DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2021-38646
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38646']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48543
Vendor/Project: Android
Product: Runtime
Vulnerability Name: Android Runtime Use-After-Free Vulnerability
Date Added to KEV: 2025-09-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/2025-09-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48543']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-34362
Vendor/Project: Progress
Product: MOVEit Transfer
Vulnerability Name: Progress MOVEit Transfer SQL Injection Vulnerability
Date Added to KEV: 2023-06-02
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-23
Known Ransomware Campaign Use: Known
Notes: ['This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.', '  https://nvd.nist.gov/vuln/detail/CVE-2023-34362']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-39226
Vendor/Project: Grafana Labs
Product: Grafana
Vulnerability Name: Grafana Authentication Bypass Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/', ' https://nvd.nist.gov/vuln/detail/CVE-2021-39226']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-6882
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2022-04-19
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-6882']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0797
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0797']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-58360
Vendor/Project: OSGeo
Product: GeoServer
Vulnerability Name: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
Date Added to KEV: 2025-12-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-01
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects an open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 ', ' https://osgeo-org.atlassian.net/browse/GEOS-11922 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-58360']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-16010
Vendor/Project: Google
Product: Chrome for Android UI
Vulnerability Name: Google Chrome for Android UI Heap Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-16010']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-8069
Vendor/Project: Citrix
Product: Session Recording
Vulnerability Name: Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-08-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/external/article/691941/citrix-session-recording-security-bullet.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-8069']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0646
Vendor/Project: Microsoft
Product: .NET Framework
Vulnerability Name: Microsoft .NET Framework Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0646']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-3066
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Deserialization Vulnerability
Date Added to KEV: 2025-02-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2017-3066']
Severity: Critical
Known Exploited Vulnerability: CVE-2002-0367
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2002-0367']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0752
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Type Confusion Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0752']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3351
Vendor/Project: Microsoft
Product: Internet Explorer and Edge
Vulnerability Name: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3351']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-4117
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-4117']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-34713
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Date Added to KEV: 2022-08-09
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713', '  https://nvd.nist.gov/vuln/detail/CVE-2022-34713']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-2539
Vendor/Project: Microsoft
Product: Word
Vulnerability Name: Microsoft Word Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-2539']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1458
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1458']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0145
Vendor/Project: Microsoft
Product: SMBv1
Vulnerability Name: Microsoft SMBv1 Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0145']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-35394
Vendor/Project: Realtek
Product: Jungle Software Development Kit (SDK)
Vulnerability Name: Realtek Jungle SDK Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-35394']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-6415
Vendor/Project: Cisco
Product: IOS, IOS XR, and IOS XE
Vulnerability Name: Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
Date Added to KEV: 2023-05-19
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1', ' https://nvd.nist.gov/vuln/detail/CVE-2016-6415']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-19356
Vendor/Project: Netis
Product: WF2419 Devices
Vulnerability Name: Netis WF2419 Devices Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-19356']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-29303
Vendor/Project: SolarView
Product: Compact
Vulnerability Name: SolarView Compact Command Injection Vulnerability
Date Added to KEV: 2023-07-13
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-08-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://jvn.jp/en/vu/JVNVU92327282/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-29303']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-24816
Vendor/Project: OSGeo
Product: JAI-EXT
Vulnerability Name: OSGeo GeoServer JAI-EXT Code Injection Vulnerability
Date Added to KEV: 2024-06-26
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-17
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. The patched JAI-EXT is version 1.1.22: https://github.com/geosolutions-it/jai-ext/releases/tag/1.1.22, https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx', '  https://nvd.nist.gov/vuln/detail/CVE-2022-24816']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-2725
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server, Injection
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-2725']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-6558
Vendor/Project: Google
Product: Chromium
Vulnerability Name: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Date Added to KEV: 2025-07-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-6558']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-2533
Vendor/Project: PaperCut
Product: NG/MF
Vulnerability Name: PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
Date Added to KEV: 2025-07-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.papercut.com/kb/Main/SecurityBulletinJune2023 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-2533']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-21412
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Date Added to KEV: 2024-02-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-05
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412', ' https://nvd.nist.gov/vuln/detail/CVE-2024-21412']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-10561
Vendor/Project: Dasan
Product: Gigabit Passive Optical Network (GPON) Routers
Vulnerability Name: Dasan GPON Routers Authentication Bypass Vulnerability
Date Added to KEV: 2022-03-31
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-10561']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-47565
Vendor/Project: QNAP
Product: VioStor NVR
Vulnerability Name: QNAP VioStor NVR OS Command Injection Vulnerability
Date Added to KEV: 2023-12-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.qnap.com/en/security-advisory/qsa-23-48 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-47565']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26486
Vendor/Project: Mozilla
Product: Firefox
Vulnerability Name: Mozilla Firefox Use-After-Free Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-26486']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-3075
Vendor/Project: Google
Product: Chromium Mojo
Vulnerability Name: Google Chromium Mojo Insufficient Data Validation Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3075', '  https://nvd.nist.gov/vuln/detail/CVE-2022-3075']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25370
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Memory Corruption Vulnerability
Date Added to KEV: 2022-11-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25370']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0261
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Use-After-Free Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0261']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36584
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Date Added to KEV: 2023-11-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36584']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-26083
Vendor/Project: Arm
Product: Mali Graphics Processing Unit (GPU)
Vulnerability Name: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability
Date Added to KEV: 2023-04-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities', '  https://nvd.nist.gov/vuln/detail/CVE-2023-26083']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12149
Vendor/Project: Red Hat
Product: JBoss Application Server
Vulnerability Name: Red Hat JBoss Application Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12149']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-2388
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver Information Disclosure Vulnerability
Date Added to KEV: 2022-06-09
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-2388']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21643
Vendor/Project: Fortinet
Product: FortiClient EMS
Vulnerability Name: Fortinet FortiClient EMS SQL Injection Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21643']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36948
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Update Medic Service Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-36948']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38406
Vendor/Project: Delta Electronics
Product: DOPSoft 2
Vulnerability Name: Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability
Date Added to KEV: 2022-08-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-02', ' https://nvd.nist.gov/vuln/detail/CVE-2021-38406']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-8291
Vendor/Project: Artifex
Product: Ghostscript
Vulnerability Name: Artifex Ghostscript Type Confusion Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-8291']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21975
Vendor/Project: VMware
Product: vRealize Operations Manager API
Vulnerability Name: VMware Server Side Request Forgery in vRealize Operations Manager API
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-01
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21975']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-55550
Vendor/Project: Mitel
Product: MiCollab
Vulnerability Name: Mitel MiCollab Path Traversal Vulnerability
Date Added to KEV: 2025-01-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-28
Known Ransomware Campaign Use: Known
Notes: ['https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-55550']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20038
Vendor/Project: SonicWall
Product: SMA 100 Appliances
Vulnerability Name: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-01-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-11
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20038']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-20131
Vendor/Project: Cisco
Product: Secure Firewall Management Center (FMC)
Vulnerability Name: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2026-03-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-22
Known Ransomware Campaign Use: Known
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-20131']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21674
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability
Date Added to KEV: 2023-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674', '  https://nvd.nist.gov/vuln/detail/CVE-2023-21674']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-0611
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2011-0611']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-28664
Vendor/Project: Arm
Product: Mali Graphics Processing Unit (GPU)
Vulnerability Name: Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-28664']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-50224
Vendor/Project: TP-Link
Product: TL-WR841N
Vulnerability Name: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
Date Added to KEV: 2025-09-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.tp-link.com/us/support/faq/4308/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-50224']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36761
Vendor/Project: Microsoft
Product: Word
Vulnerability Name: Microsoft Word Information Disclosure Vulnerability
Date Added to KEV: 2023-09-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36761']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42013
Vendor/Project: Apache
Product: HTTP Server
Vulnerability Name: Apache HTTP Server Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42013']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-53197
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Out-of-Bounds Access Vulnerability
Date Added to KEV: 2025-04-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-30
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/ ', ' https://source.android.com/docs/security/bulletin/2025-04-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-53197']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-23752
Vendor/Project: Joomla!
Product: Joomla!
Vulnerability Name: Joomla! Improper Access Control Vulnerability
Date Added to KEV: 2024-01-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-23752']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-55956
Vendor/Project: Cleo
Product: Multiple Products
Vulnerability Name: Cleo Multiple Products Unauthenticated File Upload Vulnerability
Date Added to KEV: 2024-12-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-07
Known Ransomware Campaign Use: Known
Notes: ['https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-55956']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-17463
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Remote Code Execution Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-17463']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-5076
Vendor/Project: Oracle
Product: Java SE
Vulnerability Name: Oracle Java SE Sandbox Bypass Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-5076']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-22225
Vendor/Project: VMware
Product: ESXi
Vulnerability Name: VMware ESXi Arbitrary Write Vulnerability
Date Added to KEV: 2025-03-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-25
Known Ransomware Campaign Use: Known
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-22225']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25371
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Unspecified Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25371']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-39197
Vendor/Project: Fortra
Product: Cobalt Strike
Vulnerability Name: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-39197']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4610
Vendor/Project: Arm
Product: Mali GPU Kernel Driver
Vulnerability Name: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Date Added to KEV: 2024-06-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4610']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-22719
Vendor/Project: Broadcom
Product: VMware Aria Operations
Vulnerability Name: Broadcom VMware Aria Operations Command Injection Vulnerability
Date Added to KEV: 2026-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ', ' https://knowledge.broadcom.com/external/article/430349 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-22719']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-5631
Vendor/Project: Roundcube
Product: Webmail
Vulnerability Name: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2023-10-26
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2023/10/16/security-update-1.6.4-released, https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-5631']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1147
Vendor/Project: Microsoft
Product: .NET Framework, SharePoint, Visual Studio
Vulnerability Name: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-1147']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26258
Vendor/Project: D-Link
Product: DIR-820L
Vulnerability Name: D-Link DIR-820L Remote Code Execution Vulnerability
Date Added to KEV: 2022-09-08
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10295', '  https://nvd.nist.gov/vuln/detail/CVE-2022-26258']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-14644
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Remote Code Execution Vulnerability
Date Added to KEV: 2024-09-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpujul2020.html  ', '  https://nvd.nist.gov/vuln/detail/CVE-2020-14644']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-15133
Vendor/Project: Laravel
Product: Laravel Framework
Vulnerability Name: Laravel Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-01-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30', ' https://nvd.nist.gov/vuln/detail/CVE-2018-15133']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-43208
Vendor/Project: NextGen Healthcare
Product: Mirth Connect
Vulnerability Name: NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-05-20
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-10
Known Ransomware Campaign Use: Known
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status.   For more information, please see: https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-43208']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20767
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Improper Access Control Vulnerability
Date Added to KEV: 2024-12-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-20767']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-3248
Vendor/Project: Langflow
Product: Langflow
Vulnerability Name: Langflow Missing Authentication Vulnerability
Date Added to KEV: 2025-05-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-26
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/advisories/GHSA-c995-4fw3-j39m ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-3248']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-7101
Vendor/Project: Spreadsheet::ParseExcel
Product: Spreadsheet::ParseExcel
Vulnerability Name: Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Date Added to KEV: 2024-01-02
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-23
Known Ransomware Campaign Use: Unknown
Notes: ["This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://metacpan.org/dist/Spreadsheet-ParseExcel and Barracuda's specific implementation and fix for their downstream issue CVE-2023-7102 at https://www.barracuda.com/company/legal/esg-vulnerability", '  https://nvd.nist.gov/vuln/detail/CVE-2023-7101']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2502
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2022-04-13
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2502']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-9082
Vendor/Project: ThinkPHP
Product: ThinkPHP
Vulnerability Name: ThinkPHP Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-9082']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-4681
Vendor/Project: Oracle
Product: Java SE
Vulnerability Name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-4681']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-43769
Vendor/Project: Hitachi Vantara
Product: Pentaho Business Analytics (BA) Server
Vulnerability Name: Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
Date Added to KEV: 2025-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769 ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-43769']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27860
Vendor/Project: FatPipe
Product: WARP, IPVPN, and MPVPN software
Vulnerability Name: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-01-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27860']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1064
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1064']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21333
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability
Date Added to KEV: 2025-01-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21333 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21333']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8467
Vendor/Project: Trend Micro
Product: Apex One and OfficeScan
Vulnerability Name: Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8467']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-0108
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Date Added to KEV: 2025-02-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.paloaltonetworks.com/CVE-2025-0108 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-0108']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-3929
Vendor/Project: Crestron
Product: Multiple Products
Vulnerability Name: Crestron Multiple Products Command Injection Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-3929']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-33017
Vendor/Project: Langflow
Product: Langflow
Vulnerability Name: Langflow Code Injection Vulnerability
Date Added to KEV: 2026-03-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-33017']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38226
Vendor/Project: Microsoft
Product: Publisher
Vulnerability Name: Microsoft Publisher Protection Mechanism Failure Vulnerability
Date Added to KEV: 2024-09-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38226', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38226']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-48248
Vendor/Project: NAKIVO
Product: Backup and Replication
Vulnerability Name: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
Date Added to KEV: 2025-03-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-48248']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-7796
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Date Added to KEV: 2026-02-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7 ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-7796']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-21287
Vendor/Project: Oracle
Product: Agile Product Lifecycle Management (PLM)
Vulnerability Name: Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
Date Added to KEV: 2024-11-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/alert-cve-2024-21287.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-21287']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-35674
Vendor/Project: Android
Product: Framework
Vulnerability Name: Android Framework Privilege Escalation Vulnerability
Date Added to KEV: 2023-09-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/2023-09-01', '  https://nvd.nist.gov/vuln/detail/CVE-2023-35674']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26828
Vendor/Project: OpenPLC
Product: ScadaBR
Vulnerability Name: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
Date Added to KEV: 2025-12-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/SCADA-LTS/Scada-LTS/pull/2174 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-26828']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3900
Vendor/Project: Microsoft
Product: WinVerifyTrust function
Vulnerability Name: Microsoft WinVerifyTrust function Remote Code Execution
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3900']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6736
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6736']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-32917
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
Date Added to KEV: 2022-09-14
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213445, https://support.apple.com/en-us/HT213444', '  https://nvd.nist.gov/vuln/detail/CVE-2022-32917']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8440
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8440']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-2215
Vendor/Project: Android
Product: Android Kernel
Vulnerability Name: Android Kernel Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-2215']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36033
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
Date Added to KEV: 2023-11-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36033']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-27038
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Date Added to KEV: 2025-06-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-24
Known Ransomware Campaign Use: Unknown
Notes: ['Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ', '   https://nvd.nist.gov/vuln/detail/CVE-2025-27038']
Severity: Critical