']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32439
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Type Confusion Vulnerability
Date Added to KEV: 2023-06-23
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213813, https://support.apple.com/en-us/HT213811, https://support.apple.com/en-us/HT213814, https://support.apple.com/en-us/HT213816', '  https://nvd.nist.gov/vuln/detail/CVE-2023-32439']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22620
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability
Date Added to KEV: 2022-02-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22620']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-22527
Vendor/Project: Atlassian
Product: Confluence Data Center and Server
Vulnerability Name: Atlassian Confluence Data Center and Server Template Injection Vulnerability
Date Added to KEV: 2024-01-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-14
Known Ransomware Campaign Use: Known
Notes: ['https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-22527']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24993
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2025-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24993 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24993']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-52691
Vendor/Project: SmarterTools
Product: SmarterMail
Vulnerability Name: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
Date Added to KEV: 2026-01-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.smartertools.com/smartermail/release-notes/current ', ' https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-52691']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44228
Vendor/Project: Apache
Product: Log4j2
Vulnerability Name: Apache Log4j2 Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-10
Required Action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Due Date: 2021-12-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-44228']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-3544
Vendor/Project: Oracle
Product: Java SE JDK and JRE
Vulnerability Name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2011-3544']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-20699
Vendor/Project: Cisco
Product: Small Business RV160, RV260, RV340, and RV345 Series Routers
Vulnerability Name: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-20699']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-21445
Vendor/Project: Oracle
Product: ADF Faces
Vulnerability Name: Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-09-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpuapr2022.html  ', '  https://nvd.nist.gov/vuln/detail/CVE-2022-21445']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-26369
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Date Added to KEV: 2023-09-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/acrobat/apsb23-34.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-26369']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-35405
Vendor/Project: Zoho
Product: ManageEngine
Vulnerability Name: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Date Added to KEV: 2022-09-22
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-35405']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-15949
Vendor/Project: Nagios
Product: Nagios XI
Vulnerability Name: Nagios XI Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-15949']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-33891
Vendor/Project: Apache
Product: Spark
Vulnerability Name: Apache Spark Command Injection Vulnerability
Date Added to KEV: 2023-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc', '  https://nvd.nist.gov/vuln/detail/CVE-2022-33891']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-40766
Vendor/Project: SonicWall
Product: SonicOS
Vulnerability Name: SonicWall SonicOS Improper Access Control Vulnerability
Date Added to KEV: 2024-09-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-30
Known Ransomware Campaign Use: Known
Notes: ['https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015', ' https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-40766']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-44308
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Code Execution Vulnerability
Date Added to KEV: 2024-11-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/121752, https://support.apple.com/en-us/121753, https://support.apple.com/en-us/121754, https://support.apple.com/en-us/121755, https://support.apple.com/en-us/121756 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-44308']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8218
Vendor/Project: Pulse Secure
Product: Pulse Connect Secure
Vulnerability Name: Pulse Connect Secure Code Injection Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8218']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11539
Vendor/Project: Ivanti
Product: Pulse Connect Secure and Pulse Policy Secure
Vulnerability Name: Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-11539']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-25717
Vendor/Project: Ruckus Wireless
Product: Multiple Products
Vulnerability Name: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Date Added to KEV: 2023-05-12
Required Action: Apply updates per vendor instructions or disconnect product if it is end-of-life.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.ruckuswireless.com/security_bulletins/315', '  https://nvd.nist.gov/vuln/detail/CVE-2023-25717']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2596
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Integer Overflow Vulnerability
Date Added to KEV: 2022-09-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc9bbca8f650e5f738af8806317c0a041a48ae4a', ' https://nvd.nist.gov/vuln/detail/CVE-2013-2596']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-6554
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2025-07-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-6554']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4761
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
Date Added to KEV: 2024-05-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4761']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-19323
Vendor/Project: GIGABYTE
Product: Multiple Products
Vulnerability Name: GIGABYTE Multiple Products Privilege Escalation Vulnerability
Date Added to KEV: 2022-10-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-14
Known Ransomware Campaign Use: Known
Notes: ['https://www.gigabyte.com/Support/Security/1801', ' https://nvd.nist.gov/vuln/detail/CVE-2018-19323']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27877
Vendor/Project: Veritas
Product: Backup Exec Agent
Vulnerability Name: Veritas Backup Exec Agent Improper Authentication Vulnerability
Date Added to KEV: 2023-04-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-28
Known Ransomware Campaign Use: Known
Notes: ['https://www.veritas.com/support/en_US/security/VTS21-001', ' https://nvd.nist.gov/vuln/detail/CVE-2021-27877']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-26359
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2023-08-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-09-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-26359']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-38181
Vendor/Project: Arm
Product: Mali Graphics Processing Unit (GPU)
Vulnerability Name: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities', '  https://nvd.nist.gov/vuln/detail/CVE-2022-38181']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-53770
Vendor/Project: Microsoft
Product: SharePoint
Vulnerability Name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-07-20
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Due Date: 2025-07-21
Known Ransomware Campaign Use: Known
Notes: ['CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770', ' https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ', ' https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-53770']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20090
Vendor/Project: Arcadyan
Product: Buffalo Firmware
Vulnerability Name: Arcadyan Buffalo Firmware Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20090']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-2555
Vendor/Project: Oracle
Product: Multiple Products
Vulnerability Name: Oracle Multiple Products Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-2555']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25395
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Race Condition Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25395']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-2506
Vendor/Project: QNAP Systems
Product: Helpdesk
Vulnerability Name: QNAP Helpdesk Improper Access Control Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-2506']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2423
Vendor/Project: Oracle
Product: Java Runtime Environment (JRE)
Vulnerability Name: Oracle JRE Unspecified Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-2423']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-14871
Vendor/Project: Oracle
Product: Solaris and Zettabyte File System (ZFS)
Vulnerability Name: Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-14871']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-31161
Vendor/Project: CrushFTP
Product: CrushFTP
Vulnerability Name: CrushFTP Authentication Bypass Vulnerability
Date Added to KEV: 2025-04-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-28
Known Ransomware Campaign Use: Known
Notes: ['https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-31161']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-31125
Vendor/Project: Vite
Product: Vitejs
Vulnerability Name: Vite Vitejs Improper Access Control Vulnerability
Date Added to KEV: 2026-01-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-12
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-31125']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-4655
Vendor/Project: Apple
Product: iOS
Vulnerability Name: Apple iOS Information Disclosure Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-4655']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-10189
Vendor/Project: Zoho
Product: ManageEngine
Vulnerability Name: Zoho ManageEngine Desktop Central File Upload Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-10189']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-16759
Vendor/Project: vBulletin
Product: vBulletin
Vulnerability Name: vBulletin PHP Module Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-16759']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-16017
Vendor/Project: Google
Product: Chrome
Vulnerability Name: Google Chrome Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-16017']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-14882
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-14882']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-55591
Vendor/Project: Fortinet
Product: FortiOS and FortiProxy
Vulnerability Name: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Date Added to KEV: 2025-01-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-21
Known Ransomware Campaign Use: Known
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-55591']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-2776
Vendor/Project: SysAid
Product: SysAid On-Prem
Vulnerability Name: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
Date Added to KEV: 2025-07-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://documentation.sysaid.com/docs/24-40-60 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-2776']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-43510
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Improper Locking Vulnerability
Date Added to KEV: 2026-03-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/125632 ', ' https://support.apple.com/en-us/125633 ', ' https://support.apple.com/en-us/125634 ', ' https://support.apple.com/en-us/125635 ', ' https://support.apple.com/en-us/125636 ', ' https://support.apple.com/en-us/125637 ', ' https://support.apple.com/en-us/125638 ', ' https://support.apple.com/en-us/125639 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-43510']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3163
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2023-03-30
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055', ' https://nvd.nist.gov/vuln/detail/CVE-2013-3163']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-37975
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-37975']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1048
Vendor/Project: Android
Product: Kernel
Vulnerability Name: Android Kernel Use-After-Free Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1048']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-13223
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2025-11-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-13223']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-23376
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Date Added to KEV: 2023-02-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-07
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376', '  https://nvd.nist.gov/vuln/detail/CVE-2023-23376']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8196
Vendor/Project: Citrix
Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Vulnerability Name: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8196']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-13159
Vendor/Project: Ivanti
Product: Endpoint Manager (EPM)
Vulnerability Name: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Date Added to KEV: 2025-03-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-13159']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-32701
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Date Added to KEV: 2025-05-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32701 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32701']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-9380
Vendor/Project: Ivanti
Product: Cloud Services Appliance (CSA)
Vulnerability Name: Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Date Added to KEV: 2024-10-09
Required Action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Due Date: 2024-10-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-9380']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-2775
Vendor/Project: SysAid
Product: SysAid On-Prem
Vulnerability Name: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
Date Added to KEV: 2025-07-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://documentation.sysaid.com/docs/24-40-60 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-2775']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31199
Vendor/Project: Microsoft
Product: Enhanced Cryptographic Provider
Vulnerability Name: Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-31199']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-23131
Vendor/Project: Zabbix
Product: Frontend
Vulnerability Name: Zabbix Frontend Authentication Bypass Vulnerability
Date Added to KEV: 2022-02-22
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-23131']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-6175
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-6175']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-3519
Vendor/Project: Citrix
Product: NetScaler ADC and NetScaler Gateway
Vulnerability Name: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Date Added to KEV: 2023-07-19
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-09
Known Ransomware Campaign Use: Known
Notes: ['https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467', '  https://nvd.nist.gov/vuln/detail/CVE-2023-3519']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-100005
Vendor/Project: D-Link
Product: DIR-600 Router
Vulnerability Name: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
Date Added to KEV: 2024-05-16
Required Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Due Date: 2024-06-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283', ' https://nvd.nist.gov/vuln/detail/CVE-2014-100005']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0171
Vendor/Project: Cisco
Product: IOS and IOS XE
Vulnerability Name: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0171']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22941
Vendor/Project: Citrix
Product: ShareFile
Vulnerability Name: Citrix ShareFile Improper Access Control Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22941']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-38203
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-01-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-29
Known Ransomware Campaign Use: Known
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-38203']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30858
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30858']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7192
Vendor/Project: QNAP
Product: Photo Station
Vulnerability Name: QNAP Photo Station Improper Access Control Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7192']
Severity: Critical