DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2022-26501
Vendor/Project: Veeam
Product: Backup & Replication
Vulnerability Name: Veeam Backup & Replication Remote Code Execution Vulnerability
Date Added to KEV: 2022-12-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-03
Known Ransomware Campaign Use: Known
Notes: ['https://www.veeam.com/kb4288', '  https://nvd.nist.gov/vuln/detail/CVE-2022-26501']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38003
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38003']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-33538
Vendor/Project: TP-Link
Product: Multiple Routers
Vulnerability Name: TP-Link Multiple Routers Command Injection Vulnerability
Date Added to KEV: 2025-06-16
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.tp-link.com/nordic/support/faq/3562/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-33538']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-34028
Vendor/Project: Commvault
Product: Command Center
Vulnerability Name: Commvault Command Center Path Traversal Vulnerability
Date Added to KEV: 2025-05-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-34028']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2291
Vendor/Project: Intel
Product: Ethernet Diagnostics Driver for Windows
Vulnerability Name: Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability
Date Added to KEV: 2023-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-03
Known Ransomware Campaign Use: Known
Notes: ['https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00051.html', ' https://nvd.nist.gov/vuln/detail/CVE-2015-2291']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-0609
Vendor/Project: Google
Product: Chromium Animation
Vulnerability Name: Google Chromium Animation Use-After-Free Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-0609']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0069
Vendor/Project: MediaTek
Product: Multiple Chipsets
Vulnerability Name: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0069']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30663
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Integer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30663']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-43226
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Escalation Vulnerability
Date Added to KEV: 2025-10-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-43226']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-34527
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ["Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527"]
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0189
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0189']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-5054
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Integer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-5054']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-32201
Vendor/Project: Microsoft
Product: SharePoint Server
Vulnerability Name: Microsoft SharePoint Server Improper Input Validation Vulnerability
Date Added to KEV: 2026-04-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32201 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-32201']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-60710
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Link Following Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-60710']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42292
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Excel Security Feature Bypass
Date Added to KEV: 2021-11-17
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42292']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-54253
Vendor/Project: Adobe
Product: Experience Manager (AEM) Forms
Vulnerability Name: Adobe Experience Manager Forms Code Execution Vulnerability
Date Added to KEV: 2025-10-15
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-54253']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-18187
Vendor/Project: Trend Micro
Product: OfficeScan
Vulnerability Name: Trend Micro OfficeScan Directory Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-18187']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12615
Vendor/Project: Apache
Product: Tomcat
Vulnerability Name: Apache Tomcat on Windows Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12615']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-11774
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Outlook Security Feature Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-11774']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40449
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-17
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-01
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-40449']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-15505
Vendor/Project: Ivanti
Product: MobileIron Multiple Products
Vulnerability Name: Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-15505']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-1331
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Buffer Overflow Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-1331']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3433
Vendor/Project: Cisco
Product: AnyConnect Secure
Vulnerability Name: Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
Date Added to KEV: 2022-10-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-14
Known Ransomware Campaign Use: Known
Notes: ['https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW', ' https://nvd.nist.gov/vuln/detail/CVE-2020-3433']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-4723
Vendor/Project: D-Link
Product: DIR-300 Router
Vulnerability Name: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
Date Added to KEV: 2022-09-08
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.dlink.com/uk/en/support/product/dir-300-wireless-g-router', ' https://nvd.nist.gov/vuln/detail/CVE-2011-4723']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21224
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21224']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21479
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Date Added to KEV: 2025-06-03
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-24
Known Ransomware Campaign Use: Unknown
Notes: ['Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ', '   https://nvd.nist.gov/vuln/detail/CVE-2025-21479']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-2509
Vendor/Project: QNAP
Product: QNAP Network-Attached Storage (NAS)
Vulnerability Name: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-2509']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-50603
Vendor/Project: Aviatrix
Product: Controllers
Vulnerability Name: Aviatrix Controllers OS Command Injection Vulnerability
Date Added to KEV: 2025-01-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-50603']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-61932
Vendor/Project: Motex
Product: LANSCOPE Endpoint Manager
Vulnerability Name: Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability
Date Added to KEV: 2025-10-22
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.motex.co.jp/news/notice/2025/release251020/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-61932']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-61882
Vendor/Project: Oracle
Product: E-Business Suite
Vulnerability Name: Oracle E-Business Suite Unspecified Vulnerability
Date Added to KEV: 2025-10-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-27
Known Ransomware Campaign Use: Known
Notes: ['https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-61882']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22204
Vendor/Project: Perl
Product: Exiftool
Vulnerability Name: ExifTool Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-17
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22204']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-5030
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Memory Corruption Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-5030']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28252
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Date Added to KEV: 2023-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-02
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252', '  https://nvd.nist.gov/vuln/detail/CVE-2023-28252']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-12480
Vendor/Project: Gladinet
Product: Triofox
Vulnerability Name: Gladinet Triofox Improper Access Control Vulnerability
Date Added to KEV: 2025-11-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://access.triofox.com/releases_history ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-12480']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36847
Vendor/Project: Juniper
Product: Junos OS
Vulnerability Name: Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2023-11-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36847']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-17144
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-17144']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-0310
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player ASLR Bypass Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-0310']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31196
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Information Disclosure Vulnerability
Date Added to KEV: 2024-08-21
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-11
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-31196', ' https://nvd.nist.gov/vuln/detail/CVE-2021-31196']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-32894
Vendor/Project: Apple
Product: iOS and macOS
Vulnerability Name: Apple iOS and macOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-08-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413', '  https://nvd.nist.gov/vuln/detail/CVE-2022-32894']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25487
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Out-of-Bounds Read Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25487']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-20062
Vendor/Project: ThinkPHP
Product: noneCms
Vulnerability Name: ThinkPHP "noneCms" Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-20062']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-35250
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability 
Date Added to KEV: 2024-12-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-35250']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-5223
Vendor/Project: D-Link
Product: DSL-2760U
Vulnerability Name: D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-5223']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21608
Vendor/Project: Adobe
Product: Acrobat and Reader
Vulnerability Name: Adobe Acrobat and Reader Use-After-Free Vulnerability
Date Added to KEV: 2023-10-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/acrobat/apsb23-01.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-21608']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-35081
Vendor/Project: Ivanti
Product: Endpoint Manager Mobile (EPMM)
Vulnerability Name: Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
Date Added to KEV: 2023-07-31
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US', '  https://nvd.nist.gov/vuln/detail/CVE-2023-35081']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-27443
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2025-05-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes ', ' https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes ', ' https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-27443']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-27593
Vendor/Project: QNAP
Product: Photo Station
Vulnerability Name: QNAP Photo Station Externally Controlled Reference Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Known
Notes: ['https://www.qnap.com/en/security-advisory/qsa-22-24', '  https://nvd.nist.gov/vuln/detail/CVE-2022-27593']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0798
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0798']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-0266
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Use-After-Free Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4', '  https://nvd.nist.gov/vuln/detail/CVE-2023-0266']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-28949
Vendor/Project: PEAR
Product: Archive_Tar
Vulnerability Name: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://pear.php.net/bugs/bug.php?id=27002, https://www.drupal.org/sa-core-2020-013, https://access.redhat.com/security/cve/cve-2020-28949', ' https://nvd.nist.gov/vuln/detail/CVE-2020-28949']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-43468
Vendor/Project: Microsoft
Product: Configuration Manager
Vulnerability Name: Microsoft Configuration Manager SQL Injection Vulnerability
Date Added to KEV: 2026-02-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-43468']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-33246
Vendor/Project: Apache
Product: RocketMQ
Vulnerability Name: Apache RocketMQ Command Execution Vulnerability
Date Added to KEV: 2023-09-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-09-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp', '  https://nvd.nist.gov/vuln/detail/CVE-2023-33246']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31201
Vendor/Project: Microsoft
Product: Enhanced Cryptographic Provider
Vulnerability Name: Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-31201']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8653
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8653']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-21999
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-21999']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28432
Vendor/Project: MinIO
Product: MinIO
Vulnerability Name: MinIO Information Disclosure Vulnerability
Date Added to KEV: 2023-04-21
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q', ' https://nvd.nist.gov/vuln/detail/CVE-2023-28432']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-32896
Vendor/Project: Android
Product: Pixel
Vulnerability Name: Android Pixel Privilege Escalation Vulnerability
Date Added to KEV: 2024-06-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/pixel/2024-06-01', ' https://nvd.nist.gov/vuln/detail/CVE-2024-32896']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-42917
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Memory Corruption Vulnerability
Date Added to KEV: 2023-12-04
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2023-12-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT214031, https://support.apple.com/en-us/HT214032, https://support.apple.com/en-us/HT214033 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-42917']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-5317
Vendor/Project: Jenkins
Product: Jenkins User Interface (UI)
Vulnerability Name: Jenkins User Interface (UI) Information Disclosure Vulnerability
Date Added to KEV: 2023-05-12
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.jenkins.io/security/advisory/2015-11-11/', ' https://nvd.nist.gov/vuln/detail/CVE-2015-5317']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-14611
Vendor/Project: Gladinet
Product: CentreStack and Triofox
Vulnerability Name: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Date Added to KEV: 2025-12-15
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.centrestack.com/p/gce_latest_release.html ', ' https://access.triofox.com/releases_history/', ' https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster#h_01JQRV57T37HJFQZKBZH9NBXQP ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-14611']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-9242
Vendor/Project: WatchGuard
Product: Firebox
Vulnerability Name: WatchGuard Firebox Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-11-12
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-9242']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-33106
Vendor/Project: Qualcomm
Product: Multiple Chipsets
Vulnerability Name: Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
Date Added to KEV: 2023-12-05
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Due Date: 2023-12-26
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.codelinaro.org/clo/la/kernel/msm-4.19/-/commit/1e46e81dbeb69aafd5842ce779f07e617680fd58', '  https://nvd.nist.gov/vuln/detail/CVE-2023-33106']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-25506
Vendor/Project: D-Link
Product: DNS-320 Device
Vulnerability Name: D-Link DNS-320 Device Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-25506']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41091
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Date Added to KEV: 2022-11-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-12-09
Known Ransomware Campaign Use: Known
Notes: ['https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41091']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-27199
Vendor/Project: JetBrains
Product: TeamCity
Vulnerability Name: JetBrains TeamCity Relative Path Traversal Vulnerability
Date Added to KEV: 2026-04-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.jetbrains.com/privacy-security/issues-fixed/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-27199']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21193
Vendor/Project: Google
Product: Chromium Blink
Vulnerability Name: Google Chromium Blink Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21193']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20273
Vendor/Project: Cisco
Product: Cisco IOS XE Web UI
Vulnerability Name: Cisco IOS XE Web UI Command Injection Vulnerability
Date Added to KEV: 2023-10-23
Required Action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Due Date: 2023-10-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z', '  https://nvd.nist.gov/vuln/detail/CVE-2023-20273']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20481
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerability Name: Cisco ASA and FTD Denial-of-Service Vulnerability
Date Added to KEV: 2024-10-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-20481']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-4102
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Use-After-Free Vulnerability
Date Added to KEV: 2021-12-15
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-4102']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0146
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SMB Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0146']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-0071
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer ASLR Bypass Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-0071']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-16057
Vendor/Project: D-Link
Product: DNS-320 Storage Device
Vulnerability Name: D-Link DNS-320 Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-15
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-16057']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22963
Vendor/Project: VMware Tanzu
Product: Spring Cloud
Vulnerability Name: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://tanzu.vmware.com/security/cve-2022-22963', '  https://nvd.nist.gov/vuln/detail/CVE-2022-22963']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-9859
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-9859']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-40044
Vendor/Project: Progress
Product: WS_FTP Server
Vulnerability Name: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2023-10-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-26
Known Ransomware Campaign Use: Known
Notes: ['https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023', ' https://nvd.nist.gov/vuln/detail/CVE-2023-40044']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-0507
Vendor/Project: Oracle
Product: Java SE
Vulnerability Name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-0507']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-23006
Vendor/Project: SonicWall
Product: SMA1000 Appliances
Vulnerability Name: SonicWall SMA1000 Appliances Deserialization Vulnerability
Date Added to KEV: 2025-01-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-14
Known Ransomware Campaign Use: Known
Notes: ['https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-23006']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21043
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-10-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21043']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-24489
Vendor/Project: Citrix
Product: Content Collaboration
Vulnerability Name: Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
Date Added to KEV: 2023-08-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-09-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489', '  https://nvd.nist.gov/vuln/detail/CVE-2023-24489']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44207
Vendor/Project: Acclaim Systems
Product: USAHERDS
Vulnerability Name: Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability 
Date Added to KEV: 2024-12-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.
Due Date: 2025-01-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.acclaimsystems.com/#contact ', ' https://www.tnatc.org/#contact ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-44207']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-30406
Vendor/Project: Gladinet
Product: CentreStack
Vulnerability Name: Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Date Added to KEV: 2025-04-08
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf ', ' https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-30406']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-30154
Vendor/Project: reviewdog
Product: action-setup GitHub Action
Vulnerability Name: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
Date Added to KEV: 2025-03-24
Required Action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-14
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction ', ' Additional References: https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-30154']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-26633
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Date Added to KEV: 2025-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-01
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26633 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-26633']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-11021
Vendor/Project: D-Link
Product: DCS-930L Devices
Vulnerability Name: D-Link DCS-930L Devices OS Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-11021']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40870
Vendor/Project: Aviatrix
Product: Aviatrix Controller
Vulnerability Name: Aviatrix Controller Unrestricted Upload of File
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-40870']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0074
Vendor/Project: Microsoft
Product: Silverlight
Vulnerability Name: Microsoft Silverlight Double Dereference Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0074']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21042
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-11-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-12-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21042']
Severity: Critical
Known Exploited Vulnerability: CVE-2009-2055
Vendor/Project: Cisco
Product: IOS XR
Vulnerability Name: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2009-2055']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-0232
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Exception Handler Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-0232']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-8651
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Integer Overflow Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-8651']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-1710
Vendor/Project: Oracle
Product: Fusion Middleware
Vulnerability Name: Oracle Fusion Middleware Unspecified Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-1710']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-5123
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-04-13
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-5123']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-2883
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Unspecified Vulnerability
Date Added to KEV: 2025-01-07
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-01-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpuapr2020.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-2883']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-9818
Vendor/Project: Apple
Product: iOS, iPadOS, and watchOS
Vulnerability Name: Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-9818']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11023
Vendor/Project: JQuery
Product: JQuery
Vulnerability Name: JQuery Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2025-01-23
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-13
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 ', ' https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-11023']
Severity: Critical