DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2022-41125
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-11-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-12-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41125', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41125']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-14667
Vendor/Project: Red Hat
Product: JBoss RichFaces Framework
Vulnerability Name: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Date Added to KEV: 2023-09-28
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667', ' https://nvd.nist.gov/vuln/detail/CVE-2018-14667']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-1096
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-1096']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-43000
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple products Use-After-Free Vulnerability
Date Added to KEV: 2026-03-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/120324 ', ' https://support.apple.com/en-us/120331 ', ' https://support.apple.com/en-us/120338 ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-43000']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36874
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability
Date Added to KEV: 2023-07-11
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-08-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36874', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36874']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24983
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Win32k Use-After-Free Vulnerability
Date Added to KEV: 2025-03-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24983']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-33742
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-33742']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26143
Vendor/Project: Mitel
Product: MiCollab, MiVoice Business Express
Vulnerability Name: MiCollab, MiVoice Business Express Access Control Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-26143']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0210
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0210']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-7445
Vendor/Project: MikroTik
Product: RouterOS
Vulnerability Name: MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.coresecurity.com/core-labs/advisories/mikrotik-routeros-smb-buffer-overflow#vendor_update, https://mikrotik.com/download', ' https://nvd.nist.gov/vuln/detail/CVE-2018-7445']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-35082
Vendor/Project: Ivanti
Product: Endpoint Manager Mobile (EPMM) and MobileIron Core
Vulnerability Name: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Date Added to KEV: 2024-01-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-08
Known Ransomware Campaign Use: Known
Notes: ['https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older', '  https://nvd.nist.gov/vuln/detail/CVE-2023-35082']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-5086
Vendor/Project: Dassault Systèmes
Product: DELMIA Apriso
Vulnerability Name: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-09-11
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.3ds.com/trust-center/security/security-advisories/cve-2025-5086 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-5086']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-2628
Vendor/Project: Oracle
Product: WebLogic Server
Vulnerability Name: Oracle WebLogic Server Unspecified Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.oracle.com/security-alerts/cpuapr2018.html', ' https://nvd.nist.gov/vuln/detail/CVE-2018-2628']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-13383
Vendor/Project: Fortinet
Product: FortiOS and FortiProxy
Vulnerability Name: Fortinet FortiOS and FortiProxy Out-of-bounds Write
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-13383']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-1854
Vendor/Project: Microsoft
Product: Visual Basic for Applications (VBA)
Vulnerability Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ', ' https://nvd.nist.gov/vuln/detail/CVE-2012-1854']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-42009
Vendor/Project: Roundcube
Product: Webmail
Vulnerability Name: RoundCube Webmail Cross-Site Scripting Vulnerability
Date Added to KEV: 2025-06-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-42009']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-2817
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-2817']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21166
Vendor/Project: Google
Product: Chromium
Vulnerability Name: Google Chromium Race Condition Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21166']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-42824
Vendor/Project: Apple
Product: iOS and iPadOS
Vulnerability Name: Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2023-10-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213961', '  https://nvd.nist.gov/vuln/detail/CVE-2023-42824']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-29824
Vendor/Project: Ivanti
Product: Endpoint Manager (EPM)
Vulnerability Name: Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
Date Added to KEV: 2024-10-02
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-23
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-May-2024 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-29824']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-0767
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2022-06-08
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-0767']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-9715
Vendor/Project: Adobe
Product: Acrobat
Vulnerability Name: Adobe Acrobat Use-After-Free Vulnerability
Date Added to KEV: 2026-04-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-9715']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3918
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Out-of-Bounds Write Vulnerability
Date Added to KEV: 2025-10-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090 ', ' https://nvd.nist.gov/vuln/detail/CVE-2013-3918']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-57819
Vendor/Project: Sangoma
Product: FreePBX
Vulnerability Name: Sangoma FreePBX Authentication Bypass Vulnerability
Date Added to KEV: 2025-08-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-57819']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-53521
Vendor/Project: F5
Product: BIG-IP
Vulnerability Name: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
Date Added to KEV: 2026-03-27
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-30
Known Ransomware Campaign Use: Unknown
Notes: ['Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ', ' https://my.f5.com/manage/s/article/K000160486 ', ' https://my.f5.com/manage/s/article/K11438344 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-53521']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1130
Vendor/Project: Apple
Product: OS X
Vulnerability Name: Apple OS X Authentication Bypass Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1130']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22986
Vendor/Project: F5
Product: BIG-IP and BIG-IQ Centralized Management
Vulnerability Name: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22986']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-3580
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerability Name: Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-3580']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-20708
Vendor/Project: Cisco
Product: Small Business RV160, RV260, RV340, and RV345 Series Routers
Vulnerability Name: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-20708']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38000
Vendor/Project: Google
Product: Chromium Intents
Vulnerability Name: Google Chromium Intents Improper Input Validation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38000']
Severity: Critical
Known Exploited Vulnerability: CVE-2008-0015
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name:  Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
Date Added to KEV: 2026-02-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://web.archive.org/web/20110305211119/https://www.microsoft.com/technet/security/bulletin/ms09-032.mspx ', ' https://nvd.nist.gov/vuln/detail/CVE-2008-0015']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26134
Vendor/Project: Atlassian
Product: Confluence Server/Data Center
Vulnerability Name: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Date Added to KEV: 2022-06-02
Required Action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Due Date: 2022-06-06
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-26134']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-3010
Vendor/Project: Oracle
Product: Solaris
Vulnerability Name: Oracle Solaris Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-3010']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3088
Vendor/Project: Apache
Product: ActiveMQ
Vulnerability Name: Apache ActiveMQ Improper Input Validation Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-3088']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-8963
Vendor/Project: Ivanti
Product: Cloud Services Appliance (CSA)
Vulnerability Name: Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Date Added to KEV: 2024-09-19
Required Action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Due Date: 2024-10-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-8963']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0154
Vendor/Project: Cisco
Product: IOS Software
Vulnerability Name: Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0154']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-4344
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-4344']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20198
Vendor/Project: Cisco
Product: IOS XE Web UI
Vulnerability Name: Cisco IOS XE Web UI Privilege Escalation Vulnerability
Date Added to KEV: 2023-10-16
Required Action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Due Date: 2023-10-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-20198']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20035
Vendor/Project: SonicWall
Product: SMA100 Appliances
Vulnerability Name: SonicWall SMA100 Appliances OS Command Injection Vulnerability
Date Added to KEV: 2025-04-16
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-20035']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-5281
Vendor/Project: Google
Product: Dawn
Vulnerability Name: Google Dawn Use-After-Free Vulnerability
Date Added to KEV: 2026-04-01
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-5281 ']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-42475
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2022-12-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-03
Known Ransomware Campaign Use: Known
Notes: ['https://www.fortiguard.com/psirt/FG-IR-22-398', '  https://nvd.nist.gov/vuln/detail/CVE-2022-42475']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-4211
Vendor/Project: Arm
Product: Mali GPU Kernel Driver
Vulnerability Name: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Date Added to KEV: 2023-10-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities', '  https://nvd.nist.gov/vuln/detail/CVE-2023-4211']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26084
Vendor/Project: Atlassian
Product: Confluence Server and Data Center
Vulnerability Name: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-26084']
Severity: Critical
Known Exploited Vulnerability: CVE-2007-3010
Vendor/Project: Alcatel
Product: OmniPCX Enterprise
Vulnerability Name: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2007-3010']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-2033
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2023-04-17
Required Action: Apply updates per vendor instructions.
Due Date: 2023-05-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-2033']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36844
Vendor/Project: Juniper
Product: Junos OS
Vulnerability Name: Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
Date Added to KEV: 2023-11-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36844']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44168
Vendor/Project: Fortinet
Product: FortiOS
Vulnerability Name: Fortinet FortiOS Arbitrary File Download
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-44168']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-25257
Vendor/Project: Fortinet
Product: FortiWeb
Vulnerability Name: Fortinet FortiWeb SQL Injection Vulnerability
Date Added to KEV: 2025-07-18
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-25257']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-30190
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Date Added to KEV: 2022-06-14
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-30190']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-34048
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Out-of-Bounds Write Vulnerability
Date Added to KEV: 2024-01-22
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-12
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.vmware.com/security/advisories/VMSA-2023-0023.html', '  https://nvd.nist.gov/vuln/detail/CVE-2023-34048']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3906
Vendor/Project: Microsoft
Product: Graphics Component
Vulnerability Name: Microsoft Graphics Component Memory Corruption Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3906']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-3043
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Memory Corruption Vulnerability
Date Added to KEV: 2022-03-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-3043']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0211
Vendor/Project: Apache
Product: HTTP Server
Vulnerability Name: Apache HTTP Server Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0211']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11708
Vendor/Project: Mozilla
Product: Firefox and Thunderbird
Vulnerability Name: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-11708']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-2861
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Directory Traversal Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2010-2861']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-8657
Vendor/Project: EyesOfNetwork
Product: EyesOfNetwork
Vulnerability Name: EyesOfNetwork Use of Hard-Coded Credentials Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-8657']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36884
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Search Remote Code Execution Vulnerability
Date Added to KEV: 2023-07-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-29
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36884']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-6670
Vendor/Project: Progress
Product: WhatsUp Gold
Vulnerability Name: Progress WhatsUp Gold SQL Injection Vulnerability
Date Added to KEV: 2024-09-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-07
Known Ransomware Campaign Use: Known
Notes: ['https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-6670']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25372
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Improper Boundary Check Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25372']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25394
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Race Condition Vulnerability
Date Added to KEV: 2023-06-29
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Due Date: 2023-07-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25394']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-2120
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA)
Vulnerability Name: Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2024-11-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120 ', ' https://nvd.nist.gov/vuln/detail/CVE-2014-2120']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-3714
Vendor/Project: ImageMagick
Product: ImageMagick
Vulnerability Name: ImageMagick Improper Input Validation Vulnerability
Date Added to KEV: 2024-09-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-30
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588#p132726, https://imagemagick.org/archive/releases/', ' https://nvd.nist.gov/vuln/detail/CVE-2016-3714']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-28663
Vendor/Project: Arm
Product: Mali Graphics Processing Unit (GPU)
Vulnerability Name: Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-28663']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24472
Vendor/Project: Fortinet
Product: FortiOS and FortiProxy
Vulnerability Name: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Date Added to KEV: 2025-03-18
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-04-08
Known Ransomware Campaign Use: Known
Notes: ['https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24472']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0674
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0674']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-37450
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products WebKit Code Execution Vulnerability
Date Added to KEV: 2023-07-13
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2023-08-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213826, https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213843, https://support.apple.com/en-us/HT213846, https://support.apple.com/en-us/HT213848', '  https://nvd.nist.gov/vuln/detail/CVE-2023-37450']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-9563
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver XML External Entity (XXE) Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-9563']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-6352
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Code Injection Vulnerability
Date Added to KEV: 2022-02-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-6352']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0863
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0863']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-7841
Vendor/Project: Schneider Electric
Product: U.motion Builder
Vulnerability Name: Schneider Electric U.motion Builder SQL Injection Vulnerability
Date Added to KEV: 2022-04-15
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-7841']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0824
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-08-05
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-08-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0824', ' https://nvd.nist.gov/vuln/detail/CVE-2018-0824']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-16651
Vendor/Project: Roundcube
Product: Roundcube Webmail
Vulnerability Name: Roundcube Webmail File Disclosure Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-16651']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-27950
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Initialization Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-27950']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1130
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1130']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38648
Vendor/Project: Microsoft
Product: Open Management Infrastructure (OMI)
Vulnerability Name: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38648']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1652
Vendor/Project: Cisco
Product: Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Vulnerability Name: Cisco Small Business Routers Improper Input Validation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1652']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40444
Vendor/Project: Microsoft
Product: MSHTML
Vulnerability Name: Microsoft MSHTML Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-40444']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7892
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2022-03-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7892']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-21823
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Graphic Component Privilege Escalation Vulnerability
Date Added to KEV: 2023-02-14
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21823', '  https://nvd.nist.gov/vuln/detail/CVE-2023-21823']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7193
Vendor/Project: QNAP
Product: QTS
Vulnerability Name: QNAP QTS Improper Input Validation Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7193']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22600
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22600']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8373
Vendor/Project: Microsoft
Product: Internet Explorer Scripting Engine
Vulnerability Name: Microsoft Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8373']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3993
Vendor/Project: IBM
Product: InfoSphere BigInsights
Vulnerability Name: IBM InfoSphere BigInsights Invalid Input Vulnerability
Date Added to KEV: 2022-05-25
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3993']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-12991
Vendor/Project: Citrix
Product: SD-WAN and NetScaler
Vulnerability Name: Citrix SD-WAN and NetScaler Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-12991']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-7694
Vendor/Project: TeamT5
Product: ThreatSonar Anti-Ransomware
Vulnerability Name: TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability
Date Added to KEV: 2026-02-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/ ', ' https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-7694']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-29745
Vendor/Project: Android
Product: Pixel
Vulnerability Name: Android Pixel Information Disclosure Vulnerability
Date Added to KEV: 2024-04-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-04-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://source.android.com/docs/security/bulletin/pixel/2024-04-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-29745']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0099
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0099']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0037
Vendor/Project: Microsoft
Product: Edge and Internet Explorer
Vulnerability Name: Microsoft Edge and Internet Explorer Type Confusion Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0037']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11978
Vendor/Project: Apache
Product: Airflow
Vulnerability Name: Apache Airflow Command Injection
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-11978']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6739
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6739']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-5065
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-5065']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-24112
Vendor/Project: Apache
Product: APISIX
Vulnerability Name: Apache APISIX Authentication Bypass Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94', '  https://nvd.nist.gov/vuln/detail/CVE-2022-24112']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22681
Vendor/Project: Rockwell
Product: Multiple Products
Vulnerability Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Date Added to KEV: 2026-03-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ', ' https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-22681']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-1340
Vendor/Project: Ivanti
Product: Endpoint Manager Mobile (EPMM)
Vulnerability Name: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Date Added to KEV: 2026-04-08
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-11
Known Ransomware Campaign Use: Unknown
Notes: ["Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please see: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US ", ' https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0S-5.noarch.rpm ', ' https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0L-5.noarch.rpm ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-1340']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36741
Vendor/Project: Trend Micro
Product: Apex One, Apex One as a Service, and Worry-Free Business Security
Vulnerability Name: Trend Micro Multiple Products Improper Input Validation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://success.trendmicro.com/dcx/s/solution/000287819?language=en_US, https://success.trendmicro.com/dcx/s/solution/000287820?language=en_US', ' https://nvd.nist.gov/vuln/detail/CVE-2021-36741']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-3038
Vendor/Project: Google
Product: Chromium Network Service
Vulnerability Name: Google Chromium Network Service Use-After-Free Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html', '  https://nvd.nist.gov/vuln/detail/CVE-2022-3038']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1132
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1132']
Severity: Critical