DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2023-48788
Vendor/Project: Fortinet
Product: FortiClient EMS
Vulnerability Name: Fortinet FortiClient EMS SQL Injection Vulnerability
Date Added to KEV: 2024-03-25
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-04-15
Known Ransomware Campaign Use: Known
Notes: ['https://www.fortiguard.com/psirt/FG-IR-24-007', '  https://nvd.nist.gov/vuln/detail/CVE-2023-48788']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-42287
Vendor/Project: Microsoft
Product: Active Directory
Vulnerability Name: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-02
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-42287']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-3568
Vendor/Project: Meta Platforms
Product: WhatsApp
Vulnerability Name: WhatsApp VOIP Stack Buffer Overflow Vulnerability
Date Added to KEV: 2022-04-19
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-3568']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-7965
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Inappropriate Implementation Vulnerability
Date Added to KEV: 2024-08-28
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html', ' https://nvd.nist.gov/vuln/detail/CVE-2024-7965']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-53690
Vendor/Project: Sitecore
Product: Multiple Products
Vulnerability Name: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-09-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-09-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-53690']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-1889
Vendor/Project: Microsoft
Product: Forefront Threat Management Gateway (TMG)
Vulnerability Name: Microsoft Forefront TMG Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2011-1889']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-5419
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Date Added to KEV: 2025-06-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html', '   https://nvd.nist.gov/vuln/detail/CVE-2025-5419",']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-28229
Vendor/Project: Microsoft
Product: Windows CNG Key Isolation Service
Vulnerability Name: Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Date Added to KEV: 2023-10-04
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229', ' https://nvd.nist.gov/vuln/detail/CVE-2023-28229']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30883
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Memory Corruption Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30883']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-13671
Vendor/Project: Drupal
Product: Drupal core
Vulnerability Name: Drupal core Un-restricted Upload of File
Date Added to KEV: 2022-01-18
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-13671']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-32975
Vendor/Project: Quest
Product: KACE Systems Management Appliance (SMA)
Vulnerability Name: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Date Added to KEV: 2026-04-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32975']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12235
Vendor/Project: Cisco
Product: IOS software
Vulnerability Name: Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12235']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0986
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0986']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36260
Vendor/Project: Hikvision
Product: Security cameras web server
Vulnerability Name: Hikvision Improper Input Validation
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-01-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-36260']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1214
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1214']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-32433
Vendor/Project: Erlang
Product: Erlang/OTP
Vulnerability Name: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2025-06-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-30
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2 ', ' https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-32433']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2426
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2426']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-30040
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability
Date Added to KEV: 2024-05-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040', ' https://nvd.nist.gov/vuln/detail/CVE-2024-30040']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-8570
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-8570']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-1675
Vendor/Project: Mozilla
Product: Firefox
Vulnerability Name: Mozilla Firefox Information Disclosure Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-1675']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22965
Vendor/Project: VMware
Product: Spring Framework
Vulnerability Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22965']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-25213
Vendor/Project: WordPress
Product: File Manager Plugin
Vulnerability Name: WordPress File Manager Plugin Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-25213']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-34484
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-31
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-34484']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-0847
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-04-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-0847']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-20109
Vendor/Project: Cisco
Product: IOS and IOS XE
Vulnerability Name: Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability
Date Added to KEV: 2023-10-10
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx', '  https://nvd.nist.gov/vuln/detail/CVE-2023-20109']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-5521
Vendor/Project: NETGEAR
Product: Multiple Devices
Vulnerability Name: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
Date Added to KEV: 2022-09-08
Required Action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
Due Date: 2022-09-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability', ' https://nvd.nist.gov/vuln/detail/CVE-2017-5521']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11580
Vendor/Project: Atlassian
Product: Crowd and Crowd Data Center
Vulnerability Name: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-11580']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22706
Vendor/Project: Arm
Product: Mali Graphics Processing Unit (GPU)
Vulnerability Name: Arm Mali GPU Kernel Driver Unspecified Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities', '  https://nvd.nist.gov/vuln/detail/CVE-2022-22706']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-35730
Vendor/Project: Roundcube
Product: Roundcube Webmail
Vulnerability Name: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2023-06-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13', ' https://nvd.nist.gov/vuln/detail/CVE-2020-35730']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21514
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
Date Added to KEV: 2026-02-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21514']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-16013
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Incorrect Implementation Vulnerabililty
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-16013']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-12233
Vendor/Project: Cisco
Product: IOS software
Vulnerability Name: Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-12233']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-54236
Vendor/Project: Adobe
Product: Commerce and Magento
Vulnerability Name: Adobe Commerce and Magento Improper Input Validation Vulnerability
Date Added to KEV: 2025-10-24
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-54236']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-4762
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Type Confusion Vulnerability
Date Added to KEV: 2024-02-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html', ' https://nvd.nist.gov/vuln/detail/CVE-2023-4762']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-7287
Vendor/Project: Apple
Product: iOS
Vulnerability Name: Apple iOS Memory Corruption Vulnerability
Date Added to KEV: 2022-05-23
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-7287']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21513
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
Date Added to KEV: 2026-02-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21513']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21985
Vendor/Project: VMware
Product: vCenter Server
Vulnerability Name: VMware vCenter Server Improper Input Validation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21985']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0878
Vendor/Project: Microsoft
Product: Edge and Internet Explorer
Vulnerability Name: Microsoft Edge and Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0878']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0022
Vendor/Project: Microsoft
Product: XML Core Services
Vulnerability Name: Microsoft XML Core Services Information Disclosure Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0022']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-0391
Vendor/Project: Apache
Product: Struts 2
Vulnerability Name: Apache Struts 2 Improper Input Validation Vulnerability
Date Added to KEV: 2022-01-21
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-0391']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-12987
Vendor/Project: DrayTek
Product: Vigor Routers
Vulnerability Name: DrayTek Vigor Routers OS Command Injection Vulnerability
Date Added to KEV: 2025-05-15
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.5/DrayTek_Vigor2960_V1.5.1.5_01release-note.pdf ', ' https://fw.draytek.com.tw/Vigor300B/Firmware/v1.5.1.5/DrayTek_Vigor300B_V1.5.1.5_01release-note.pdf ', ' https://fw.draytek.com.tw/Vigor3900/Firmware/v1.5.1.5/DrayTek_Vigor3900_V1.5.1.5_01release-note.pdf ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-12987']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-11634
Vendor/Project: Citrix
Product: Workspace Application and Receiver for Windows
Vulnerability Name: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-11634']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-20028
Vendor/Project: SonicWall
Product: Secure Remote Access (SRA)
Vulnerability Name: SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
Date Added to KEV: 2022-03-28
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-20028']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21334
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Date Added to KEV: 2025-01-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21334 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21334']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-1388
Vendor/Project: F5
Product: BIG-IP
Vulnerability Name: F5 BIG-IP Missing Authentication Vulnerability
Date Added to KEV: 2022-05-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-31
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-1388']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36802
Vendor/Project: Microsoft
Product: Streaming Service Proxy
Vulnerability Name: Microsoft Streaming Service Proxy Privilege Escalation Vulnerability
Date Added to KEV: 2023-09-12
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802', '   https://nvd.nist.gov/vuln/detail/CVE-2023-36802']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-7262
Vendor/Project: Kingsoft
Product: WPS Office
Vulnerability Name: Kingsoft WPS Office Path Traversal Vulnerability
Date Added to KEV: 2024-09-03
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-24
Known Ransomware Campaign Use: Unknown
Notes: ['While CISA cannot confirm the effectiveness of patches at this time, it is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue the use of the product.', '   https://nvd.nist.gov/vuln/detail/CVE-2024-7262']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-20362
Vendor/Project: Cisco
Product: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Vulnerability Name: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
Date Added to KEV: 2025-09-25
Required Action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Due Date: 2025-09-26
Known Ransomware Campaign Use: Unknown
Notes: ['CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ', ' https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ', ' https://www.cisa.gov/eviction-strategies-tool/create-from-template ', ' https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ', '   https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ', ' https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-20362']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-1761
Vendor/Project: Microsoft
Product: Word
Vulnerability Name: Microsoft Word Memory Corruption Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-1761']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-42948
Vendor/Project: Fortra
Product: Cobalt Strike
Vulnerability Name: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Date Added to KEV: 2023-03-30
Required Action: Apply updates per vendor instructions.
Due Date: 2023-04-20
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-2/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-42948']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-21413
Vendor/Project: Microsoft
Product: Office Outlook
Vulnerability Name: Microsoft Outlook Improper Input Validation Vulnerability
Date Added to KEV: 2025-02-06
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-21413']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-38645
Vendor/Project: Microsoft
Product: Open Management Infrastructure (OMI)
Vulnerability Name: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-38645']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26411
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-26411']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0683
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Installer Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-0683']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-20017
Vendor/Project: D-Link
Product: DSL-2750B Devices
Vulnerability Name: D-Link DSL-2750B Devices Command Injection Vulnerability
Date Added to KEV: 2024-01-08
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088', ' https://nvd.nist.gov/vuln/detail/CVE-2016-20017']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-42827
Vendor/Project: Apple
Product: iOS and iPadOS
Vulnerability Name: Apple iOS and iPadOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-10-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213489', '  https://nvd.nist.gov/vuln/detail/CVE-2022-42827']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7201
Vendor/Project: Microsoft
Product: Edge
Vulnerability Name: Microsoft Edge Memory Corruption Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7201']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-8190
Vendor/Project: Ivanti
Product: Cloud Services Appliance
Vulnerability Name: Ivanti Cloud Services Appliance OS Command Injection Vulnerability
Date Added to KEV: 2024-09-13
Required Action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Due Date: 2024-10-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190', ' https://nvd.nist.gov/vuln/detail/CVE-2024-8190']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-8735
Vendor/Project: Apache
Product: Tomcat
Vulnerability Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added to KEV: 2023-05-12
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Known Ransomware Campaign Use: Unknown
Notes: ['https://tomcat.apache.org/security-9.html', ' https://nvd.nist.gov/vuln/detail/CVE-2016-8735']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-0160
Vendor/Project: OpenSSL
Product: OpenSSL
Vulnerability Name: OpenSSL Information Disclosure Vulnerability
Date Added to KEV: 2022-05-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-0160']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-17530
Vendor/Project: Apache
Product: Struts
Vulnerability Name: Apache Struts Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-17530']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0185
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Media Center Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0185']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0841
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0841']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8611
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8611']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0147
Vendor/Project: Microsoft
Product: SMBv1 server
Vulnerability Name: Microsoft Windows SMBv1 Information Disclosure Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0147']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-7169
Vendor/Project: GNU
Product: Bourne-Again Shell (Bash)
Vulnerability Name: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Date Added to KEV: 2022-01-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-7169']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-22226
Vendor/Project: VMware
Product: ESXi, Workstation, and Fusion
Vulnerability Name: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
Date Added to KEV: 2025-03-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-22226']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-27518
Vendor/Project: Citrix
Product: Application Delivery Controller (ADC) and Gateway
Vulnerability Name: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
Date Added to KEV: 2022-12-13
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/', '  https://nvd.nist.gov/vuln/detail/CVE-2022-27518']
Severity: Critical
Known Exploited Vulnerability: CVE-2010-3962
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Date Added to KEV: 2025-10-06
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ', ' https://nvd.nist.gov/vuln/detail/CVE-2010-3962']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-1731
Vendor/Project: BeyondTrust
Product: Remote Support (RS) and Privileged Remote Access (PRA)
Vulnerability Name: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
Date Added to KEV: 2026-02-13
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-16
Known Ransomware Campaign Use: Known
Notes: ["Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ", ' https://nvd.nist.gov/vuln/detail/CVE-2026-1731']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-15811
Vendor/Project: DotNetNuke (DNN)
Product: DotNetNuke (DNN)
Vulnerability Name: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-15811']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11651
Vendor/Project: SaltStack
Product: Salt
Vulnerability Name: SaltStack Salt Authentication Bypass Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-11651']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-12356
Vendor/Project: BeyondTrust
Product: Privileged Remote Access (PRA) and Remote Support (RS) 
Vulnerability Name: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability 
Date Added to KEV: 2024-12-19
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-27
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-12356']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-26352
Vendor/Project: dotCMS
Product: dotCMS
Vulnerability Name: dotCMS Unrestricted Upload of File Vulnerability
Date Added to KEV: 2022-08-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-09-15
Known Ransomware Campaign Use: Known
Notes: ['https://www.dotcms.com/security/SI-62', '  https://nvd.nist.gov/vuln/detail/CVE-2022-26352']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-4034
Vendor/Project: Red Hat
Product: Polkit
Vulnerability Name: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-4034']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-3502
Vendor/Project: TrueConf
Product: Client
Vulnerability Name: TrueConf Client Download of Code Without Integrity Check Vulnerability
Date Added to KEV: 2026-04-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://trueconf.com/blog/update/trueconf-8-5 ', ' https://trueconf.com/downloads/windows.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-3502']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-15415
Vendor/Project: DrayTek
Product: Multiple Vigor Routers
Vulnerability Name: DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
Date Added to KEV: 2024-09-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472) ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-15415']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-0167
Vendor/Project: Microsoft
Product: Win32k
Vulnerability Name: Microsoft Win32k Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-0167']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-27992
Vendor/Project: Zyxel
Product: Multiple Network-Attached Storage (NAS) Devices
Vulnerability Name: Zyxel Multiple NAS Devices Command Injection Vulnerability
Date Added to KEV: 2023-06-23
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products', '  https://nvd.nist.gov/vuln/detail/CVE-2023-27992']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36934
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows SAM Local Privilege Escalation Vulnerability
Date Added to KEV: 2022-02-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-02-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-36934']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-1641
Vendor/Project: Microsoft
Product: Office
Vulnerability Name: Microsoft Office Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-1641']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29298
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Improper Access Control Vulnerability
Date Added to KEV: 2023-07-20
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html', ' https://nvd.nist.gov/vuln/detail/CVE-2023-29298']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-4878
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Use-After-Free Vulnerability
Date Added to KEV: 2021-11-03
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-4878']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-0386
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Improper Ownership Management Vulnerability
Date Added to KEV: 2025-06-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-08
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a ', ' https://access.redhat.com/security/cve/cve-2023-0386 ', ' https://security.netapp.com/advisory/ntap-20230420-0004/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2023-0386']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-0143
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-0143']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-24557
Vendor/Project: Trend Micro
Product: Apex One, OfficeScan, and Worry-Free Business Security
Vulnerability Name: Trend Micro Multiple Products Improper Access Control Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-24557']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-44877
Vendor/Project: CWP
Product: Control Web Panel
Vulnerability Name: CWP Control Web Panel OS Command Injection Vulnerability
Date Added to KEV: 2023-01-17
Required Action: Apply updates per vendor instructions.
Due Date: 2023-02-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://control-webpanel.com/changelog#1669855527714-450fb335-6194', '  https://nvd.nist.gov/vuln/detail/CVE-2022-44877']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-1938
Vendor/Project: Apache
Product: Tomcat
Vulnerability Name: Apache Tomcat Improper Privilege Management Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-1938']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-43461
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows MSHTML Platform Spoofing Vulnerability
Date Added to KEV: 2024-09-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-10-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-43461']
Severity: Critical
Known Exploited Vulnerability: CVE-2012-0151
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability
Date Added to KEV: 2022-06-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-22
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2012-0151']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-49113
Vendor/Project: Roundcube
Product: Webmail
Vulnerability Name: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2026-02-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 ', ' https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 ', ' https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-49113']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-44026
Vendor/Project: Roundcube
Product: Roundcube Webmail
Vulnerability Name: Roundcube Webmail SQL Injection Vulnerability
Date Added to KEV: 2023-06-22
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-13
Known Ransomware Campaign Use: Unknown
Notes: ['https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released', ' https://nvd.nist.gov/vuln/detail/CVE-2021-44026']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-1671
Vendor/Project: Sophos
Product: Web Appliance
Vulnerability Name: Sophos Web Appliance Command Injection Vulnerability
Date Added to KEV: 2023-11-16
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-07
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce', '  https://nvd.nist.gov/vuln/detail/CVE-2023-1671']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-11738
Vendor/Project: WordPress
Product: Snap Creek Duplicator Plugin
Vulnerability Name: WordPress Snap Creek Duplicator Plugin File Download Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-11738']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2590
Vendor/Project: Oracle
Product: Java SE
Vulnerability Name: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2590']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-25078
Vendor/Project: D-Link
Product: DCS-2530L and DCS-2670L Devices
Vulnerability Name: D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
Date Added to KEV: 2025-08-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.dlink.com/productinfo.aspx?m=DCS-2530L ', ' https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 ', ' https://nvd.nist.gov/vuln/detail/CVE-2020-25078']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-7450
Vendor/Project: IBM
Product: WebSphere Application Server and Server Hypervisor Edition
Vulnerability Name: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-7450']
Severity: Critical