DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2017-11317
Vendor/Project: Telerik
Product: User Interface (UI) for ASP.NET AJAX
Vulnerability Name: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-11317']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-32030
Vendor/Project: ASUS
Product: Routers
Vulnerability Name: ASUS Routers Improper Authentication Vulnerability
Date Added to KEV: 2025-06-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/ ', ' https://www.asus.com/us/supportonly/rog%20rapture%20gt-ac2900/helpdesk_bios/', ' https://nvd.nist.gov/vuln/detail/CVE-2021-32030']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38193
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
Date Added to KEV: 2024-08-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38193']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-4113
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-4113']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-35464
Vendor/Project: ForgeRock
Product: Access Management (AM)
Vulnerability Name: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-35464']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-20281
Vendor/Project: Cisco
Product: Identity Services Engine
Vulnerability Name: Cisco Identity Services Engine Injection Vulnerability
Date Added to KEV: 2025-07-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-20281']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-34473
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-34473']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3715
Vendor/Project: ImageMagick
Product: ImageMagick
Vulnerability Name: ImageMagick Arbitrary File Deletion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3715']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22047
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability
Date Added to KEV: 2022-07-12
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22047', '  https://nvd.nist.gov/vuln/detail/CVE-2022-22047']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41064
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
Date Added to KEV: 2023-09-11
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213905, https://support.apple.com/en-us/HT213906', ' https://nvd.nist.gov/vuln/detail/CVE-2023-41064']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-29256
Vendor/Project: Arm
Product: Mali Graphics Processing Unit (GPU)
Vulnerability Name: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Date Added to KEV: 2023-07-07
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities', ' https://nvd.nist.gov/vuln/detail/CVE-2021-29256']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-4427
Vendor/Project: IBM
Product: Data Risk Manager
Vulnerability Name: IBM Data Risk Manager Security Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-4427']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-6530
Vendor/Project: D-Link
Product: Multiple Routers
Vulnerability Name: D-Link Multiple Routers OS Command Injection Vulnerability
Date Added to KEV: 2022-09-08
Required Action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Known
Notes: ['https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10105', ' https://nvd.nist.gov/vuln/detail/CVE-2018-6530']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-11138
Vendor/Project: Quest
Product: KACE System Management Appliance
Vulnerability Name: Quest KACE System Management Appliance Remote Command Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-11138']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3569
Vendor/Project: Cisco
Product: IOS XR
Vulnerability Name: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3569']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-4792
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Use-After-Free Vulnerability
Date Added to KEV: 2024-07-23
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2024-08-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11', ' https://nvd.nist.gov/vuln/detail/CVE-2012-4792']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3660
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3660']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42321
Vendor/Project: Microsoft
Product: Exchange
Vulnerability Name: Microsoft Exchange Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-17
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-01
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42321']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-20250
Vendor/Project: RARLAB
Product: WinRAR
Vulnerability Name: WinRAR Absolute Path Traversal Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-20250']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-45249
Vendor/Project: Acronis
Product: Cyber Infrastructure (ACI)
Vulnerability Name: Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
Date Added to KEV: 2024-07-29
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://security-advisory.acronis.com/advisories/SEC-6452', '  https://nvd.nist.gov/vuln/detail/CVE-2023-45249']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-1316
Vendor/Project: Edimax
Product: IC-7100 IP Camera
Vulnerability Name: Edimax IC-7100 IP Camera OS Command Injection Vulnerability
Date Added to KEV: 2025-03-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-1316']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24200
Vendor/Project: Apple
Product: iOS and iPadOS
Vulnerability Name: Apple iOS and iPadOS Incorrect Authorization Vulnerability
Date Added to KEV: 2025-02-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/122173 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24200']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48384
Vendor/Project: Git
Product: Git
Vulnerability Name: Git Link Following Vulnerability
Date Added to KEV: 2025-08-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ', ' https://access.redhat.com/errata/RHSA-2025:13933 ', ' https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html ', ' https://linux.oracle.com/errata/ELSA-2025-11534.html ', ' https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48384']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-4966
Vendor/Project: Citrix
Product: NetScaler ADC and NetScaler Gateway
Vulnerability Name: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Date Added to KEV: 2023-10-18
Required Action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-08
Known Ransomware Campaign Use: Known
Notes: ['https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/, https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-4966']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-1976
Vendor/Project: Broadcom
Product: Brocade Fabric OS
Vulnerability Name: Broadcom Brocade Fabric OS Code Injection Vulnerability
Date Added to KEV: 2025-04-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-1976']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27101
Vendor/Project: Accellion
Product: FTA
Vulnerability Name: Accellion FTA SQL Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27101']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-14864
Vendor/Project: Oracle
Product: Intelligence Enterprise Edition
Vulnerability Name: Oracle Business Intelligence Enterprise Edition Path Transversal
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-14864']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-12271
Vendor/Project: Sophos
Product: SFOS
Vulnerability Name: Sophos SFOS SQL Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-12271']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-0738
Vendor/Project: Red Hat
Product: JBoss
Vulnerability Name: Red Hat JBoss Authentication Bypass Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-0738']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-5122
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-04-13
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-5122']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-25079
Vendor/Project: D-Link
Product: DCS-2530L and DCS-2670L Devices
Vulnerability Name: D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
Date Added to KEV: 2025-08-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.dlink.com/productinfo.aspx?m=DCS-2530L ', ' https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-25079']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-6207
Vendor/Project: SAP
Product: Solution Manager
Vulnerability Name: SAP Solution Manager Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-6207']
Severity: Critical
Known Exploited Vulnerability: CVE-2004-0210
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2004-0210']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-2783
Vendor/Project: Google
Product: Chromium Mojo
Vulnerability Name: Google Chromium Mojo Sandbox Escape Vulnerability
Date Added to KEV: 2025-03-27
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-2783']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21519
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Type Confusion Vulnerability
Date Added to KEV: 2026-02-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21519']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-6271
Vendor/Project: GNU
Product: Bourne-Again Shell (Bash)
Vulnerability Name: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-01-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-6271']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41080
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Privilege Escalation Vulnerability
Date Added to KEV: 2023-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-31
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41080']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8120
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8120']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1405
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1405']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27852
Vendor/Project: Checkbox
Product: Checkbox Survey
Vulnerability Name: Checkbox Survey Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27852']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-29464
Vendor/Project: WSO2
Product: Multiple Products
Vulnerability Name: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Date Added to KEV: 2022-04-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-16
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-29464']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-14847
Vendor/Project: MongoDB
Product: MongoDB and MongoDB Server
Vulnerability Name: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Date Added to KEV: 2025-12-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-19
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://jira.mongodb.org/browse/SERVER-115508 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-14847']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-38831
Vendor/Project: RARLAB
Product: WinRAR
Vulnerability Name: RARLAB WinRAR Code Execution Vulnerability
Date Added to KEV: 2023-08-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-09-14
Known Ransomware Campaign Use: Known
Notes: ['http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa', '  https://nvd.nist.gov/vuln/detail/CVE-2023-38831']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-42599
Vendor/Project: Qualitia
Product: Active! Mail
Vulnerability Name: Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2025-04-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.qualitia.com/jp/news/2025/04/18_1030.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-42599']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-34486
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Event Tracing Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-34486']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-10221
Vendor/Project: rConfig
Product: rConfig
Vulnerability Name: rConfig OS Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-10221']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21220
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Improper Input Validation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21220']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-7921
Vendor/Project: Hikvision
Product: Multiple Products
Vulnerability Name: Hikvision Multiple Products Improper Authentication Vulnerability
Date Added to KEV: 2026-03-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2017-7921']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-5544
Vendor/Project: VMware
Product: VMware ESXi and Horizon DaaS
Vulnerability Name: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-5544']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36424
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Out-of-Bounds Read Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-36424']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-19322
Vendor/Project: GIGABYTE
Product: Multiple Products
Vulnerability Name: GIGABYTE Multiple Products Code Execution Vulnerability
Date Added to KEV: 2022-10-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-14
Known Ransomware Campaign Use: Known
Notes: ['https://www.gigabyte.com/Support/Security/1801', ' https://nvd.nist.gov/vuln/detail/CVE-2018-19322']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-9054
Vendor/Project: Zyxel
Product: Multiple Network-Attached Storage (NAS) Devices
Vulnerability Name: Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-9054']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20269
Vendor/Project: Cisco
Product: Adaptive Security Appliance and Firepower Threat Defense
Vulnerability Name: Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
Date Added to KEV: 2023-09-13
Required Action: Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Due Date: 2023-10-04
Known Ransomware Campaign Use: Known
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC', '  https://nvd.nist.gov/vuln/detail/CVE-2023-20269']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-6204
Vendor/Project: Dassault Systèmes
Product: DELMIA Apriso
Vulnerability Name: Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
Date Added to KEV: 2025-10-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-6204']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-7755
Vendor/Project: Juniper
Product: ScreenOS
Vulnerability Name: Juniper ScreenOS Improper Authentication Vulnerability
Date Added to KEV: 2025-10-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportportal.juniper.net/s/article/2015-12-Out-of-Cycle-Security-Bulletin-ScreenOS-Multiple-Security-issues-with-ScreenOS-CVE-2015-7755-CVE-2015-7756 ', ' https://nvd.nist.gov/vuln/detail/CVE-2015-7755']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38856
Vendor/Project: Apache
Product: OFBiz
Vulnerability Name: Apache OFBiz Incorrect Authorization Vulnerability
Date Added to KEV: 2024-08-27
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-17
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38856']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-31324
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver Unrestricted File Upload Vulnerability
Date Added to KEV: 2025-04-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-20
Known Ransomware Campaign Use: Known
Notes: ['https://me.sap.com/notes/3594142 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-31324']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11581
Vendor/Project: Atlassian
Product: Jira Server and Data Center
Vulnerability Name: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-11581']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8260
Vendor/Project: Ivanti
Product: Pulse Connect Secure
Vulnerability Name: Ivanti Pulse Connect Secure Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ["Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8260"]
Severity: Critical
Known Exploited Vulnerability: CVE-2021-43890
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Installer Spoofing Vulnerability
Date Added to KEV: 2021-12-15
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-29
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-43890']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-33634
Vendor/Project: Aquasecurity
Product: Trivy
Vulnerability Name: Aquasecurity Trivy Embedded Malicious Code Vulnerability
Date Added to KEV: 2026-03-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-09
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability involves a supply‑chain compromise in a product that may be used across multiple products and environments. Additional vendor‑provided guidance must be followed to ensure full remediation. For more information, please see: https://github.com/advisories/GHSA-69fq-xp46-6x23 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-33634']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-14883
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Unspecified Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-14883']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-18368
Vendor/Project: Zyxel
Product: P660HN-T1A Routers
Vulnerability Name: Zyxel P660HN-T1A Routers Command Injection Vulnerability
Date Added to KEV: 2023-08-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware', ' https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe', ' https://nvd.nist.gov/vuln/detail/CVE-2017-18368']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27103
Vendor/Project: Accellion
Product: FTA
Vulnerability Name: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27103']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-19781
Vendor/Project: Citrix
Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Vulnerability Name: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-19781']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24016
Vendor/Project: Wazuh
Product: Wazuh Server
Vulnerability Name: Wazuh Server Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-06-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://wazuh.com/blog/addressing-the-cve-2025-24016-vulnerability/ ', ' https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24016']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40655
Vendor/Project: D-Link
Product: DIR-605 Router
Vulnerability Name: D-Link DIR-605 Router Information Disclosure Vulnerability
Date Added to KEV: 2024-05-16
Required Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Due Date: 2024-06-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5', ' https://nvd.nist.gov/vuln/detail/CVE-2021-40655']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-0158
Vendor/Project: Microsoft
Product: MSCOMCTL.OCX
Vulnerability Name: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-0158']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0296
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA)
Vulnerability Name: Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0296']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-3152
Vendor/Project: Oracle
Product: Fusion Middleware
Vulnerability Name: Oracle Fusion Middleware Unspecified Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-3152']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6740
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6740']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-0556
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office PowerPoint Code Injection Vulnerability
Date Added to KEV: 2026-01-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 ', ' https://nvd.nist.gov/vuln/detail/CVE-2009-0556']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12240
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12240']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30869
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30869']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-35078
Vendor/Project: Ivanti
Product: Endpoint Manager Mobile (EPMM)
Vulnerability Name: Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Date Added to KEV: 2023-07-25
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-15
Known Ransomware Campaign Use: Known
Notes: ['https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US', '  https://nvd.nist.gov/vuln/detail/CVE-2023-35078']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0648
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Code Execution Vulnerability
Date Added to KEV: 2024-09-17
Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Due Date: 2024-10-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ', ' https://nvd.nist.gov/vuln/detail/CVE-2013-0648']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21973
Vendor/Project: VMware
Product: vCenter Server and Cloud Foundation
Vulnerability Name: VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21973']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0938
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0938']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1905
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1905']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26085
Vendor/Project: Atlassian
Product: Confluence Server
Vulnerability Name: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-26085']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-8876
Vendor/Project: N-able
Product: N-Central
Vulnerability Name: N-able N-Central Command Injection Vulnerability
Date Added to KEV: 2025-08-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-8876']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-6345
Vendor/Project: Google
Product: Chromium Skia
Vulnerability Name: Google Skia Integer Overflow Vulnerability
Date Added to KEV: 2023-11-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-21
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-6345']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-5430
Vendor/Project: TIBCO
Product: JasperReports
Vulnerability Name: TIBCO JasperReports Server Information Disclosure Vulnerability
Date Added to KEV: 2022-12-29
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430', 'https://nvd.nist.gov/vuln/detail/CVE-2018-5430']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44529
Vendor/Project: Ivanti
Product: Endpoint Manager Cloud Service Appliance (EPM CSA)
Vulnerability Name: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability 
Date Added to KEV: 2024-03-25
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US', ' https://nvd.nist.gov/vuln/detail/CVE-2021-44529']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-24706
Vendor/Project: Apache
Product: CouchDB
Vulnerability Name: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00', '  https://nvd.nist.gov/vuln/detail/CVE-2022-24706']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44077
Vendor/Project: Zoho
Product: ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Vulnerability Name: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-01
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-44077']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-23692
Vendor/Project: Rejetto
Product: HTTP File Server
Vulnerability Name: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Date Added to KEV: 2024-07-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-30
Known Ransomware Campaign Use: Unknown
Notes: ['The patched Rejetto HTTP File Server (HFS) is version 3: https://github.com/rejetto/hfs?tab=readme-ov-file#installation, https://www.rejetto.com/hfs/ ', '   https://nvd.nist.gov/vuln/detail/CVE-2024-23692']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-8875
Vendor/Project: N-able
Product: N-Central
Vulnerability Name: N-able N-Central Insecure Deserialization Vulnerability
Date Added to KEV: 2025-08-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-8875']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41990
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Code Execution Vulnerability
Date Added to KEV: 2024-01-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213599, https://support.apple.com/en-us/HT213601, https://support.apple.com/en-us/HT213605, https://support.apple.com/en-us/HT213606, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213844, https://support.apple.com/en-us/HT213845 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-41990']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-4810
Vendor/Project: Hewlett Packard (HP)
Product: ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management
Vulnerability Name: HP Multiple Products Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-4810']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3161
Vendor/Project: Cisco
Product: Cisco IP Phones
Vulnerability Name: Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3161']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21715
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Publisher Security Feature Bypass Vulnerability
Date Added to KEV: 2023-02-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21715', '  https://nvd.nist.gov/vuln/detail/CVE-2023-21715']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-0780
Vendor/Project: InduSoft
Product: Web Studio
Vulnerability Name: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-0780']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-41277
Vendor/Project: Metabase
Product: Metabase
Vulnerability Name: Metabase GeoJSON API Local File Inclusion Vulnerability
Date Added to KEV: 2024-11-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-41277']
Severity: Critical