DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2024-40891
Vendor/Project: Zyxel
Product: DSL CPE Devices
Vulnerability Name: Zyxel DSL CPE OS Command Injection Vulnerability
Date Added to KEV: 2025-02-11
Required Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Due Date: 2025-03-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ', ' https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-40891']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-7331
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Information Disclosure Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-7331']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-24880
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Date Added to KEV: 2023-03-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-04
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-24880', '  https://nvd.nist.gov/vuln/detail/CVE-2023-24880']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-32893
Vendor/Project: Apple
Product: iOS and macOS
Vulnerability Name: Apple iOS and macOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-08-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413', '  https://nvd.nist.gov/vuln/detail/CVE-2022-32893']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-8540
Vendor/Project: Microsoft
Product: Malware Protection Engine
Vulnerability Name: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-8540']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-7024
Vendor/Project: Google
Product: Chromium WebRTC
Vulnerability Name: Google Chromium WebRTC Heap Buffer Overflow Vulnerability
Date Added to KEV: 2024-01-02
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-23
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-7024']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-3120
Vendor/Project: Elastic
Product: Elasticsearch
Vulnerability Name: Elasticsearch Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-3120']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36742
Vendor/Project: Trend Micro
Product: Apex One, Apex One as a Service, and Worry-Free Business Security
Vulnerability Name: Trend Micro Multiple Products Improper Input Validation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://success.trendmicro.com/dcx/s/solution/000287819?language=en_US, https://success.trendmicro.com/dcx/s/solution/000287820?language=en_US', ' https://nvd.nist.gov/vuln/detail/CVE-2021-36742']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-4123
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-4123']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38189
Vendor/Project: Microsoft
Product: Project
Vulnerability Name: Microsoft Project Remote Code Execution Vulnerability 
Date Added to KEV: 2024-08-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38189', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38189']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-5786
Vendor/Project: Google
Product: Chrome Blink
Vulnerability Name: Google Chrome Blink Use-After-Free Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-5786']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-39793
Vendor/Project: Google
Product: Pixel
Vulnerability Name: Google Pixel Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-39793']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-4398
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-4398']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-5217
Vendor/Project: ServiceNow
Product: Utah, Vancouver, and Washington DC Now Platform
Vulnerability Name: ServiceNow Incomplete List of Disallowed Inputs Vulnerability
Date Added to KEV: 2024-07-29
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313', ' https://nvd.nist.gov/vuln/detail/CVE-2024-5217']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-18935
Vendor/Project: Progress
Product: Telerik UI for ASP.NET AJAX
Vulnerability Name: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-18935']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-34621
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-34621']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21510
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Shell Protection Mechanism Failure Vulnerability
Date Added to KEV: 2026-02-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21510 ']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-29824
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Date Added to KEV: 2025-04-08
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-29
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-29824']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-40139
Vendor/Project: Trend Micro
Product: Apex One and Apex One as a Service
Vulnerability Name: Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
Date Added to KEV: 2022-09-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US', '  https://nvd.nist.gov/vuln/detail/CVE-2022-40139']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-4114
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-4114']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-6543
Vendor/Project: Citrix
Product: NetScaler ADC and Gateway
Vulnerability Name: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
Date Added to KEV: 2025-06-30
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788 ', ' https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/ ', '   https://nvd.nist.gov/vuln/detail/CVE-2025-6543']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3235
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office OLE DLL Side Loading Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3235']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-7494
Vendor/Project: Samba
Product: Samba
Vulnerability Name: Samba Remote Code Execution Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Known
Notes: ['https://www.samba.org/samba/security/CVE-2017-7494.html', ' https://nvd.nist.gov/vuln/detail/CVE-2017-7494']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-5198
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Memory Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-5198']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3643
Vendor/Project: SolarWinds
Product: Virtualization Manager
Vulnerability Name: SolarWinds Virtualization Manager Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3643']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-2380
Vendor/Project: SAP
Product: Customer Relationship Management (CRM)
Vulnerability Name: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-2380']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-5195
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Race Condition Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-5195']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38178
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2024-08-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38178']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-5217
Vendor/Project: Google
Product: Chromium libvpx
Vulnerability Name: Google Chromium libvpx Heap Buffer Overflow Vulnerability
Date Added to KEV: 2023-10-02
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html', ' https://nvd.nist.gov/vuln/detail/CVE-2023-5217']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27102
Vendor/Project: Accellion
Product: FTA
Vulnerability Name: Accellion FTA OS Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27102']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-42856
Vendor/Project: Apple
Product: iOS
Vulnerability Name: Apple iOS Type Confusion Vulnerability
Date Added to KEV: 2022-12-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213516', '  https://nvd.nist.gov/vuln/detail/CVE-2022-42856']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-49897
Vendor/Project: FXC
Product: AE1021, AE1021PE
Vulnerability Name: FXC AE1021, AE1021PE OS Command Injection Vulnerability
Date Added to KEV: 2023-12-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.fxc.jp/news/20231206 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-49897']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-5274
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2024-05-28
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html?m=1', ' https://nvd.nist.gov/vuln/detail/CVE-2024-5274']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3309
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3309']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-47827
Vendor/Project: IGEL
Product: IGEL OS
Vulnerability Name: IGEL OS Use of a Key Past its Expiration Date Vulnerability
Date Added to KEV: 2025-10-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-47827']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-17087
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-17087']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22960
Vendor/Project: VMware
Product: Multiple Products
Vulnerability Name: VMware Multiple Products Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22960']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26829
Vendor/Project: OpenPLC
Product: ScadaBR
Vulnerability Name: OpenPLC ScadaBR Cross-site Scripting Vulnerability
Date Added to KEV: 2025-11-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-19
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/SCADA-LTS/Scada-LTS/pull/3211 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-26829']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-3935
Vendor/Project: ConnectWise
Product: ScreenConnect
Vulnerability Name: ConnectWise ScreenConnect Improper Authentication Vulnerability
Date Added to KEV: 2025-06-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4 ', '   https://nvd.nist.gov/vuln/detail/CVE-2025-3935']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-22952
Vendor/Project: SugarCRM
Product: Multiple Products
Vulnerability Name: Multiple SugarCRM Products Remote Code Execution Vulnerability
Date Added to KEV: 2023-02-02
Required Action: Apply updates per vendor instructions.
Due Date: 2023-02-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/', '  https://nvd.nist.gov/vuln/detail/CVE-2023-22952']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30551
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30551']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-19321
Vendor/Project: GIGABYTE
Product: Multiple Products
Vulnerability Name: GIGABYTE Multiple Products Privilege Escalation Vulnerability
Date Added to KEV: 2022-10-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-14
Known Ransomware Campaign Use: Known
Notes: ['https://www.gigabyte.com/Support/Security/1801', ' https://nvd.nist.gov/vuln/detail/CVE-2018-19321']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-0497
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Integer Underflow Vulnerablity
Date Added to KEV: 2024-09-17
Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Due Date: 2024-10-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ', ' https://nvd.nist.gov/vuln/detail/CVE-2014-0497']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-3400
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Command Injection Vulnerability
Date Added to KEV: 2024-04-12
Required Action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Due Date: 2024-04-19
Known Ransomware Campaign Use: Known
Notes: ['https://security.paloaltonetworks.com/CVE-2024-3400 ', '   https://nvd.nist.gov/vuln/detail/CVE-2024-3400']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-4437
Vendor/Project: Apache
Product: Shiro
Vulnerability Name: Apache Shiro Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-4437']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7194
Vendor/Project: QNAP
Product: Photo Station
Vulnerability Name: QNAP Photo Station Path Traversal Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7194']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-3079
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2023-06-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html', ' https://nvd.nist.gov/vuln/detail/CVE-2023-3079']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-43300
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-08-21
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/124925 ', ' https://support.apple.com/en-us/124926 ', ' https://support.apple.com/en-us/124927 ', ' https://support.apple.com/en-us/124928 ', ' https://support.apple.com/en-us/124929 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-43300']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28771
Vendor/Project: Zyxel
Product: Multiple Firewalls
Vulnerability Name: Zyxel Multiple Firewalls OS Command Injection Vulnerability
Date Added to KEV: 2023-05-31
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls', '   https://nvd.nist.gov/vuln/detail/CVE-2023-28771']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30665
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30665']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-59374
Vendor/Project: ASUS
Product: Live Update
Vulnerability Name: ASUS Live Update Embedded Malicious Code Vulnerability
Date Added to KEV: 2025-12-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.asus.com/support/faq/1018727/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-59374']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-27932
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-27932']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-29557
Vendor/Project: D-Link
Product: DIR-825 R1 Devices
Vulnerability Name: D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-29557']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21315
Vendor/Project: Npm package
Product: System Information Library for Node.JS
Vulnerability Name: System Information Library for Node.JS Command Injection
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21315']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22265
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Use-After-Free Vulnerability
Date Added to KEV: 2023-09-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1', '  https://nvd.nist.gov/vuln/detail/CVE-2022-22265']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0222
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0222']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1129
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1129']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-27198
Vendor/Project: JetBrains
Product: TeamCity
Vulnerability Name: JetBrains TeamCity Authentication Bypass Vulnerability
Date Added to KEV: 2024-03-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-28
Known Ransomware Campaign Use: Known
Notes: ['https://www.jetbrains.com/help/teamcity/teamcity-2023-11-4-release-notes.html', ' https://nvd.nist.gov/vuln/detail/CVE-2024-27198']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-53104
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-02-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-26
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024120232-CVE-2024-53104-d781@gregkh/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-53104']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38014
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Installer Improper Privilege Management Vulnerability
Date Added to KEV: 2024-09-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38014']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-39780
Vendor/Project: ASUS
Product: RT-AX55 Routers
Vulnerability Name: ASUS RT-AX55 Routers OS Command Injection Vulnerability
Date Added to KEV: 2025-06-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.asus.com/networking-iot-servers/wifi-6/all-series/rt-ax55/helpdesk_bios/?model2Name=RT-AX55 ', '   https://www.asus.com/content/asus-product-security-advisory/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-39780']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20021
Vendor/Project: SonicWall
Product: SonicWall Email Security
Vulnerability Name: SonicWall Email Security Improper Privilege Management Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20021']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4885
Vendor/Project: Progress
Product: WhatsUp Gold
Vulnerability Name: Progress WhatsUp Gold Path Traversal Vulnerability
Date Added to KEV: 2025-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4885']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-20045
Vendor/Project: Cisco
Product: Unified Communications Manager
Vulnerability Name: Cisco Unified Communications Products Code Injection Vulnerability
Date Added to KEV: 2026-01-21
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-20045']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-5591
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS Default Configuration Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-5591']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8655
Vendor/Project: EyesOfNetwork
Product: EyesOfNetwork
Vulnerability Name: EyesOfNetwork Improper Privilege Management Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8655']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-30066
Vendor/Project: tj-actions
Product: changed-files GitHub Action
Vulnerability Name: tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
Date Added to KEV: 2025-03-18
Required Action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-08
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction ', ' Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-30066']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3259
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerability Name: Cisco ASA and FTD Information Disclosure Vulnerability
Date Added to KEV: 2024-02-15
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-07
Known Ransomware Campaign Use: Known
Notes: ['https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB', ' https://nvd.nist.gov/vuln/detail/CVE-2020-3259']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-40890
Vendor/Project: Zyxel
Product: DSL CPE Devices
Vulnerability Name: Zyxel DSL CPE OS Command Injection Vulnerability
Date Added to KEV: 2025-02-11
Required Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Due Date: 2025-03-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ', ' https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-40890']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-3035
Vendor/Project: TP-Link
Product: Multiple Archer Devices
Vulnerability Name: TP-Link Multiple Archer Devices Directory Traversal Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-3035']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7855
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7855']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-7600
Vendor/Project: Drupal
Product: Drupal Core
Vulnerability Name: Drupal Core Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-7600']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20953
Vendor/Project: Oracle
Product: Agile Product Lifecycle Management (PLM)
Vulnerability Name: Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
Date Added to KEV: 2025-02-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpujan2024.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-20953']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-37383
Vendor/Project: Roundcube
Product: Webmail
Vulnerability Name: RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2024-10-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/roundcube/roundcubemail/releases/tag/1.5.7, https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-37383']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36563
Vendor/Project: Microsoft
Product: WordPad
Vulnerability Name: Microsoft WordPad Information Disclosure Vulnerability
Date Added to KEV: 2023-10-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36563', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36563']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31755
Vendor/Project: Tenda
Product: AC11 Router
Vulnerability Name: Tenda AC11 Router Stack Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-31755']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-47729
Vendor/Project: TeleMessage
Product: TM SGNL
Vulnerability Name: TeleMessage TM SGNL Hidden Functionality Vulnerability
Date Added to KEV: 2025-05-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['Apply mitigations per vendor instructions. Absent mitigating instructions from the vendor, discontinue use of the product. ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-47729']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0703
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SMB Information Disclosure Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0703']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0179
Vendor/Project: Cisco
Product: IOS Software
Vulnerability Name: Cisco IOS Software Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0179']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40450
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-40450']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21590
Vendor/Project: Juniper
Product: Junos OS
Vulnerability Name: Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
Date Added to KEV: 2025-03-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21590']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-29574
Vendor/Project: Sophos
Product: CyberoamOS
Vulnerability Name: CyberoamOS (CROS) SQL Injection Vulnerability
Date Added to KEV: 2025-02-06
Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Due Date: 2025-02-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.sophos.com/support/s/article/KBA-000007526 ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-29574']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32049
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability
Date Added to KEV: 2023-07-11
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-08-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049', ' https://nvd.nist.gov/vuln/detail/CVE-2023-32049']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-23760
Vendor/Project: SmarterTools
Product: SmarterMail
Vulnerability Name: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
Date Added to KEV: 2026-01-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-16
Known Ransomware Campaign Use: Known
Notes: ['https://www.smartertools.com/smartermail/release-notes/current ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-23760']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1906
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1906']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6744
Vendor/Project: Cisco
Product: IOS software
Vulnerability Name: Cisco IOS Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6744']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3427
Vendor/Project: Oracle
Product: Java SE and JRockit
Vulnerability Name: Oracle Java SE and JRockit Unspecified Vulnerability
Date Added to KEV: 2023-05-12
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpuapr2016v3.html', ' https://nvd.nist.gov/vuln/detail/CVE-2016-3427']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-7645
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-7645']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-26919
Vendor/Project: NETGEAR
Product: JGS516PE Devices
Vulnerability Name: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-26919']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-3035
Vendor/Project: Cisco
Product: IOS XR
Vulnerability Name: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-3035']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6737
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6737']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-6693
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Date Added to KEV: 2025-06-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-16
Known Ransomware Campaign Use: Known
Notes: ['https://fortiguard.com/advisory/FG-IR-19-007 ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-6693']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-1646
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Read Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-1646']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-2747
Vendor/Project: Kentico
Product: Xperience CMS
Vulnerability Name: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Date Added to KEV: 2025-10-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://devnet.kentico.com/download/hotfixes ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-2747']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26138
Vendor/Project: Atlassian
Product: Confluence
Vulnerability Name: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Date Added to KEV: 2022-07-29
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-26138']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-7961
Vendor/Project: Liferay
Product: Liferay Portal
Vulnerability Name: Liferay Portal Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-7961']
Severity: Critical