DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2023-23529
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Type Confusion Vulnerability
Date Added to KEV: 2023-02-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213635, https://support.apple.com/en-us/HT213633, https://support.apple.com/en-us/HT213638', '  https://nvd.nist.gov/vuln/detail/CVE-2023-23529']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6884
Vendor/Project: Zyxel
Product: EMG2926 Routers
Vulnerability Name: Zyxel EMG2926 Routers Command Injection Vulnerability
Date Added to KEV: 2023-09-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-09
Known Ransomware Campaign Use: Known
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe, https://www.zyxelguard.com/Zyxel-EOL.asp', ' https://nvd.nist.gov/vuln/detail/CVE-2017-6884']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0688
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0688']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12231
Vendor/Project: Cisco
Product: IOS software
Vulnerability Name: Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12231']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-22769
Vendor/Project: Dell
Product: RecoverPoint for Virtual Machines (RP4VMs)
Vulnerability Name: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
Date Added to KEV: 2026-02-18
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079 ', ' https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa ', ' https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-22769']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42278
Vendor/Project: Microsoft
Product: Active Directory
Vulnerability Name: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42278']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-20805
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Information Disclosure Vulnerability
Date Added to KEV: 2026-01-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-20805']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5849
Vendor/Project: Unraid
Product: Unraid
Vulnerability Name: Unraid Authentication Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-5849']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-10585
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2025-09-23
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-10585']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-1603
Vendor/Project: Ivanti
Product:  Endpoint Manager (EPM)
Vulnerability Name: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
Date Added to KEV: 2026-03-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-1603']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24985
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
Date Added to KEV: 2025-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24985']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-4344
Vendor/Project: Exim
Product: Exim
Vulnerability Name: Exim Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-4344']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-0543
Vendor/Project: Redis
Product: Debian-specific Redis Servers
Vulnerability Name: Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-0543']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-32113
Vendor/Project: Apache
Product: OFBiz
Vulnerability Name: Apache OFBiz Path Traversal Vulnerability
Date Added to KEV: 2024-08-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-28
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd', ' https://nvd.nist.gov/vuln/detail/CVE-2024-32113']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20887
Vendor/Project: VMware
Product: Aria Operations for Networks
Vulnerability Name: Vmware Aria Operations for Networks Command Injection Vulnerability
Date Added to KEV: 2023-06-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.vmware.com/security/advisories/VMSA-2023-0012.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-20887']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-29499
Vendor/Project: Mitel
Product: MiVoice Connect
Vulnerability Name: Mitel MiVoice Connect Data Validation Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-29499']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-37042
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Date Added to KEV: 2022-08-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-01
Known Ransomware Campaign Use: Known
Notes: ['https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-37042']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32315
Vendor/Project: Ignite Realtime
Product: Openfire
Vulnerability Name: Ignite Realtime Openfire Path Traversal Vulnerability
Date Added to KEV: 2023-08-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-09-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.igniterealtime.org/downloads/#openfire', '  https://nvd.nist.gov/vuln/detail/CVE-2023-32315']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24085
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Use-After-Free Vulnerability
Date Added to KEV: 2025-01-29
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/122066 ', ' https://support.apple.com/en-us/122068 ', ' https://support.apple.com/en-us/122071 ', ' https://support.apple.com/en-us/122072 ', ' https://support.apple.com/en-us/122073 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24085']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-46604
Vendor/Project: Apache
Product: ActiveMQ
Vulnerability Name: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2023-11-02
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-23
Known Ransomware Campaign Use: Known
Notes: ['https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt', ' https://nvd.nist.gov/vuln/detail/CVE-2023-46604']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-14847
Vendor/Project: MikroTik
Product: RouterOS
Vulnerability Name: MikroTik Router OS Directory Traversal Vulnerability
Date Added to KEV: 2021-12-01
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-14847']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1647
Vendor/Project: Microsoft
Product: Defender
Vulnerability Name: Microsoft Defender Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1647']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41073
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Date Added to KEV: 2022-11-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-12-09
Known Ransomware Campaign Use: Known
Notes: ['https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41073']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20016
Vendor/Project: SonicWall
Product: SSLVPN SMA100
Vulnerability Name: SonicWall SSLVPN SMA100 SQL Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20016']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-44487
Vendor/Project: IETF
Product: HTTP/2
Vulnerability Name: HTTP/2 Rapid Reset Attack Vulnerability
Date Added to KEV: 2023-10-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487', ' https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/', '  https://nvd.nist.gov/vuln/detail/CVE-2023-44487']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-36804
Vendor/Project: Atlassian
Product: Bitbucket Server and Data Center
Vulnerability Name: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Date Added to KEV: 2022-09-30
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://jira.atlassian.com/browse/BSERV-13438', '  https://nvd.nist.gov/vuln/detail/CVE-2022-36804']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-0238
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Remote Code Execution
Date Added to KEV: 2026-04-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ', ' https://nvd.nist.gov/vuln/detail/CVE-2009-0238']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0752
Vendor/Project: Rails
Product: Ruby on Rails
Vulnerability Name: Ruby on Rails Directory Traversal Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0752']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-10271
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-10271']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-14933
Vendor/Project: NUUO
Product: NVRmini Devices
Vulnerability Name: NUUO NVRmini Devices OS Command Injection Vulnerability 
Date Added to KEV: 2024-12-18
Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Due Date: 2025-01-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2018-14933']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-8605
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Use-After-Free Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-8605']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-43047
Vendor/Project: Qualcomm
Product: Multiple Chipsets 
Vulnerability Name: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Date Added to KEV: 2024-10-08
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2024-10-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/dsp-kernel/-/commit/0e27b6c7d2bd8d0453e4465ac2ca49a8f8c440e2 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-43047']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3153
Vendor/Project: Cisco
Product: AnyConnect Secure
Vulnerability Name: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Date Added to KEV: 2022-10-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-14
Known Ransomware Campaign Use: Known
Notes: ['https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj', ' https://nvd.nist.gov/vuln/detail/CVE-2020-3153']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-40799
Vendor/Project: D-Link
Product: DNR-322L
Vulnerability Name: D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
Date Added to KEV: 2025-08-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.dlink.com/uk/en/products/dnr-322l-cloud-network-video-recorder ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-40799']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-7602
Vendor/Project: Drupal
Product: Core
Vulnerability Name: Drupal Core Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-13
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-7602']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-1000861
Vendor/Project: Jenkins
Product: Jenkins Stapler Web Framework
Vulnerability Name: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-1000861']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-64446
Vendor/Project: Fortinet
Product: FortiWeb
Vulnerability Name: Fortinet FortiWeb Path Traversal Vulnerability
Date Added to KEV: 2025-11-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.fortiguard.com/psirt/FG-IR-25-910 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-64446']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3952
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Information Disclosure Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3952']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-6820
Vendor/Project: Mozilla
Product: Firefox and Thunderbird
Vulnerability Name: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-6820']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-17621
Vendor/Project: D-Link
Product: DIR-859 Router
Vulnerability Name: D-Link DIR-859 Router Command Execution Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147', ' https://nvd.nist.gov/vuln/detail/CVE-2019-17621']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0180
Vendor/Project: Cisco
Product: IOS Software
Vulnerability Name: Cisco IOS Software Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0180']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-7775
Vendor/Project: Citrix
Product: NetScaler
Vulnerability Name: Citrix NetScaler Memory Overflow Vulnerability
Date Added to KEV: 2025-08-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-7775']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28434
Vendor/Project: MinIO
Product: MinIO
Vulnerability Name: MinIO Security Feature Bypass Vulnerability
Date Added to KEV: 2023-09-19
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c', '  https://nvd.nist.gov/vuln/detail/CVE-2023-28434']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-6340
Vendor/Project: Drupal
Product: Core
Vulnerability Name: Drupal Core Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-6340']
Severity: Critical
Known Exploited Vulnerability: CVE-2007-5659
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Buffer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2007-5659']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-16928
Vendor/Project: Exim
Product: Exim Internet Mailer
Vulnerability Name: Exim Out-of-bounds Write Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-16928']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-10562
Vendor/Project: Dasan
Product: Gigabit Passive Optical Network (GPON) Routers
Vulnerability Name: Dasan GPON Routers Command Injection Vulnerability
Date Added to KEV: 2022-03-31
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-10562']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3976
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver Directory Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3976']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-68461
Vendor/Project: Roundcube
Product: Webmail
Vulnerability Name: RoundCube Webmail Cross-site Scripting Vulnerability
Date Added to KEV: 2026-02-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 ', ' https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-68461']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-27997
Vendor/Project: Fortinet
Product: FortiOS and FortiProxy SSL-VPN
Vulnerability Name: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2023-06-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-04
Known Ransomware Campaign Use: Known
Notes: ['https://www.fortiguard.com/psirt/FG-IR-23-097', '  https://nvd.nist.gov/vuln/detail/CVE-2023-27997']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-40602
Vendor/Project: SonicWall
Product: SMA1000 appliance
Vulnerability Name: SonicWall SMA1000 Missing Authorization Vulnerability
Date Added to KEV: 2025-12-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
Due Date: 2025-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['Check for signs of potential compromise on all internet accessible SonicWall SMA1000 instances after applying mitigations. For more information please see: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-40602']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-26399
Vendor/Project: SolarWinds
Product: Web Help Desk
Vulnerability Name: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2026-03-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399 ', ' https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-26399']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21237
Vendor/Project: Android
Product: Pixel
Vulnerability Name: Android Pixel Information Disclosure Vulnerability 
Date Added to KEV: 2024-03-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/pixel/2023-06-01', '  https://nvd.nist.gov/vuln/detail/CVE-2023-21237']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0149
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0149']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0787
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
Date Added to KEV: 2022-01-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-28
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0787']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-40551
Vendor/Project: SolarWinds
Product: Web Help Desk
Vulnerability Name: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2026-02-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-40551']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-34448
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-34448']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38106
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2024-08-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38106', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38106']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-14733
Vendor/Project: WatchGuard
Product: Firebox
Vulnerability Name: WatchGuard Firebox Out of Bounds Write Vulnerability
Date Added to KEV: 2025-12-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-26
Known Ransomware Campaign Use: Unknown
Notes: ['Check for signs of potential compromise on all internet accessible instances after applying mitigations. For more information please see: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-14733']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41328
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS Path Traversal Vulnerability
Date Added to KEV: 2023-03-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.fortiguard.com/psirt/FG-IR-22-369', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41328']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2729
Vendor/Project: Adobe
Product: Reader and Acrobat
Vulnerability Name: Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-2729']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-34026
Vendor/Project: Versa
Product: Concerto
Vulnerability Name: Versa Concerto Improper Authentication Vulnerability
Date Added to KEV: 2026-01-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-34026']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41265
Vendor/Project: Qlik
Product: Sense
Vulnerability Name: Qlik Sense HTTP Tunneling Vulnerability
Date Added to KEV: 2023-12-07
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2023-12-28
Known Ransomware Campaign Use: Known
Notes: ['https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801', '  https://nvd.nist.gov/vuln/detail/CVE-2023-41265']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-18426
Vendor/Project: Meta Platforms
Product: WhatsApp
Vulnerability Name: WhatsApp Cross-Site Scripting Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-18426']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-4495
Vendor/Project: Mozilla
Product: Firefox
Vulnerability Name: Mozilla Firefox Security Feature Bypass Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-4495']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-20700
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Buffer Overflow Vulnerability
Date Added to KEV: 2026-02-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/126346 ', ' https://support.apple.com/en-us/126348 ', ' https://support.apple.com/en-us/126351 ', ' https://support.apple.com/en-us/126352 ', ' https://support.apple.com/en-us/126353 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-20700']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-55177
Vendor/Project: Meta Platforms
Product: WhatsApp
Vulnerability Name: Meta Platforms WhatsApp Incorrect Authorization Vulnerability
Date Added to KEV: 2025-09-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.whatsapp.com/security/advisories/2025/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-55177']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-6065
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Integer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-6065']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-3904
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Improper Input Validation Vulnerability
Date Added to KEV: 2023-05-12
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://lkml.iu.edu/hypermail/linux/kernel/1601.3/06474.html', ' https://nvd.nist.gov/vuln/detail/CVE-2010-3904']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-3156
Vendor/Project: Sudo
Product: Sudo
Vulnerability Name: Sudo Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-04-06
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-3156']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1464
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Spoofing Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-1464']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-12641
Vendor/Project: Roundcube
Product: Roundcube Webmail
Vulnerability Name: Roundcube Webmail Remote Code Execution Vulnerability
Date Added to KEV: 2023-06-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10', ' https://nvd.nist.gov/vuln/detail/CVE-2020-12641']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30554
Vendor/Project: Google
Product: Chromium WebGL
Vulnerability Name: Google Chromium WebGL Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30554']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-35914
Vendor/Project: Teclib
Product: GLPI
Vulnerability Name: Teclib GLPI Remote Code Execution Vulnerability
Date Added to KEV: 2023-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://glpi-project.org/fr/glpi-10-0-3-disponible/, http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed.', '  https://nvd.nist.gov/vuln/detail/CVE-2022-35914']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-8562
Vendor/Project: Siemens
Product: SIMATIC CP
Vulnerability Name: Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-8562']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-30400
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows DWM Core Library Use-After-Free Vulnerability
Date Added to KEV: 2025-05-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30400 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-30400']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-38606
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Kernel Unspecified Vulnerability
Date Added to KEV: 2023-07-26
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213843,https://support.apple.com/en-us/HT213844,https://support.apple.com/en-us/HT213845,https://support.apple.com/en-us/HT213846,https://support.apple.com/en-us/HT213848 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-38606']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-6218
Vendor/Project: RARLAB
Product: WinRAR
Vulnerability Name: RARLAB WinRAR Path Traversal Vulnerability
Date Added to KEV: 2025-12-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-6218']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-3881
Vendor/Project: Cisco
Product: IOS and IOS XE
Vulnerability Name: Cisco IOS and IOS XE Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-3881']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1315
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1315']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2360
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2360']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5722
Vendor/Project: Grandstream
Product: UCM6200
Vulnerability Name: Grandstream Networks UCM6200 Series SQL Injection Vulnerability
Date Added to KEV: 2022-01-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-5722']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-0016
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows TS WebProxy Directory Traversal Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-0016']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-0754
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Memory Corruption Vulnerability
Date Added to KEV: 2022-06-08
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-0754']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-4911
Vendor/Project: GNU
Product: GNU C Library
Vulnerability Name: GNU C Library Buffer Overflow Vulnerability
Date Added to KEV: 2023-11-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-12
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://sourceware.org/git/?p=glibc.git', 'a=commitdiff', 'h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa, https://access.redhat.com/security/cve/cve-2023-4911, https://www.debian.org/security/2023/dsa-5514 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-4911  ']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-0994
Vendor/Project: Trimble
Product: Cityworks
Vulnerability Name: Trimble Cityworks Deserialization Vulnerability
Date Added to KEV: 2025-02-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?', ' https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-0994']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42237
Vendor/Project: Sitecore
Product: XP
Vulnerability Name: Sitecore XP Remote Command Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42237']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-24955
Vendor/Project: Microsoft
Product: SharePoint Server
Vulnerability Name: Microsoft SharePoint Server Code Injection Vulnerability
Date Added to KEV: 2024-03-26
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-04-16
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955', '  https://nvd.nist.gov/vuln/detail/CVE-2023-24955']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-1428
Vendor/Project: Red Hat
Product: JBoss
Vulnerability Name: Red Hat JBoss Information Disclosure Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-1428']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5847
Vendor/Project: Unraid
Product: Unraid
Vulnerability Name: Unraid Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-5847']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-39717
Vendor/Project: Versa
Product: Director
Vulnerability Name: Versa Director Dangerous File Type Upload Vulnerability
Date Added to KEV: 2024-08-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/', '   https://nvd.nist.gov/vuln/detail/CVE-2024-39717']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48927
Vendor/Project: TeleMessage
Product: TM SGNL
Vulnerability Name: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
Date Added to KEV: 2025-07-01
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-22
Known Ransomware Campaign Use: Unknown
Notes: ['It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48927']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-17496
Vendor/Project: vBulletin
Product: vBulletin
Vulnerability Name: vBulletin PHP Module Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-17496']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-29583
Vendor/Project: Zyxel
Product: Multiple Products
Vulnerability Name: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-29583']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-33073
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SMB Client Improper Access Control Vulnerability
Date Added to KEV: 2025-10-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-33073']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11652
Vendor/Project: SaltStack
Product: Salt
Vulnerability Name: SaltStack Salt Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-11652']
Severity: Critical