DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2019-9875
Vendor/Project: Sitecore
Product: CMS and Experience Platform (XP)
Vulnerability Name: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Date Added to KEV: 2025-03-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556 ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-9875']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0676
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Information Disclosure Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0676']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-27876
Vendor/Project: Veritas
Product: Backup Exec Agent
Vulnerability Name: Veritas Backup Exec Agent File Access Vulnerability
Date Added to KEV: 2023-04-07
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-28
Known Ransomware Campaign Use: Known
Notes: ['https://www.veritas.com/support/en_US/security/VTS21-001', ' https://nvd.nist.gov/vuln/detail/CVE-2021-27876']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6738
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6738']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0796
Vendor/Project: Microsoft
Product: SMBv3
Vulnerability Name: Microsoft SMBv3 Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0796']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-13720
Vendor/Project: Google
Product: Chrome WebAudio
Vulnerability Name: Google Chrome WebAudio Use-After-Free Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-13720']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-34192
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2025-02-25
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-34192']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-33107
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Integer Overflow Vulnerability
Date Added to KEV: 2023-12-05
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2023-12-26
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-4.19/-/commit/d66b799c804083ea5226cfffac6d6c4e7ad4968b', '  https://nvd.nist.gov/vuln/detail/CVE-2023-33107']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-46748
Vendor/Project: F5
Product: BIG-IP Configuration Utility
Vulnerability Name: F5 BIG-IP Configuration Utility SQL Injection Vulnerability
Date Added to KEV: 2023-10-31
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://my.f5.com/manage/s/article/K000137365 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-46748']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22502
Vendor/Project: Micro Focus
Product: Operation Bridge Reporter (OBR)
Vulnerability Name: Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22502']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-4852
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-4852']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-8720
Vendor/Project: WebKitGTK
Product: WebKitGTK
Vulnerability Name: WebKitGTK Memory Corruption Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-8720']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-15271
Vendor/Project: Cisco
Product: RV Series Routers
Vulnerability Name: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-15271']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-9907
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-9907']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-4404
Vendor/Project: Apple
Product: OS X
Vulnerability Name: Apple OS X Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-4404']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1635
Vendor/Project: Microsoft
Product: HTTP.sys
Vulnerability Name: Microsoft HTTP.sys Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1635']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0629
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Directory Traversal Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0629']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-1776
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2022-01-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-021?redirectedfrom=MSDN', ' https://nvd.nist.gov/vuln/detail/CVE-2014-1776']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-4262
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2022-12-05
Required Action: Apply updates per vendor instructions.
Due Date: 2022-12-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-4262']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24984
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows NTFS Information Disclosure Vulnerability
Date Added to KEV: 2025-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24984']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-27350
Vendor/Project: PaperCut
Product: MF/NG
Vulnerability Name: PaperCut MF/NG Improper Access Control Vulnerability
Date Added to KEV: 2023-04-21
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-12
Known Ransomware Campaign Use: Known
Notes: ['https://www.papercut.com/kb/Main/PO-1216-and-PO-1219', '  https://nvd.nist.gov/vuln/detail/CVE-2023-27350']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-3393
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Date Added to KEV: 2024-12-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.paloaltonetworks.com/CVE-2024-3393 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-3393']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20124
Vendor/Project: DrayTek
Product: VigorConnect
Vulnerability Name: Draytek VigorConnect Path Traversal Vulnerability 
Date Added to KEV: 2024-09-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.draytek.com/about/security-advisory/vigorconnect-software-security-vulnerability-(cve-2021-20123-cve-2021-20129)', ' https://nvd.nist.gov/vuln/detail/CVE-2021-20124']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11510
Vendor/Project: Ivanti
Product: Pulse Connect Secure
Vulnerability Name: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ["Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2019-11510"]
Severity: Critical
Known Exploited Vulnerability: CVE-2025-38352
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
Date Added to KEV: 2025-09-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-25
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff ', ' https://source.android.com/docs/security/bulletin/2025-09-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-38352']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-9841
Vendor/Project: PHPUnit
Product: PHPUnit
Vulnerability Name: PHPUnit Command Injection Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-9841']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-9248
Vendor/Project: Progress
Product: ASP.NET AJAX and Sitefinity
Vulnerability Name: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-9248']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-1555
Vendor/Project: NETGEAR
Product: Wireless Access Point (WAP) Devices
Vulnerability Name: NETGEAR Multiple WAP Devices Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-1555']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36380
Vendor/Project: Sunhillo
Product: SureLine
Vulnerability Name: Sunhillo SureLine OS Command Injection Vulnerablity
Date Added to KEV: 2024-03-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.sunhillo.com/fb011/', ' https://nvd.nist.gov/vuln/detail/CVE-2021-36380']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-10148
Vendor/Project: SolarWinds
Product: Orion
Vulnerability Name: SolarWinds Orion Authentication Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-10148']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-50623
Vendor/Project: Cleo
Product: Multiple Products
Vulnerability Name: Cleo Multiple Products Unrestricted File Upload Vulnerability
Date Added to KEV: 2024-12-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-03
Known Ransomware Campaign Use: Known
Notes: ['https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-50623']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-2868
Vendor/Project: Barracuda Networks
Product: Email Security Gateway (ESG) Appliance
Vulnerability Name: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
Date Added to KEV: 2023-05-26
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://status.barracuda.com/incidents/34kx82j5n4q9', '  https://nvd.nist.gov/vuln/detail/CVE-2023-2868']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-8957
Vendor/Project: PTZOptics
Product: PT30X-SDI/NDI Cameras
Vulnerability Name: PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability
Date Added to KEV: 2024-11-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://ptzoptics.com/firmware-changelog/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-8957']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-51378
Vendor/Project: CyberPersons
Product: CyberPanel
Vulnerability Name: CyberPanel Incorrect Default Permissions Vulnerability
Date Added to KEV: 2024-12-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-25
Known Ransomware Campaign Use: Known
Notes: ['https://cyberpanel.net/KnowledgeBase/home/change-logs/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-51378']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-2462
Vendor/Project: Adobe
Product: Reader and Acrobat
Vulnerability Name: Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2011-2462']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-4171
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-4171']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-6549
Vendor/Project: Citrix
Product: NetScaler ADC and NetScaler Gateway
Vulnerability Name: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Date Added to KEV: 2024-01-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549', '   https://nvd.nist.gov/vuln/detail/CVE-2023-6549']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-30051
Vendor/Project: Microsoft
Product: DWM Core Library
Vulnerability Name:  Microsoft DWM Core Library Privilege Escalation Vulnerability
Date Added to KEV: 2024-05-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-04
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30051', ' https://nvd.nist.gov/vuln/detail/CVE-2024-30051']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-11371
Vendor/Project: Gladinet
Product: CentreStack and Triofox
Vulnerability Name: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Date Added to KEV: 2025-11-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.centrestack.com/p/gce_latest_release.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-11371']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1675
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1675']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21311
Vendor/Project: Adminer
Product: Adminer
Vulnerability Name: Adminer Server-Side Request Forgery Vulnerability
Date Added to KEV: 2025-09-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-21311']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-21351
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Date Added to KEV: 2024-02-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21351', ' https://nvd.nist.gov/vuln/detail/CVE-2024-21351']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-26360
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2023-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-26360']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-9276
Vendor/Project: Paessler
Product: PRTG Network Monitor
Vulnerability Name: Paessler PRTG Network Monitor OS Command Injection Vulnerability
Date Added to KEV: 2025-02-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.paessler.com/prtg/history/prtg-18#18.2.39 ', ' https://nvd.nist.gov/vuln/detail/CVE-2018-9276']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-6418
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-6418']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-4135
Vendor/Project: Google
Product: Chromium GPU
Vulnerability Name: Google Chromium GPU Heap Buffer Overflow Vulnerability
Date Added to KEV: 2022-11-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-12-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-4135']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1642
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Memory Corruption Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1642']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12232
Vendor/Project: Cisco
Product: IOS software
Vulnerability Name: Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12232']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-8088
Vendor/Project: RARLAB
Product: WinRAR
Vulnerability Name: RARLAB WinRAR Path Traversal Vulnerability
Date Added to KEV: 2025-08-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-8088']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-0920
Vendor/Project: Android
Product: Kernel
Vulnerability Name: Android Kernel Race Condition Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-0920']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-10149
Vendor/Project: Exim
Product: Mail Transfer Agent (MTA)
Vulnerability Name: Exim Mail Transfer Agent (MTA) Improper Input Validation
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-10149']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-14839
Vendor/Project: LG
Product: N1A1 NAS
Vulnerability Name: LG N1A1 NAS Remote Command Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-14839']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-22515
Vendor/Project: Atlassian
Product: Confluence Data Center and Server
Vulnerability Name: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Date Added to KEV: 2023-10-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
Due Date: 2023-10-13
Known Ransomware Campaign Use: Known
Notes: ['https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-22515']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25298
Vendor/Project: Nagios
Product: Nagios XI
Vulnerability Name: Nagios XI OS Command Injection
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-25298']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3896
Vendor/Project: Microsoft
Product: Silverlight
Vulnerability Name: Microsoft Silverlight Information Disclosure Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3896']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38649
Vendor/Project: Microsoft
Product: Open Management Infrastructure (OMI)
Vulnerability Name: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38649']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-18988
Vendor/Project: TeamViewer
Product: Desktop
Vulnerability Name: TeamViewer Desktop Bypass Remote Login Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-18988']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29336
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32K Privilege Escalation Vulnerability
Date Added to KEV: 2023-05-09
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29336', ' https://nvd.nist.gov/vuln/detail/CVE-2023-29336']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-20775
Vendor/Project: Cisco
Product: SD-WAN
Vulnerability Name: Cisco SD-WAN Path Traversal Vulnerability
Date Added to KEV: 2026-02-25
Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Due Date: 2026-02-27
Known Ransomware Campaign Use: Unknown
Notes: ['CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ', ' https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ', ' https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-20775']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-43939
Vendor/Project: Hitachi Vantara
Product: Pentaho Business Analytics (BA) Server
Vulnerability Name: Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
Date Added to KEV: 2025-03-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939- ', ' https://nvd.nist.gov/vuln/detail/CVE-2022-43939']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-43093
Vendor/Project: Android
Product: Framework
Vulnerability Name: Android Framework Privilege Escalation Vulnerability
Date Added to KEV: 2024-11-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/2024-11-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-43093']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-45519
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
Date Added to KEV: 2024-10-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-45519']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0631
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Information Disclosure Vulnerability
Date Added to KEV: 2022-03-07
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0631']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-1389
Vendor/Project: TP-Link
Product: Archer AX21
Vulnerability Name: TP-Link Archer AX-21 Command Injection Vulnerability
Date Added to KEV: 2023-05-01
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware', '  https://nvd.nist.gov/vuln/detail/CVE-2023-1389']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2094
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-09-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8176cced706b5e5d15887584150764894e94e02f', ' https://nvd.nist.gov/vuln/detail/CVE-2013-2094']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-24061
Vendor/Project: GNU
Product: InetUtils
Vulnerability Name: GNU InetUtils Argument Injection Vulnerability
Date Added to KEV: 2026-01-26
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-16
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cgit.git.savannah.gnu.org/cgit/inetutils.git ', ' https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc', ' https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-24061']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-39891
Vendor/Project: Twilio
Product: Authy
Vulnerability Name: Twilio Authy Information Disclosure Vulnerability
Date Added to KEV: 2024-07-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS', ' https://nvd.nist.gov/vuln/detail/CVE-2024-39891']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-4879
Vendor/Project: ServiceNow
Product: Utah, Vancouver, and Washington DC Now Platform
Vulnerability Name: ServiceNow Improper Input Validation Vulnerability
Date Added to KEV: 2024-07-29
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154', ' https://nvd.nist.gov/vuln/detail/CVE-2024-4879']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-3723
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2022-10-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-3723']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-64328
Vendor/Project: Sangoma
Product: FreePBX 
Vulnerability Name: Sangoma FreePBX OS Command Injection Vulnerability
Date Added to KEV: 2026-02-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-64328']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0618
Vendor/Project: Microsoft
Product: SQL Server
Vulnerability Name: Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
Date Added to KEV: 2024-09-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618  ', '  https://nvd.nist.gov/vuln/detail/CVE-2020-0618']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11899
Vendor/Project: Treck TCP/IP stack
Product: IPv6
Vulnerability Name: Treck TCP/IP stack Out-of-Bounds Read Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-11899']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-3129
Vendor/Project: Microsoft
Product: Excel
Vulnerability Name: Microsoft Excel Featheader Record Memory Corruption Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-3129']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1732
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1732']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-4902
Vendor/Project: Oracle
Product: Java SE
Vulnerability Name: Oracle Java SE Integrity Check Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-4902']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-2034
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Memory Corruption Vulnerability
Date Added to KEV: 2022-03-28
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-2034']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-2136
Vendor/Project: Google
Product: Chromium Skia
Vulnerability Name: Google Chrome Skia Integer Overflow Vulnerability
Date Added to KEV: 2023-04-21
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-2136']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0193
Vendor/Project: Apache
Product: Solr
Vulnerability Name: Apache Solr DataImportHandler Code Injection Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0193']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-54309
Vendor/Project: CrushFTP
Product: CrushFTP
Vulnerability Name:  CrushFTP Unprotected Alternate Channel Vulnerability
Date Added to KEV: 2025-07-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-54309 ']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-35616
Vendor/Project: Fortinet
Product: FortiClient EMS
Vulnerability Name: Fortinet FortiClient EMS Improper Access Control Vulnerability
Date Added to KEV: 2026-04-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-09
Known Ransomware Campaign Use: Unknown
Notes: ["Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-099 ", ' https://nvd.nist.gov/vuln/detail/CVE-2026-35616']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-0012
Vendor/Project: Palo Alto Networks
Product: PAN-OS
Vulnerability Name: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Date Added to KEV: 2024-11-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
Due Date: 2024-12-09
Known Ransomware Campaign Use: Known
Notes: ['https://security.paloaltonetworks.com/CVE-2024-0012 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-0012']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-17026
Vendor/Project: Mozilla
Product: Firefox and Thunderbird
Vulnerability Name: Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-17026']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-21762
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS Out-of-Bound Write Vulnerability
Date Added to KEV: 2024-02-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-16
Known Ransomware Campaign Use: Known
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-24-015 ', '   https://nvd.nist.gov/vuln/detail/CVE-2024-21762']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0040
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0040']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-9978
Vendor/Project: WordPress
Product: Social Warfare Plugin
Vulnerability Name: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-9978']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-12989
Vendor/Project: Citrix
Product: SD-WAN and NetScaler
Vulnerability Name: Citrix SD-WAN and NetScaler SQL Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-12989']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-4428
Vendor/Project: Ivanti
Product: Endpoint Manager Mobile (EPMM)
Vulnerability Name: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Date Added to KEV: 2025-05-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-4428']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30713
Vendor/Project: Apple
Product: macOS
Vulnerability Name: Apple macOS Unspecified Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30713']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32409
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Sandbox Escape Vulnerability
Date Added to KEV: 2023-05-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765', ' https://nvd.nist.gov/vuln/detail/CVE-2023-32409']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-5070
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-5070']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-6332
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-6332']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-19410
Vendor/Project: Paessler
Product: PRTG Network Monitor
Vulnerability Name: Paessler PRTG Network Monitor Local File Inclusion Vulnerability
Date Added to KEV: 2025-02-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.paessler.com/prtg/history/prtg-18#18.2.41.1652 ', ' https://nvd.nist.gov/vuln/detail/CVE-2018-19410']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-10174
Vendor/Project: NETGEAR
Product: WNR2000v5 Router
Vulnerability Name: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-10174']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12637
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver Directory Traversal Vulnerability
Date Added to KEV: 2025-03-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-09
Known Ransomware Campaign Use: Unknown
Notes: ['SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549 ', ' https://nvd.nist.gov/vuln/detail/CVE-2017-12637']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-29988
Vendor/Project: Microsoft
Product: SmartScreen Prompt
Vulnerability Name: Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability
Date Added to KEV: 2024-04-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-05-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29988', ' https://nvd.nist.gov/vuln/detail/CVE-2024-29988']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-44309
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2024-11-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/121752, https://support.apple.com/en-us/121753, https://support.apple.com/en-us/121754, https://support.apple.com/en-us/121755, https://support.apple.com/en-us/121756 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-44309']
Severity: Critical