DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2023-22518
Vendor/Project: Atlassian
Product: Confluence Data Center and Server
Vulnerability Name: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Date Added to KEV: 2023-11-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-28
Known Ransomware Campaign Use: Known
Notes: ['https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-22518']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-32706
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2025-05-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32706 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32706']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-40765
Vendor/Project: Mitel
Product: MiVoice Connect
Vulnerability Name: Mitel MiVoice Connect Command Injection Vulnerability
Date Added to KEV: 2023-02-21
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-14
Known Ransomware Campaign Use: Known
Notes: ['https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007', '  https://nvd.nist.gov/vuln/detail/CVE-2022-40765']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-68645
Vendor/Project: Synacor
Product:  Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Date Added to KEV: 2026-01-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Security_Center ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-68645']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-28810
Vendor/Project: Zoho
Product: ManageEngine
Vulnerability Name: Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Date Added to KEV: 2023-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28810.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-28810']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41763
Vendor/Project: Microsoft
Product: Skype for Business
Vulnerability Name: Microsoft Skype for Business Privilege Escalation Vulnerability
Date Added to KEV: 2023-10-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763', '   https://nvd.nist.gov/vuln/detail/CVE-2023-41763']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1671
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Remote Code Execution Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1671']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-9670
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-9670']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-2616
Vendor/Project: Oracle
Product: BI Publisher (Formerly XML Publisher)
Vulnerability Name: Oracle BI Publisher Unauthorized Access Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-2616']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-43770
Vendor/Project: Roundcube
Product: Webmail
Vulnerability Name: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2024-02-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-43770']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-19006
Vendor/Project: Sangoma
Product: FreePBX
Vulnerability Name:  Sangoma FreePBX Improper Authentication Vulnerability
Date Added to KEV: 2026-02-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.freepbx.org/display/FOP/2019-11-20%2BRemote%2BAdmin%2BAuthentication%2BBypass ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-19006']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-10068
Vendor/Project: Kentico
Product: Xperience
Vulnerability Name: Kentico Xperience Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-10068']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36851
Vendor/Project: Juniper
Product: Junos OS
Vulnerability Name: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2023-11-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36851']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4040
Vendor/Project: CrushFTP
Product: CrushFTP
Vulnerability Name: CrushFTP VFS Sandbox Escape Vulnerability
Date Added to KEV: 2024-04-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-05-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4040']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0165
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2023-06-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039', ' https://nvd.nist.gov/vuln/detail/CVE-2016-0165']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-53150
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Out-of-Bounds Read Vulnerability
Date Added to KEV: 2025-04-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-30
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/ ', ' https://source.android.com/docs/security/bulletin/2025-04-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-53150']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3118
Vendor/Project: Cisco
Product: IOS XR
Vulnerability Name: Cisco IOS XR Software Discovery Protocol Format String Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3118']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-29059
Vendor/Project: Microsoft
Product: .NET Framework
Vulnerability Name: Microsoft .NET Framework Information Disclosure Vulnerability
Date Added to KEV: 2025-02-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-29059']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1388
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability
Date Added to KEV: 2023-04-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-28
Known Ransomware Campaign Use: Known
Notes: ['https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388', ' https://nvd.nist.gov/vuln/detail/CVE-2019-1388']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21839
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Unspecified Vulnerability
Date Added to KEV: 2023-05-01
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpujan2023.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-21839']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-4430
Vendor/Project: IBM
Product: Data Risk Manager
Vulnerability Name: IBM Data Risk Manager Directory Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-4430']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7481
Vendor/Project: SonicWall
Product: SMA100
Vulnerability Name: SonicWall SMA100 SQL Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7481']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0262
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0262']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-17463
Vendor/Project: Fuel CMS
Product: Fuel CMS
Vulnerability Name: Fuel CMS SQL Injection Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-17463']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6316
Vendor/Project: Citrix
Product: NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
Vulnerability Name: Citrix Multiple Products Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6316']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25489
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Improper Input Validation Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25489']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-3398
Vendor/Project: Atlassian
Product: Confluence Server and Data Center
Vulnerability Name: Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-3398']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-61757
Vendor/Project: Oracle
Product: Fusion Middleware
Vulnerability Name: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2025-11-21
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpuoct2025.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-61757']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-3931
Vendor/Project: Looking Glass
Product: Multi-Router Looking Glass (MRLG)
Vulnerability Name: Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability
Date Added to KEV: 2025-07-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://mrlg.op-sec.us/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2014-3931']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27085
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27085']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22506
Vendor/Project: Micro Focus
Product: Micro Focus Access Manager
Vulnerability Name: Micro Focus Access Manager Information Leakage Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22506']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-24858
Vendor/Project: Fortinet
Product: Multiple Products
Vulnerability Name: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Date Added to KEV: 2026-01-27
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-30
Known Ransomware Campaign Use: Unknown
Notes: ["Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-060 ", ' https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-24858']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-47575
Vendor/Project: Fortinet
Product: FortiManager
Vulnerability Name: Fortinet FortiManager Missing Authentication Vulnerability
Date Added to KEV: 2024-10-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-24-423 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-47575']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-17480
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-17480']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-3236
Vendor/Project: Sophos
Product: Firewall
Vulnerability Name: Sophos Firewall Code Injection Vulnerability
Date Added to KEV: 2022-09-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce', '  https://nvd.nist.gov/vuln/detail/CVE-2022-3236']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22718
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-19
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22718']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-23227
Vendor/Project: NUUO
Product: NVRmini2 Devices
Vulnerability Name: NUUO NVRmini2 Devices Missing Authentication Vulnerability 
Date Added to KEV: 2024-12-18
Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Due Date: 2025-01-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter＿NVRmini-2-and-NVRsolo-series.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-23227']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41974
Vendor/Project: Apple
Product: iOS and iPadOS
Vulnerability Name: Apple iOS and iPadOS Use-After-Free Vulnerability
Date Added to KEV: 2026-03-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213938 ', ' https://support.apple.com/kb/HT213938 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-41974']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12617
Vendor/Project: Apache
Product: Tomcat
Vulnerability Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12617']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-4632
Vendor/Project: Samsung
Product: MagicINFO 9 Server
Vulnerability Name: Samsung MagicINFO 9 Server Path Traversal Vulnerability
Date Added to KEV: 2025-05-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungtv.com/securityUpdates#SVP-MAY-2025 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-4632']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-0769
Vendor/Project: D-Link
Product: DIR-859 Router
Vulnerability Name:  D-Link DIR-859 Router Path Traversal Vulnerability
Date Added to KEV: 2025-06-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-0769']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21480
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Date Added to KEV: 2025-06-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-24
Known Ransomware Campaign Use: Unknown
Notes: ['Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ', '   https://nvd.nist.gov/vuln/detail/CVE-2025-21480']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-9874
Vendor/Project: Sitecore
Product: CMS and Experience Platform (XP)
Vulnerability Name: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Date Added to KEV: 2025-03-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035 ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-9874']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-13379
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-13379']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-1040
Vendor/Project: Sophos
Product: Firewall
Vulnerability Name: Sophos Firewall Authentication Bypass Vulnerability
Date Added to KEV: 2022-03-31
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-1040']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-6572
Vendor/Project: Google
Product: Chrome Media
Vulnerability Name: Google Chrome Media Use-After-Free Vulnerability
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-6572']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-3928
Vendor/Project: Commvault
Product: Web Server
Vulnerability Name: Commvault Web Server Unspecified Vulnerability
Date Added to KEV: 2025-04-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html', '   https://www.commvault.com/blogs/notice-security-advisory-update', '   https://nvd.nist.gov/vuln/detail/CVE-2025-3928      ']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0625
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Authentication Bypass Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0625']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22674
Vendor/Project: Apple
Product: macOS
Vulnerability Name: Apple macOS Out-of-Bounds Read Vulnerability
Date Added to KEV: 2022-04-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22674']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26500
Vendor/Project: Veeam
Product: Backup & Replication
Vulnerability Name: Veeam Backup & Replication Remote Code Execution Vulnerability
Date Added to KEV: 2022-12-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-03
Known Ransomware Campaign Use: Known
Notes: ['https://www.veeam.com/kb4288', '  https://nvd.nist.gov/vuln/detail/CVE-2022-26500']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1956
Vendor/Project: Apache
Product: Kylin
Vulnerability Name: Apache Kylin OS Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-1956']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-2749
Vendor/Project: Kentico
Product: Kentico Xperience
Vulnerability Name: Kentico Xperience Path Traversal Vulnerability
Date Added to KEV: 2026-04-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://devnet.kentico.com/download/hotfixes ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-2749']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-0322
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Use-After-Free Vulnerability
Date Added to KEV: 2022-05-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-0322']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26858
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ["Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26858"]
Severity: Critical
Known Exploited Vulnerability: CVE-2025-43529
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Use-After-Free WebKit Vulnerability
Date Added to KEV: 2025-12-15
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/125884 ', ' https://support.apple.com/en-us/125892 ', ' https://support.apple.com/en-us/125885 ', ' https://support.apple.com/en-us/125886 ', ' https://support.apple.com/en-us/125889 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-43529']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-59287
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-10-24
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59287 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-59287']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-37973
Vendor/Project: Google
Product: Chromium Portals
Vulnerability Name: Google Chromium Portals Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-37973']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1497
Vendor/Project: Cisco
Product: HyperFlex HX
Vulnerability Name: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1497']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8468
Vendor/Project: Trend Micro
Product: Apex One, OfficeScan and Worry-Free Business Security Agents
Vulnerability Name: Trend Micro Multiple Products Content Validation Escape Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8468']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0803
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0803']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40539
Vendor/Project: Zoho
Product: ManageEngine
Vulnerability Name: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-40539']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0162
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Information Disclosure Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0162']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3893
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Resource Management Errors Vulnerability
Date Added to KEV: 2025-08-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 ', ' https://nvd.nist.gov/vuln/detail/CVE-2013-3893']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-0196
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Race Condition Vulnerability
Date Added to KEV: 2023-05-12
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://lkml.iu.edu/hypermail/linux/kernel/1609.1/02103.html', ' https://nvd.nist.gov/vuln/detail/CVE-2014-0196']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-5777
Vendor/Project: Citrix
Product: NetScaler ADC and Gateway
Vulnerability Name: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Date Added to KEV: 2025-07-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-11
Known Ransomware Campaign Use: Known
Notes: ['https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-5777']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1350
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows DNS Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ["Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350"]
Severity: Critical
Known Exploited Vulnerability: CVE-2025-30397
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Scripting Engine Type Confusion Vulnerability
Date Added to KEV: 2025-05-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30397 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-30397']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-23296
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2024-03-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT214081, https://support.apple.com/en-us/HT214082, https://support.apple.com/en-us/HT214084, https://support.apple.com/en-us/HT214086, https://support.apple.com/en-us/HT214088  ', '  https://nvd.nist.gov/vuln/detail/CVE-2024-23296']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5902
Vendor/Project: F5
Product: BIG-IP
Vulnerability Name: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-5902']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-1123
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Improper Input Validation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-1123']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-16278
Vendor/Project: Nostromo
Product: nhttpd
Vulnerability Name: Nostromo nhttpd Directory Traversal Vulnerability
Date Added to KEV: 2024-11-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.nazgul.ch/dev/nostromo_cl.txt ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-16278']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-3960
Vendor/Project: Adobe
Product: BlazeDS
Vulnerability Name: Adobe BlazeDS Information Disclosure Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-3960']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-30333
Vendor/Project: RARLAB
Product: UnRAR
Vulnerability Name: RARLAB UnRAR Directory Traversal Vulnerability
Date Added to KEV: 2022-08-09
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-30
Known Ransomware Campaign Use: Known
Notes: ['Vulnerability updated with version 6.12. Accessing link will download update information: https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz', '  https://nvd.nist.gov/vuln/detail/CVE-2022-30333']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6334
Vendor/Project: NETGEAR
Product: DGN2200 Devices
Vulnerability Name: NETGEAR DGN2200 Devices OS Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6334']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-11120
Vendor/Project: GeoVision
Product: Multiple Devices
Vulnerability Name: GeoVision Devices OS Command Injection Vulnerability
Date Added to KEV: 2025-05-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-11120']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-27920
Vendor/Project: Srimax
Product: Output Messenger
Vulnerability Name: Srimax Output Messenger Directory Traversal Vulnerability
Date Added to KEV: 2025-05-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.outputmessenger.com/cve-2025-27920/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-27920']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31166
Vendor/Project: Microsoft
Product: HTTP Protocol Stack
Vulnerability Name: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-06
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-31166']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30533
Vendor/Project: Google
Product: Chromium PopupBlocker
Vulnerability Name: Google Chromium PopupBlocker Security Bypass Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30533']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-15982
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-02-15
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-15982']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48633
Vendor/Project: Android
Product: Framework
Vulnerability Name: Android Framework Information Disclosure Vulnerability
Date Added to KEV: 2025-12-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/2025-12-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48633']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-4969
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Use-After-Free Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-4969']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-6819
Vendor/Project: Mozilla
Product: Firefox and Thunderbird
Vulnerability Name: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-6819']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-7028
Vendor/Project: GitLab
Product: GitLab CE/EE
Vulnerability Name: GitLab Community and Enterprise Editions Improper Access Control Vulnerability
Date Added to KEV: 2024-05-01
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-05-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/ ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-7028']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-10987
Vendor/Project: Tenda
Product: AC1900 Router AC15 Model
Vulnerability Name: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-10987']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27059
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27059']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12237
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12237']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-9379
Vendor/Project: Ivanti
Product: Cloud Services Appliance (CSA)
Vulnerability Name: Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
Date Added to KEV: 2024-10-09
Required Action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Due Date: 2024-10-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-9379']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-14558
Vendor/Project: Tenda
Product: AC7, AC9, and AC10 Routers
Vulnerability Name: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-14558']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-3909
Vendor/Project: Google
Product: Skia
Vulnerability Name: Google Skia Out-of-Bounds Write Vulnerability
Date Added to KEV: 2026-03-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-27
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-3909']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32373
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Use-After-Free Vulnerability
Date Added to KEV: 2023-05-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765', ' https://nvd.nist.gov/vuln/detail/CVE-2023-32373']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-55182
Vendor/Project: Meta
Product: React Server Components
Vulnerability Name: Meta React Server Components Remote Code Execution Vulnerability
Date Added to KEV: 2025-12-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-12
Known Ransomware Campaign Use: Known
Notes: ['Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ', ' https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-55182']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28206
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
Date Added to KEV: 2023-04-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213720, https://support.apple.com/en-us/HT213721', ' https://nvd.nist.gov/vuln/detail/CVE-2023-28206']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38094
Vendor/Project: Microsoft
Product: SharePoint
Vulnerability Name: Microsoft SharePoint Deserialization Vulnerability
Date Added to KEV: 2024-10-22
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-12
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38094']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27878
Vendor/Project: Veritas
Product: Backup Exec Agent
Vulnerability Name: Veritas Backup Exec Agent Command Execution Vulnerability
Date Added to KEV: 2023-04-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-28
Known Ransomware Campaign Use: Known
Notes: ['https://www.veritas.com/support/en_US/security/VTS21-001', ' https://nvd.nist.gov/vuln/detail/CVE-2021-27878']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4671
Vendor/Project: Google
Product: Chromium
Vulnerability Name: Google Chromium Visuals Use-After-Free Vulnerability
Date Added to KEV: 2024-05-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html?m=1', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4671']
Severity: Critical