DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2024-11680
Vendor/Project: ProjectSend
Product: ProjectSend
Vulnerability Name: ProjectSend Improper Authentication Vulnerability
Date Added to KEV: 2024-12-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-11680']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-33053
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name:  Microsoft Windows External Control of File Name or Path Vulnerability
Date Added to KEV: 2025-06-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-33053']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-14750
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-14750']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-13927
Vendor/Project: Apache
Product: Airflow's Experimental API
Vulnerability Name: Apache Airflow's Experimental API Authentication Bypass
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-13927']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-20133
Vendor/Project: Cisco
Product: Catalyst SD-WAN Manager
Vulnerability Name: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Date Added to KEV: 2026-04-20
Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Due Date: 2026-04-23
Known Ransomware Campaign Use: Unknown
Notes: ['CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ', ' https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ', ' https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-20133']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22175
Vendor/Project: GitLab
Product: GitLab
Vulnerability Name: GitLab Server-Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2026-02-18
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-22175']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-3506
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server OS Command Injection Vulnerability
Date Added to KEV: 2024-06-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpuapr2017.html', ' https://nvd.nist.gov/vuln/detail/CVE-2017-3506']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-59689
Vendor/Project: Libraesva
Product: Email Security Gateway
Vulnerability Name: Libraesva Email Security Gateway Command Injection Vulnerability
Date Added to KEV: 2025-09-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-59689']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-14634
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Integer Overflow Vulnerability
Date Added to KEV: 2026-01-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-16
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ', ' https://www.kernel.org/ ', ' https://www.cve.org/CVERecord?id=CVE-2018-14634 ', ' https://access.redhat.com/errata/RHSA-2018:3540 ', ' https://nvd.nist.gov/vuln/detail/CVE-2018-14634']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2387
Vendor/Project: Microsoft
Product: ATM Font Driver
Vulnerability Name: Microsoft ATM Font Driver Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2387']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-47966
Vendor/Project: Zoho
Product: ManageEngine
Vulnerability Name: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Date Added to KEV: 2023-01-23
Required Action: Apply updates per vendor instructions.
Due Date: 2023-02-13
Known Ransomware Campaign Use: Known
Notes: ['https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-47966']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41061
Vendor/Project: Apple
Product: iOS, iPadOS, and watchOS
Vulnerability Name: Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
Date Added to KEV: 2023-09-11
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213905, https://support.apple.com/kb/HT213907', ' https://nvd.nist.gov/vuln/detail/CVE-2023-41061']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29492
Vendor/Project: Novi Survey
Product: Novi Survey
Vulnerability Name: Novi Survey Insecure Deserialization Vulnerability
Date Added to KEV: 2023-04-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx', ' https://nvd.nist.gov/vuln/detail/CVE-2023-29492']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1215
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1215']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41266
Vendor/Project: Qlik
Product: Sense
Vulnerability Name: Qlik Sense Path Traversal Vulnerability
Date Added to KEV: 2023-12-07
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2023-12-28
Known Ransomware Campaign Use: Known
Notes: ['https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801  ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-41266']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7193
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Memory Corruption Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7193']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6862
Vendor/Project: NETGEAR
Product: Multiple Devices
Vulnerability Name: NETGEAR Multiple Devices Buffer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6862']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-24086
Vendor/Project: Adobe
Product: Commerce and Magento Open Source
Vulnerability Name: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-24086']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22005
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server File Upload Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22005']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-27524
Vendor/Project: Apache
Product: Superset
Vulnerability Name: Apache Superset Insecure Default Initialization of Resource Vulnerability
Date Added to KEV: 2024-01-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk', '  https://nvd.nist.gov/vuln/detail/CVE-2023-27524']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0125
Vendor/Project: Cisco
Product: VPN Routers
Vulnerability Name: Cisco VPN Routers Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0125']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-8464
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-8464']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1770
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Uninitialized Memory Use Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1770']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48703
Vendor/Project: CWP
Product: Control Web Panel
Vulnerability Name: CWP Control Web Panel OS Command Injection Vulnerability
Date Added to KEV: 2025-11-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://control-webpanel.com/changelog ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48703']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0159
Vendor/Project: Cisco
Product: IOS Software and Cisco IOS XE Software
Vulnerability Name: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0159']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27104
Vendor/Project: Accellion
Product: FTA
Vulnerability Name: Accellion FTA OS Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27104']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30661
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30661']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-12686
Vendor/Project: BeyondTrust
Product: Privileged Remote Access (PRA) and Remote Support (RS)
Vulnerability Name: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
Date Added to KEV: 2025-01-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.beyondtrust.com/trust-center/security-advisories/bt24-11 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-12686']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-32756
Vendor/Project: Fortinet
Product: Multiple Products
Vulnerability Name: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2025-05-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-25-254 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32756']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7195
Vendor/Project: QNAP
Product: Photo Station
Vulnerability Name: QNAP Photo Station Path Traversal Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7195']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20118
Vendor/Project: Cisco
Product: Small Business RV Series Routers
Vulnerability Name: Cisco Small Business RV Series Routers Command Injection Vulnerability
Date Added to KEV: 2025-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-20118']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-1723
Vendor/Project: Oracle
Product: Java SE
Vulnerability Name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-1723']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-6448
Vendor/Project: Unitronics
Product: Vision PLC and HMI
Vulnerability Name: Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Date Added to KEV: 2023-12-11
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-18
Known Ransomware Campaign Use: Unknown
Notes: ['Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf', '   https://nvd.nist.gov/vuln/detail/CVE-2023-6448']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8453
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-01-21
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-21
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8453']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38812
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2024-11-20
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38812']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-27925
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Date Added to KEV: 2022-08-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-01
Known Ransomware Campaign Use: Known
Notes: ['https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-27925']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3298
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3298']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-37969
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Date Added to KEV: 2022-09-14
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969', '  https://nvd.nist.gov/vuln/detail/CVE-2022-37969']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-5119
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-5119']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1322
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1322']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7255
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7255']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-39935
Vendor/Project: GitLab
Product: Community and Enterprise Editions
Vulnerability Name: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2026-02-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-39935']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11001
Vendor/Project: Reolink
Product: Multiple IP Cameras
Vulnerability Name: Reolink Multiple IP Cameras OS Command Injection Vulnerability
Date Added to KEV: 2024-12-18
Required Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Due Date: 2025-01-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://reolink.com/product-eol/ ', ' https://reolink.com/download-center/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-11001']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31010
Vendor/Project: Apple
Product: iOS, macOS, watchOS
Vulnerability Name: Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT212804, https://support.apple.com/en-us/HT212805, https://support.apple.com/en-us/HT212806, https://support.apple.com/en-us/HT212807, https://support.apple.com/en-us/HT212824', ' https://nvd.nist.gov/vuln/detail/CVE-2021-31010']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0156
Vendor/Project: Cisco
Product: IOS Software and Cisco IOS XE Software
Vulnerability Name: Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0156']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21509
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Security Feature Bypass Vulnerability
Date Added to KEV: 2026-01-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-16
Known Ransomware Campaign Use: Unknown
Notes: ['Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21509']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-1862
Vendor/Project: Adobe
Product: Acrobat and Reader, Flash Player
Vulnerability Name: Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
Date Added to KEV: 2022-06-08
Required Action: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-1862']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20022
Vendor/Project: SonicWall
Product: SonicWall Email Security
Vulnerability Name: SonicWall Email Security Unrestricted Upload of File Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20022']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41033
Vendor/Project: Microsoft
Product: Windows COM+ Event System Service
Vulnerability Name: Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-10-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41033']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-9537
Vendor/Project: ScienceLogic
Product: SL1
Vulnerability Name: ScienceLogic SL1 Unspecified Vulnerability
Date Added to KEV: 2024-10-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.sciencelogic.com/s/article/15527 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-9537']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0968
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0968']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-47813
Vendor/Project: Wing FTP Server
Product: Wing FTP Server
Vulnerability Name: Wing FTP Server Information Disclosure Vulnerability
Date Added to KEV: 2026-03-16
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.wftpserver.com/serverhistory.htm ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-47813']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-7247
Vendor/Project: OpenBSD
Product: OpenSMTPD
Vulnerability Name: OpenSMTPD Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-7247']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22017
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Improper Access Control
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-01-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22017']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21385
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Memory Corruption Vulnerability
Date Added to KEV: 2026-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2026/2026-03-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21385']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0422
Vendor/Project: Oracle
Product: Java Runtime Environment (JRE)
Vulnerability Name: Oracle JRE Remote Code Execution Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0422']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0034
Vendor/Project: Microsoft
Product: Silverlight
Vulnerability Name: Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted products are end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0034']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-9474
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Date Added to KEV: 2024-11-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
Due Date: 2024-12-09
Known Ransomware Campaign Use: Known
Notes: ['https://security.paloaltonetworks.com/CVE-2024-9474 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-9474']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-4006
Vendor/Project: VMware
Product: Multiple Products
Vulnerability Name: Multiple VMware Products Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-4006']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-0840
Vendor/Project: Oracle
Product: Java Runtime Environment (JRE)
Vulnerability Name: Oracle JRE Unspecified Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-0840']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-6047
Vendor/Project: GeoVision
Product: Multiple Devices
Vulnerability Name: GeoVision Devices OS Command Injection Vulnerability
Date Added to KEV: 2025-05-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-6047']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1003030
Vendor/Project: Jenkins
Product: Matrix Project Plugin
Vulnerability Name: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1003030']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30860
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Integer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30860']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29300
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-01-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-29
Known Ransomware Campaign Use: Known
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html', ' https://nvd.nist.gov/vuln/detail/CVE-2023-29300']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0001
Vendor/Project: Microsoft
Product: Graphics Device Interface (GDI)
Vulnerability Name: Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0001']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8193
Vendor/Project: Citrix
Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Vulnerability Name: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8193']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8644
Vendor/Project: PlaySMS
Product: PlaySMS
Vulnerability Name: PlaySMS Server-Side Template Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8644']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-44698
Vendor/Project: Microsoft
Product: Defender
Vulnerability Name: Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
Date Added to KEV: 2022-12-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-03
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698', '  https://nvd.nist.gov/vuln/detail/CVE-2022-44698']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-1000353
Vendor/Project: Jenkins
Product: Jenkins
Vulnerability Name: Jenkins Remote Code Execution Vulnerability
Date Added to KEV: 2025-10-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.jenkins.io/security/advisory/2017-04-26/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2017-1000353']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-15752
Vendor/Project: Docker
Product: Desktop Community Edition
Vulnerability Name: Docker Desktop Community Edition Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-15752']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-2883
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-2883']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1427
Vendor/Project: Elastic
Product: Elasticsearch
Vulnerability Name: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1427']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21972
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21972']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0199
Vendor/Project: Microsoft
Product: Office and WordPad
Vulnerability Name: Microsoft Office and WordPad Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0199']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8405
Vendor/Project: Microsoft
Product: DirectX Graphics Kernel (DXGKRNL)
Vulnerability Name: Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8405']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-27363
Vendor/Project: FreeType
Product: FreeType
Vulnerability Name: FreeType Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-05-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-27
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-27363']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-9621
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2025-07-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ', ' https://wiki.zimbra.com/wiki/Security_Center ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-9621']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6327
Vendor/Project: Symantec
Product: Symantec Messaging Gateway
Vulnerability Name: Symantec Messaging Gateway Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6327']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-34102
Vendor/Project: Adobe
Product: Commerce and Magento Open Source
Vulnerability Name: Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
Date Added to KEV: 2024-07-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/magento/apsb24-40.html', '  https://nvd.nist.gov/vuln/detail/CVE-2024-34102']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6077
Vendor/Project: NETGEAR
Product: Wireless Router DGN2200
Vulnerability Name: NETGEAR DGN2200 Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6077']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0148
Vendor/Project: Microsoft
Product: SMBv1 server
Vulnerability Name: Microsoft SMBv1 Server Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-06
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-27
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0148']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-58034
Vendor/Project: Fortinet
Product: FortiWeb
Vulnerability Name: Fortinet FortiWeb OS Command Injection Vulnerability
Date Added to KEV: 2025-11-18
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-25-513 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-58034']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-23897
Vendor/Project: Jenkins
Product: Jenkins Command Line Interface (CLI)
Vulnerability Name: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Date Added to KEV: 2024-08-19
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-09
Known Ransomware Campaign Use: Known
Notes: ['https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314', ' https://nvd.nist.gov/vuln/detail/CVE-2024-23897']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-0313
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-04-13
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-0313']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0144
Vendor/Project: Microsoft
Product: SMBv1
Vulnerability Name: Microsoft SMBv1 Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0144']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-52163
Vendor/Project: Digiever
Product: DS-2105 Pro
Vulnerability Name: Digiever DS-2105 Pro Missing Authorization Vulnerability
Date Added to KEV: 2025-12-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.digiever.com/tw/support/faq-content.php?FAQ=217 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-52163']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-9163
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-04-13
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-9163']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26086
Vendor/Project: Atlassian
Product: Jira Server and Data Center
Vulnerability Name: Atlassian Jira Server and Data Center Path Traversal Vulnerability
Date Added to KEV: 2024-11-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://jira.atlassian.com/browse/JRASERVER-72695 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-26086']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-37085
Vendor/Project: VMware
Product: ESXi
Vulnerability Name: VMware ESXi Authentication Bypass Vulnerability
Date Added to KEV: 2024-07-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-20
Known Ransomware Campaign Use: Known
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505', '   https://nvd.nist.gov/vuln/detail/CVE-2024-37085']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-0666
Vendor/Project: Cisco
Product: Prime Data Center Network Manager (DCNM)
Vulnerability Name: Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-0666']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-36971
Vendor/Project: Android
Product: Kernel
Vulnerability Name: Android Kernel Remote Code Execution Vulnerability
Date Added to KEV: 2024-08-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-28
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see:   https://source.android.com/docs/security/bulletin/2024-08-01,  https://lore.kernel.org/linux-cve-announce/20240610090330.1347021-2-lee@kernel.org/T/#u ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-36971']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-1364
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-1364']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31956
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows NTFS Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-31956']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-4716
Vendor/Project: IBM
Product: Planning Analytics
Vulnerability Name: IBM Planning Analytics Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-4716']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-21919
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-21919']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-3402
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Remote Code Execution Vulnerability
Date Added to KEV: 2025-10-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 ', ' https://nvd.nist.gov/vuln/detail/CVE-2011-3402']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3897
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Use-After-Free Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3897']
Severity: Critical