DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2025-32463
Vendor/Project: Sudo
Product: Sudo
Vulnerability Name: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Date Added to KEV: 2025-09-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-20
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/chroot_bug/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32463']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-6277
Vendor/Project: NETGEAR
Product: Multiple Routers
Vulnerability Name: NETGEAR Multiple Routers Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-6277']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36942
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-36942']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-6324
Vendor/Project: Microsoft
Product: Kerberos Key Distribution Center (KDC)
Vulnerability Name: Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-6324']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3452
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerability Name: Cisco ASA and FTD Read-Only Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3452']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-43200
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Unspecified Vulnerability
Date Added to KEV: 2025-06-16
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/122174 ', ' https://support.apple.com/en-us/122173 ', ' https://support.apple.com/en-us/122900 ', ' https://support.apple.com/en-us/122901 ', ' https://support.apple.com/en-us/122902 ', ' https://support.apple.com/en-us/122903 ', ' https://support.apple.com/en-us/122904 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-43200']
Severity: Critical
Known Exploited Vulnerability: CVE-2006-1547
Vendor/Project: Apache
Product: Struts 1
Vulnerability Name: Apache Struts 1 ActionForm Denial-of-Service Vulnerability
Date Added to KEV: 2022-01-21
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2006-1547']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48572
Vendor/Project: Android
Product: Framework
Vulnerability Name: Android Framework Privilege Escalation Vulnerability
Date Added to KEV: 2025-12-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/2025-12-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48572']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-8110
Vendor/Project: Gogs
Product: Gogs
Vulnerability Name: Gogs Path Traversal Vulnerability
Date Added to KEV: 2026-01-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-8110']
Severity: Critical
Known Exploited Vulnerability: CVE-2008-3431
Vendor/Project: Oracle
Product: VirtualBox
Vulnerability Name: Oracle VirtualBox Insufficient Input Validation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2008-3431']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-11826
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-11826']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-10181
Vendor/Project: Sumavision
Product: Enhanced Multimedia Router (EMR)
Vulnerability Name: Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-10181']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-4863
Vendor/Project: Google
Product: Chromium WebP
Vulnerability Name: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2023-09-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1', ' https://nvd.nist.gov/vuln/detail/CVE-2023-4863']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26485
Vendor/Project: Mozilla
Product: Firefox
Vulnerability Name: Mozilla Firefox Use-After-Free Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-26485']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-2386
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver SQL Injection Vulnerability
Date Added to KEV: 2022-06-09
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-2386']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-4324
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Use-After-Free Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-4324']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-6287
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-6287']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20439
Vendor/Project: Cisco
Product: Smart Licensing Utility
Vulnerability Name: Cisco Smart Licensing Utility Static Credential Vulnerability
Date Added to KEV: 2025-03-31
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-20439']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-33045
Vendor/Project: Dahua
Product: IP Camera Firmware
Vulnerability Name: Dahua IP Camera Authentication Bypass Vulnerability
Date Added to KEV: 2024-08-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582', ' https://nvd.nist.gov/vuln/detail/CVE-2021-33045']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22948
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Incorrect Default File Permissions Vulnerability 
Date Added to KEV: 2024-07-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.vmware.com/security/advisories/VMSA-2022-0009.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-22948']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-0496
Vendor/Project: Adobe
Product: Reader and Acrobat
Vulnerability Name: Adobe Reader and Acrobat Use-After-Free Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-0496']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22054
Vendor/Project: Omnissa
Product: Workspace One UEM
Vulnerability Name: Omnissa Workspace ONE Server-Side Request Forgery
Date Added to KEV: 2026-03-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-22054']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44515
Vendor/Project: Zoho
Product: Desktop Central
Vulnerability Name: Zoho Desktop Central Authentication Bypass Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-44515']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20023
Vendor/Project: SonicWall
Product: SonicWall Email Security
Vulnerability Name: SonicWall Email Security Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20023']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-8439
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Dereferenced Pointer Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-8439']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-23874
Vendor/Project: McAfee
Product: McAfee Total Protection (MTP)
Vulnerability Name: McAfee Total Protection (MTP) Improper Privilege Management Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-23874']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29357
Vendor/Project: Microsoft
Product: SharePoint Server
Vulnerability Name: Microsoft SharePoint Server Privilege Escalation Vulnerability
Date Added to KEV: 2024-01-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-31
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357', ' https://nvd.nist.gov/vuln/detail/CVE-2023-29357']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-19949
Vendor/Project: QNAP
Product: Network Attached Storage (NAS)
Vulnerability Name: QNAP NAS File Station Command Injection Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-19949']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1380
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-1380']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-5330
Vendor/Project: Ubiquiti
Product: AirOS
Vulnerability Name: Ubiquiti AirOS Command Injection Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-5330']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1385
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1385']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-45382
Vendor/Project: D-Link
Product: Multiple Routers
Vulnerability Name: D-Link Multiple Routers Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-04
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-45382']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-5638
Vendor/Project: Apache
Product: Struts
Vulnerability Name: Apache Struts Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-5638']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2545
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Malformed EPS File Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2545']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4577
Vendor/Project: PHP Group
Product: PHP
Vulnerability Name: PHP-CGI OS Command Injection Vulnerability
Date Added to KEV: 2024-06-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-03
Known Ransomware Campaign Use: Known
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see:  https://www.php.net/ChangeLog-8.php#', '   https://nvd.nist.gov/vuln/detail/CVE-2024-4577']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-3113
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-04-13
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-3113']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0101
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Transaction Manager Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0101']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-33010
Vendor/Project: Zyxel
Product: Multiple Firewalls
Vulnerability Name: Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Date Added to KEV: 2023-06-05
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls', '  https://nvd.nist.gov/vuln/detail/CVE-2023-33010']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6743
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6743']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-11882
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-11882']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0151
Vendor/Project: Microsoft
Product: Client-Server Run-time Subsystem (CSRSS)
Vulnerability Name: Microsoft Windows CSRSS Security Feature Bypass Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0151']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0175
Vendor/Project: Cisco
Product: IOS, XR, and XE Software
Vulnerability Name: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0175']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-48503
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Unspecified Vulnerability
Date Added to KEV: 2025-10-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213340 ', ' https://support.apple.com/en-us/HT213341 ', ' https://support.apple.com/en-us/HT213342 ', ' https://support.apple.com/en-us/HT213345 ', ' https://support.apple.com/en-us/HT213346 ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-48503']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-13382
Vendor/Project: Fortinet
Product: FortiOS and FortiProxy
Vulnerability Name: Fortinet FortiOS and FortiProxy Improper Authorization
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-13382']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30563
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30563']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0172
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0172']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-27532
Vendor/Project: Veeam
Product: Backup & Replication
Vulnerability Name: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2023-08-22
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-09-12
Known Ransomware Campaign Use: Known
Notes: ['https://www.veeam.com/kb4424', '  https://nvd.nist.gov/vuln/detail/CVE-2023-27532']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7256
Vendor/Project: Nice
Product: Linear eMerge E3-Series
Vulnerability Name: Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Date Added to KEV: 2024-03-25
Required Action: Contact the vendor for guidance on remediating firmware, per their advisory.
Due Date: 2024-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://linear-solutions.com/wp-content/uploads/E3-Bulletin-06-27-2023.pdf, https://www.cisa.gov/news-events/ics-advisories/icsa-24-065-01', ' https://nvd.nist.gov/vuln/detail/CVE-2019-7256']
Severity: Critical
Known Exploited Vulnerability: CVE-2005-2773
Vendor/Project: Hewlett Packard (HP)
Product: OpenView Network Node Manager
Vulnerability Name: HP OpenView Network Node Manager Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2005-2773']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24201
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-03-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/122281 ', ' https://support.apple.com/en-us/122283 ', ' https://support.apple.com/en-us/122284 ', ' https://support.apple.com/en-us/122285 ', ' ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24201']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-20821
Vendor/Project: Cisco
Product: IOS XR
Vulnerability Name: Cisco IOS XR Open Port Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-20821']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32046
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability
Date Added to KEV: 2023-07-11
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-08-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046', '  https://nvd.nist.gov/vuln/detail/CVE-2023-32046']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-36537
Vendor/Project: ZK Framework
Product: AuUploader
Vulnerability Name: ZK Framework AuUploader Unspecified Vulnerability
Date Added to KEV: 2023-02-27
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-20
Known Ransomware Campaign Use: Known
Notes: ['https://tracker.zkoss.org/browse/ZK-5150', '  https://nvd.nist.gov/vuln/detail/CVE-2022-36537']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-41773
Vendor/Project: Apache
Product: HTTP Server
Vulnerability Name: Apache HTTP Server Path Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-41773']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-9079
Vendor/Project: Mozilla
Product: Firefox, Firefox ESR, and Thunderbird
Vulnerability Name: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Date Added to KEV: 2023-06-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079', ' https://nvd.nist.gov/vuln/detail/CVE-2016-9079']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-5825
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-5825']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28204
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
Date Added to KEV: 2023-05-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765', '  https://nvd.nist.gov/vuln/detail/CVE-2023-28204']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2551
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Use-After-Free Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-2551']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-6789
Vendor/Project: Exim
Product: Exim
Vulnerability Name: Exim Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-6789']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1579
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1579']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-4427
Vendor/Project: Ivanti
Product: Endpoint Manager Mobile (EPMM)
Vulnerability Name: Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
Date Added to KEV: 2025-05-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-4427']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-11667
Vendor/Project: Zyxel
Product: Multiple Firewalls
Vulnerability Name: Zyxel Multiple Firewalls Path Traversal Vulnerability
Date Added to KEV: 2024-12-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-24
Known Ransomware Campaign Use: Known
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-11667']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-68613
Vendor/Project: n8n
Product: n8n
Vulnerability Name: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
Date Added to KEV: 2026-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-68613']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-1823
Vendor/Project: Android
Product: Android OS
Vulnerability Name: Android OS Privilege Escalation Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://android.googlesource.com/platform/system/vold/+/c51920c82463b240e2be0430849837d6fdc5352e', ' https://nvd.nist.gov/vuln/detail/CVE-2011-1823']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8816
Vendor/Project: Pi-hole
Product: AdminLTE
Vulnerability Name: Pi-Hole AdminLTE Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8816']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0158
Vendor/Project: Cisco
Product: IOS Software and Cisco IOS XE Software
Vulnerability Name: Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0158']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0263
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0263']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-47986
Vendor/Project: IBM
Product: Aspera Faspex
Vulnerability Name: IBM Aspera Faspex Code Execution Vulnerability
Date Added to KEV: 2023-02-21
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-14
Known Ransomware Campaign Use: Known
Notes: ['https://exchange.xforce.ibmcloud.com/vulnerabilities/243512?_ga=2.189195179.1800390251.1676559338-700333034.1676325890', '  https://nvd.nist.gov/vuln/detail/CVE-2022-47986']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1769
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Mount Manager Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1769']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-41710
Vendor/Project: Mitel
Product: SIP Phones
Vulnerability Name: Mitel SIP Phones Argument Injection Vulnerability
Date Added to KEV: 2025-02-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0019-001-v2.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-41710']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-4068
Vendor/Project: Arcserve
Product: Unified Data Protection (UDP)
Vulnerability Name: Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-4068']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-58136
Vendor/Project: Yiiframework
Product: Yii
Vulnerability Name: Yiiframework Yii Improper Protection of Alternate Path Vulnerability
Date Added to KEV: 2025-05-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-23
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-58136']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-9463
Vendor/Project: Palo Alto Networks
Product: Expedition
Vulnerability Name: Palo Alto Networks Expedition OS Command Injection Vulnerability
Date Added to KEV: 2024-11-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.paloaltonetworks.com/PAN-SA-2024-0010 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-9463']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-20703
Vendor/Project: Cisco
Product: Small Business RV160, RV260, RV340, and RV345 Series Routers
Vulnerability Name: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-20703']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1297
Vendor/Project: Microsoft
Product: Excel
Vulnerability Name: Microsoft Excel Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1297']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21391
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Storage Link Following Vulnerability
Date Added to KEV: 2025-02-11
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21391']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-11292
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Type Confusion Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-11292']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32435
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Memory Corruption Vulnerability
Date Added to KEV: 2023-06-23
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213670, https://support.apple.com/en-us/HT213671, https://support.apple.com/en-us/HT213676, https://support.apple.com/en-us/HT213811', '  https://nvd.nist.gov/vuln/detail/CVE-2023-32435']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-7971
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2024-08-26
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html', ' https://nvd.nist.gov/vuln/detail/CVE-2024-7971']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-44221
Vendor/Project: SonicWall
Product: SMA100 Appliances
Vulnerability Name: SonicWall SMA100 Appliances OS Command Injection Vulnerability
Date Added to KEV: 2025-05-01
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-44221']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8414
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Shell Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8414']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1367
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1367']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0147
Vendor/Project: Cisco
Product: Secure Access Control System (ACS)
Vulnerability Name: Cisco Secure Access Control System Java Deserialization Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0147']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-21587
Vendor/Project: Oracle
Product: E-Business Suite
Vulnerability Name: Oracle E-Business Suite Unspecified Vulnerability
Date Added to KEV: 2023-02-02
Required Action: Apply updates per vendor instructions.
Due Date: 2023-02-23
Known Ransomware Campaign Use: Known
Notes: ['https://www.oracle.com/security-alerts/cpuoct2022.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-21587']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6742
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2023-04-19
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp', ' https://nvd.nist.gov/vuln/detail/CVE-2017-6742']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41040
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Date Added to KEV: 2022-09-30
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-21
Known Ransomware Campaign Use: Known
Notes: ['https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41040']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-54085
Vendor/Project: AMI
Product: MegaRAC SPx
Vulnerability Name: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
Date Added to KEV: 2025-06-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-16
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf ', ' https://security.netapp.com/advisory/ntap-20250328-0003/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-54085']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-46169
Vendor/Project: Cacti
Product: Cacti
Vulnerability Name: Cacti Command Injection Vulnerability
Date Added to KEV: 2023-02-16
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf', '  https://nvd.nist.gov/vuln/detail/CVE-2022-46169']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24991
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
Date Added to KEV: 2025-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24991 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24991']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-13272
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Improper Privilege Management Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-13272']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-48365
Vendor/Project: Qlik
Product: Sense
Vulnerability Name: Qlik Sense HTTP Tunneling Vulnerability
Date Added to KEV: 2025-01-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-03
Known Ransomware Campaign Use: Known
Notes: ['https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-48365']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-1812
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-1812']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-28987
Vendor/Project: SolarWinds
Product: Web Help Desk
Vulnerability Name: SolarWinds Web Help Desk Hardcoded Credential Vulnerability
Date Added to KEV: 2024-10-15
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-28987']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-21882
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-02-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-21882']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-10758
Vendor/Project: MongoDB
Product: mongo-express
Vulnerability Name: MongoDB mongo-express Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-10758']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2251
Vendor/Project: Apache
Product: Struts
Vulnerability Name: Apache Struts Improper Input Validation Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-2251']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-3560
Vendor/Project: Red Hat
Product: Polkit
Vulnerability Name: Red Hat Polkit Incorrect Authorization Vulnerability
Date Added to KEV: 2023-05-12
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://bugzilla.redhat.com/show_bug.cgi?id=1961710', ' https://nvd.nist.gov/vuln/detail/CVE-2021-3560']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25297
Vendor/Project: Nagios
Product: Nagios XI
Vulnerability Name: Nagios XI OS Command Injection
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-25297']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0155
Vendor/Project: Cisco
Product: Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches
Vulnerability Name: Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0155']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-11953
Vendor/Project: React Native Community
Product: CLI
Vulnerability Name: React Native Community CLI OS Command Injection Vulnerability
Date Added to KEV: 2026-02-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-26
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 ', ' https://github.com/react-native-community/cli/pull/2735 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-11953']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0859
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0859']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0213
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0213']
Severity: Critical