DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2021-30762
Vendor/Project: Apple
Product: iOS
Vulnerability Name: Apple iOS WebKit Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30762']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-21410
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Privilege Escalation Vulnerability
Date Added to KEV: 2024-02-15
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410', ' https://nvd.nist.gov/vuln/detail/CVE-2024-21410']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-45195
Vendor/Project: Apache
Product: OFBiz
Vulnerability Name: Apache OFBiz Forced Browsing Vulnerability
Date Added to KEV: 2025-02-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-25
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://ofbiz.apache.org/security.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-45195']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2419
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2419']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-1000253
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel PIE Stack Buffer Corruption Vulnerability 
Date Added to KEV: 2024-09-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-30
Known Ransomware Campaign Use: Known
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a87938b2e246b81b4fb713edb371a9fa3c5c3c86', ' https://nvd.nist.gov/vuln/detail/CVE-2017-1000253']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-2746
Vendor/Project: Kentico
Product: Xperience CMS
Vulnerability Name: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Date Added to KEV: 2025-10-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://devnet.kentico.com/download/hotfixes ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-2746']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38647
Vendor/Project: Microsoft
Product: Open Management Infrastructure (OMI)
Vulnerability Name: Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38647']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-4077
Vendor/Project: Microsoft
Product: Input Method Editor (IME) Japanese
Vulnerability Name: Microsoft IME Japanese Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-4077']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0640
Vendor/Project: Adobe
Product: Reader and Acrobat
Vulnerability Name: Adobe Reader and Acrobat Memory Corruption Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0640']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7286
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7286']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30900
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT21286, https://support.apple.com/en-us/HT212868, https://support.apple.com/kb/HT212872', ' https://nvd.nist.gov/vuln/detail/CVE-2021-30900']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-4657
Vendor/Project: Apple
Product: iOS
Vulnerability Name: Apple iOS Webkit Memory Corruption Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-4657']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24054
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Date Added to KEV: 2025-04-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24054']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20867
Vendor/Project: VMware
Product: Tools
Vulnerability Name: VMware Tools Authentication Bypass Vulnerability
Date Added to KEV: 2023-06-23
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.vmware.com/security/advisories/VMSA-2023-0013.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-20867']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-45727
Vendor/Project: North Grid
Product: Proself
Vulnerability Name: North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability
Date Added to KEV: 2024-12-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.proself.jp/information/153/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-45727']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-49035
Vendor/Project: Microsoft
Product: Partner Center
Vulnerability Name: Microsoft Partner Center Improper Access Control Vulnerability
Date Added to KEV: 2025-02-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-49035']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-9934
Vendor/Project: Apple
Product: iOS, iPadOS, and macOS
Vulnerability Name: Apple iOS, iPadOS, and macOS Input Validation Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT211288, https://support.apple.com/en-us/HT211289', ' https://nvd.nist.gov/vuln/detail/CVE-2020-9934']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41223
Vendor/Project: Mitel
Product: MiVoice Connect
Vulnerability Name: Mitel MiVoice Connect Code Injection Vulnerability
Date Added to KEV: 2023-02-21
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-14
Known Ransomware Campaign Use: Known
Notes: ['https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41223']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8589
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8589']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0638
Vendor/Project: Microsoft
Product: Update Notification Manager
Vulnerability Name: Microsoft Update Notification Manager Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0638']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21418
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2025-02-11
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21418']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-5002
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Stack-based Buffer Overflow Vulnerability
Date Added to KEV: 2022-05-23
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-5002']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21529
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-21529']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38213
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Date Added to KEV: 2024-08-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38213', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38213']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-28799
Vendor/Project: QNAP
Product: Network Attached Storage (NAS)
Vulnerability Name: QNAP NAS Improper Authorization Vulnerability
Date Added to KEV: 2022-03-31
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-28799']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-28995
Vendor/Project: SolarWinds
Product: Serv-U
Vulnerability Name: SolarWinds Serv-U Path Traversal Vulnerability 
Date Added to KEV: 2024-07-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995', ' https://nvd.nist.gov/vuln/detail/CVE-2024-28995']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30657
Vendor/Project: Apple
Product: macOS
Vulnerability Name: Apple macOS Unspecified Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30657']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-2572
Vendor/Project: Microsoft
Product: PowerPoint
Vulnerability Name: Microsoft PowerPoint Buffer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-2572']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0431
Vendor/Project: Oracle
Product: Java Runtime Environment (JRE)
Vulnerability Name: Oracle JRE Sandbox Bypass Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0431']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-23134
Vendor/Project: Zabbix
Product: Frontend
Vulnerability Name: Zabbix Frontend Improper Access Control Vulnerability
Date Added to KEV: 2022-02-22
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-23134']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1040
Vendor/Project: Microsoft
Product: Hyper-V RemoteFX
Vulnerability Name: Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-1040']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-19953
Vendor/Project: QNAP
Product: Network Attached Storage (NAS)
Vulnerability Name: QNAP NAS File Station Cross-Site Scripting Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-19953']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42258
Vendor/Project: BQE
Product: BillQuick Web Suite
Vulnerability Name: BQE BillQuick Web Suite SQL Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42258']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-48928
Vendor/Project: TeleMessage
Product: TM SGNL
Vulnerability Name: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
Date Added to KEV: 2025-07-01
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-22
Known Ransomware Campaign Use: Unknown
Notes: ['It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-48928']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-41357
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-41357']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-33044
Vendor/Project: Dahua
Product: IP Camera Firmware
Vulnerability Name: Dahua IP Camera Authentication Bypass Vulnerability
Date Added to KEV: 2024-08-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582', ' https://nvd.nist.gov/vuln/detail/CVE-2021-33044']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-22224
Vendor/Project: VMware
Product: ESXi and Workstation
Vulnerability Name: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Date Added to KEV: 2025-03-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-22224']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1003029
Vendor/Project: Jenkins
Product: Script Security Plugin
Vulnerability Name: Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Date Added to KEV: 2022-04-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1003029']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-54068
Vendor/Project: Laravel
Product: Livewire
Vulnerability Name: Laravel Livewire Code Injection Vulnerability
Date Added to KEV: 2026-03-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 ', ' https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-54068']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-1019
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-1019']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12238
Vendor/Project: Cisco
Product: Catalyst 6800 Series Switches
Vulnerability Name: Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12238']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-62215
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Race Condition Vulnerability
Date Added to KEV: 2025-11-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62215 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-62215']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-1823
Vendor/Project: PHP
Product: PHP
Vulnerability Name: PHP-CGI Query String Parameter Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-1823']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-2021
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-2021']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26925
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows LSA Spoofing Vulnerability
Date Added to KEV: 2022-07-01
Required Action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
Due Date: 2022-07-22
Known Ransomware Campaign Use: Unknown
Notes: ['WARNING: This update is required on all Microsoft Windows endpoints but if deployed to domain controllers without additional configuration changes the update breaks PIV/CAC authentication. Read CISA implementation guidance carefully before deploying to domain controllers.', '  https://nvd.nist.gov/vuln/detail/CVE-2022-26925']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8639
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
Date Added to KEV: 2025-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8639 ', ' https://nvd.nist.gov/vuln/detail/CVE-2018-8639']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-15999
Vendor/Project: Google
Product: Chrome FreeType
Vulnerability Name: Google Chrome FreeType Heap Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-15999']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30666
Vendor/Project: Apple
Product: iOS
Vulnerability Name: Apple iOS WebKit Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30666']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11261
Vendor/Project: Qualcomm
Product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Vulnerability Name: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
Date Added to KEV: 2021-12-01
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-11261']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21551
Vendor/Project: Dell
Product: dbutil Driver
Vulnerability Name: Dell dbutil Driver Insufficient Access Control Vulnerability
Date Added to KEV: 2022-03-31
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21551']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25337
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Improper Access Control Vulnerability
Date Added to KEV: 2022-11-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25337']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-0669
Vendor/Project: Fortra
Product: GoAnywhere MFT
Vulnerability Name: Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Date Added to KEV: 2023-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-03
Known Ransomware Campaign Use: Known
Notes: ['This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.', '  https://nvd.nist.gov/vuln/detail/CVE-2023-0669']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-15944
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Date Added to KEV: 2022-08-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.paloaltonetworks.com/CVE-2017-15944', ' https://nvd.nist.gov/vuln/detail/CVE-2017-15944']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7238
Vendor/Project: Sonatype
Product: Nexus Repository Manager
Vulnerability Name: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7238']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0161
Vendor/Project: Cisco
Product: IOS Software
Vulnerability Name: Cisco IOS Software Resource Management Errors Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0161']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12319
Vendor/Project: Cisco
Product: IOS XE Software
Vulnerability Name: Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12319']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28205
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Use-After-Free Vulnerability
Date Added to KEV: 2023-04-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723', '  https://nvd.nist.gov/vuln/detail/CVE-2023-28205']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-0028
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
Date Added to KEV: 2022-08-22
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.paloaltonetworks.com/CVE-2022-0028', ' https://nvd.nist.gov/vuln/detail/CVE-2022-0028']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-1086
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Use-After-Free Vulnerability
Date Added to KEV: 2024-05-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-20
Known Ransomware Campaign Use: Known
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660', '   https://nvd.nist.gov/vuln/detail/CVE-2024-1086']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-23222
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Type Confusion Vulnerability
Date Added to KEV: 2024-01-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT214055,  https://support.apple.com/en-us/HT214056, https://support.apple.com/en-us/HT214057, https://support.apple.com/en-us/HT214058, https://support.apple.com/en-us/HT214059, https://support.apple.com/en-us/HT214061, https://support.apple.com/en-us/HT214063 ', '  https://nvd.nist.gov/vuln/detail/CVE-2024-23222']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3992
Vendor/Project: VMware
Product: ESXi
Vulnerability Name: VMware ESXi OpenSLP Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3992']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0344
Vendor/Project: SAP
Product: Commerce Cloud
Vulnerability Name: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-09-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-0344']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-3396
Vendor/Project: Atlassian
Product: Confluence Server and Data Server
Vulnerability Name: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-3396']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-23748
Vendor/Project: Audinate
Product: Dante Discovery
Vulnerability Name: Dante Discovery Process Control Vulnerability
Date Added to KEV: 2025-02-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.getdante.com/support/faq/audinate-response-to-dante-discovery-mdnsresponder-exe-security-issue-cve-2022-23748/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-23748']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-28310
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-28310']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-3055
Vendor/Project: Citrix
Product: NetScaler
Vulnerability Name: Citrix NetScaler Out-of-Bounds Read Vulnerability
Date Added to KEV: 2026-03-30
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_3055_and_CVE_2026_4368 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-3055']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2546
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Memory Corruption Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2546']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-36193
Vendor/Project: PEAR
Product: Archive_Tar
Vulnerability Name: PEAR Archive_Tar Improper Link Resolution Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916, https://www.drupal.org/sa-core-2021-001, https://access.redhat.com/security/cve/cve-2020-36193', ' https://nvd.nist.gov/vuln/detail/CVE-2020-36193']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4358
Vendor/Project: Progress
Product: Telerik Report Server
Vulnerability Name: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Date Added to KEV: 2024-06-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4358']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5741
Vendor/Project: Plex
Product: Media Server
Vulnerability Name: Plex Media Server Remote Code Execution Vulnerability
Date Added to KEV: 2023-03-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.plex.tv/t/security-regarding-cve-2020-5741/586819', ' https://nvd.nist.gov/vuln/detail/CVE-2020-5741']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30632
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Write Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30632']
Severity: Critical
Known Exploited Vulnerability: CVE-2006-2492
Vendor/Project: Microsoft
Product: Word
Vulnerability Name: Microsoft Word Malformed Object Pointer Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2006-2492']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-6287
Vendor/Project: Rejetto
Product: HTTP File Server (HFS)
Vulnerability Name: Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-6287']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-17558
Vendor/Project: Apache
Product: Solr
Vulnerability Name: Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-17558']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-32709
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Date Added to KEV: 2025-05-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32709 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32709']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12234
Vendor/Project: Cisco
Product: IOS software
Vulnerability Name: Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12234']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22555
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Heap Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-10-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21 ', ' https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d ', ' https://security.netapp.com/advisory/ntap-20210805-0010/ ', ' https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-22555']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22954
Vendor/Project: VMware
Product: Workspace ONE Access and Identity Manager
Vulnerability Name: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
Date Added to KEV: 2022-04-14
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22954']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38107
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability
Date Added to KEV: 2024-08-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38107', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38107']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27562
Vendor/Project: Arm
Product: Trusted Firmware
Vulnerability Name: Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-27562']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22947
Vendor/Project: VMware
Product: Spring Cloud Gateway
Vulnerability Name: VMware Spring Cloud Gateway Code Injection Vulnerability
Date Added to KEV: 2022-05-16
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22947']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24989
Vendor/Project: Microsoft
Product: Power Pages
Vulnerability Name: Microsoft Power Pages Improper Access Control Vulnerability
Date Added to KEV: 2025-02-21
Required Action: Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24989 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24989']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-1010
Vendor/Project: Adobe
Product: Flash Player and AIR
Vulnerability Name: Adobe Flash Player and AIR Integer Overflow Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted products are end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-1010']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-6282
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Improper Input Validation Vulnerability
Date Added to KEV: 2022-09-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8404663f81d212918ff85f493649a7991209fa04', ' https://nvd.nist.gov/vuln/detail/CVE-2013-6282']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0167
Vendor/Project: Cisco
Product: IOS, XR, and XE Software
Vulnerability Name: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0167']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-38028
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Print Spooler Privilege Escalation Vulnerability 
Date Added to KEV: 2024-04-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.  
Due Date: 2024-05-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028', '  https://nvd.nist.gov/vuln/detail/CVE-2022-38028']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-9465
Vendor/Project: Palo Alto Networks
Product: Expedition
Vulnerability Name: Palo Alto Networks Expedition SQL Injection Vulnerability
Date Added to KEV: 2024-11-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.paloaltonetworks.com/PAN-SA-2024-0010 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-9465']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1069
Vendor/Project: Microsoft
Product: Task Scheduler
Vulnerability Name: Microsoft Task Scheduler Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1069']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-6205
Vendor/Project: Dassault Systèmes
Product: DELMIA Apriso
Vulnerability Name: Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
Date Added to KEV: 2025-10-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-6205']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3566
Vendor/Project: Cisco
Product: IOS XR
Vulnerability Name: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3566']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-23225
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2024-03-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT214081, https://support.apple.com/en-us/HT214082, https://support.apple.com/en-us/HT214083, https://support.apple.com/en-us/HT214084, https://support.apple.com/en-us/HT214085, https://support.apple.com/en-us/HT214086, https://support.apple.com/en-us/HT214087, https://support.apple.com/en-us/HT214088 ', '  https://nvd.nist.gov/vuln/detail/CVE-2024-23225']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-3953
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-3953']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0005
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0005']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-36401
Vendor/Project: OSGeo
Product: GeoServer
Vulnerability Name: OSGeo GeoServer GeoTools Eval Injection Vulnerability
Date Added to KEV: 2024-07-15
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-05
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects an open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv, https://github.com/geotools/geotools/pull/4797 ', '   https://nvd.nist.gov/vuln/detail/CVE-2024-36401']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-43572
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Management Console Remote Code Execution Vulnerability
Date Added to KEV: 2024-10-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/advisory/CVE-2024-43572 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-43572']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29552
Vendor/Project: IETF
Product: Service Location Protocol (SLP)
Vulnerability Name: Service Location Protocol (SLP) Denial-of-Service Vulnerability
Date Added to KEV: 2023-11-08
Required Action: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
Due Date: 2023-11-29
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on the patching status. For more information please see https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp and https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks.', '  https://nvd.nist.gov/vuln/detail/CVE-2023-29552']
Severity: Critical