DuyTa/cve-kgrag-db huggingface dataset:
Known Exploited Vulnerability: CVE-2023-6548
Vendor/Project: Citrix
Product: NetScaler ADC and NetScaler Gateway
Vulnerability Name: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Date Added to KEV: 2024-01-17
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-01-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549', '   https://nvd.nist.gov/vuln/detail/CVE-2023-6548']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-6278
Vendor/Project: GNU
Product: GNU Bash
Vulnerability Name: GNU Bash OS Command Injection Vulnerability
Date Added to KEV: 2025-10-02
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. 
Due Date: 2025-10-23
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ', ' https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ', ' https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ', ' https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ', ' https://nvd.nist.gov/vuln/detail/CVE-2014-6278']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-33771
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-33771']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7200
Vendor/Project: Microsoft
Product: Edge
Vulnerability Name: Microsoft Edge Memory Corruption Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7200']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-18325
Vendor/Project: DotNetNuke (DNN)
Product: DotNetNuke (DNN)
Vulnerability Name: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-18325']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-10035
Vendor/Project: Fortra
Product: GoAnywhere MFT
Vulnerability Name: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2025-09-29
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-20
Known Ransomware Campaign Use: Known
Notes: ['https://www.fortra.com/security/advisories/product-security/fi-2025-012 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-10035']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38080
Vendor/Project: Microsoft
Product: Windows 
Vulnerability Name: Microsoft Windows Hyper-V Privilege Escalation Vulnerability
Date Added to KEV: 2024-07-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38080', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38080']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41991
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Improper Certificate Validation Vulnerability
Date Added to KEV: 2023-09-25
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213928, https://support.apple.com/en-us/HT213929, https://support.apple.com/en-us/HT213931 ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-41991']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-3346
Vendor/Project: Adobe
Product: Reader and Acrobat
Vulnerability Name: Adobe Reader and Acrobat Memory Corruption Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-3346']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30983
Vendor/Project: Apple
Product: iOS and iPadOS
Vulnerability Name: Apple iOS and iPadOS Buffer Overflow Vulnerability
Date Added to KEV: 2022-06-27
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-30983']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-18362
Vendor/Project: Kaseya
Product: Virtual System/Server Administrator (VSA)
Vulnerability Name: Kaseya VSA SQL Injection Vulnerability
Date Added to KEV: 2022-05-24
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-18362']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-1000486
Vendor/Project: Primetek
Product: Primefaces Application
Vulnerability Name: Primetek Primefaces Remote Code Execution Vulnerability
Date Added to KEV: 2022-01-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-07-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-1000486']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-2441
Vendor/Project: Google
Product: Chromium
Vulnerability Name: Google Chromium CSS Use-After-Free Vulnerability
Date Added to KEV: 2026-02-17
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-2441']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-22675
Vendor/Project: Apple
Product: macOS
Vulnerability Name: Apple macOS Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-04-04
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-22675']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-5735
Vendor/Project: Amcrest
Product: Cameras and Network Video Recorder (NVR)
Vulnerability Name: Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-5735']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-5418
Vendor/Project: Rails
Product: Ruby on Rails
Vulnerability Name: Rails Ruby on Rails Path Traversal Vulnerability
Date Added to KEV: 2025-07-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-07-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2019-5418']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-6961
Vendor/Project: VMware
Product: SD-WAN Edge
Vulnerability Name: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
Date Added to KEV: 2022-03-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-6961']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-39144
Vendor/Project: XStream
Product: XStream
Vulnerability Name: XStream Remote Code Execution Vulnerability
Date Added to KEV: 2023-03-10
Required Action: Apply updates per vendor instructions.
Due Date: 2023-03-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-2021-39144.html', ' https://nvd.nist.gov/vuln/detail/CVE-2021-39144']
Severity: Critical
Known Exploited Vulnerability: CVE-2014-4148
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Remote Code Execution Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2014-4148']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-61884
Vendor/Project: Oracle
Product: E-Business Suite
Vulnerability Name: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Date Added to KEV: 2025-10-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-10
Known Ransomware Campaign Use: Known
Notes: ['https://www.oracle.com/security-alerts/alert-cve-2025-61884.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-61884']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1429
Vendor/Project: Microsoft
Product: Internet Explorer
Vulnerability Name: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1429']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-41379
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Installer Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-41379']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0643
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Incorrect Default Permissions Vulnerability
Date Added to KEV: 2024-09-17
Required Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Due Date: 2024-10-08
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ', ' https://nvd.nist.gov/vuln/detail/CVE-2013-0643']
Severity: Critical
Known Exploited Vulnerability: CVE-2011-2005
Vendor/Project: Microsoft
Product: Ancillary Function Driver (afd.sys)
Vulnerability Name: Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability
Date Added to KEV: 2022-03-28
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2011-2005']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-47246
Vendor/Project: SysAid
Product: SysAid Server
Vulnerability Name: SysAid Server Path Traversal Vulnerability
Date Added to KEV: 2023-11-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-12-04
Known Ransomware Campaign Use: Known
Notes: ['https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification', ' https://nvd.nist.gov/vuln/detail/CVE-2023-47246']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-0641
Vendor/Project: Adobe
Product: Reader
Vulnerability Name: Adobe Reader Buffer Overflow Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2013-0641']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-40684
Vendor/Project: Fortinet
Product: Multiple Products
Vulnerability Name: Fortinet Multiple Products Authentication Bypass Vulnerability
Date Added to KEV: 2022-10-11
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-01
Known Ransomware Campaign Use: Known
Notes: ['https://www.fortiguard.com/psirt/FG-IR-22-377', '  https://nvd.nist.gov/vuln/detail/CVE-2022-40684']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-21148
Vendor/Project: Google
Product: Chromium V8
Vulnerability Name: Google Chromium V8 Heap Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-21148']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-42999
Vendor/Project: SAP
Product: NetWeaver
Vulnerability Name: SAP NetWeaver Deserialization Vulnerability
Date Added to KEV: 2025-05-15
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-05
Known Ransomware Campaign Use: Unknown
Notes: ['SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-42999']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-37164
Vendor/Project: Hewlett Packard Enterprise (HPE)
Product: OneView
Vulnerability Name: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Date Added to KEV: 2026-01-07
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-01-28
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-37164']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-1253
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability
Date Added to KEV: 2022-03-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-05
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-1253']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-2051
Vendor/Project: D-Link
Product: DIR-645 Router
Vulnerability Name: D-Link DIR-645 Router Remote Code Execution Vulnerability
Date Added to KEV: 2022-02-10
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-2051']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-21335
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Date Added to KEV: 2025-01-14
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-02-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21335 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-21335']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-0541
Vendor/Project: Microsoft
Product: MSHTML
Vulnerability Name: Microsoft MSHTML Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-0541']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-28986
Vendor/Project: SolarWinds
Product: Web Help Desk
Vulnerability Name: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Date Added to KEV: 2024-08-15
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-09-05
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28986', ' https://nvd.nist.gov/vuln/detail/CVE-2024-28986']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-24423
Vendor/Project: SmarterTools
Product: SmarterMail
Vulnerability Name: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2026-02-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-02-26
Known Ransomware Campaign Use: Known
Notes: ['https://www.smartertools.com/smartermail/release-notes/current ', ' https://www.cve.org/CVERecord?id=CVE-2026-24423 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-24423']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-1709
Vendor/Project: ConnectWise
Product: ScreenConnect
Vulnerability Name: ConnectWise ScreenConnect Authentication Bypass Vulnerability
Date Added to KEV: 2024-02-22
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-02-29
Known Ransomware Campaign Use: Known
Notes: ['https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8', ' https://nvd.nist.gov/vuln/detail/CVE-2024-1709']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-43520
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Classic Buffer Overflow Vulnerability
Date Added to KEV: 2026-03-20
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-04-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/125632 ', ' https://support.apple.com/en-us/125633 ', ' https://support.apple.com/en-us/125634 ', ' https://support.apple.com/en-us/125635 ', ' https://support.apple.com/en-us/125636 ', ' https://support.apple.com/en-us/125637 ', ' https://support.apple.com/en-us/125638 ', ' https://support.apple.com/en-us/125639 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-43520']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-6663
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-6663']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-36955
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-36955']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-41992
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Kernel Privilege Escalation Vulnerability
Date Added to KEV: 2023-09-25
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-16
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213928, https://support.apple.com/en-us/HT213929, https://support.apple.com/en-us/HT213931, https://support.apple.com/en-us/HT213932', '  https://nvd.nist.gov/vuln/detail/CVE-2023-41992']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-50302
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Use of Uninitialized Resource Vulnerability
Date Added to KEV: 2025-03-04
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-25
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/ ', ' https://source.android.com/docs/security/bulletin/2025-03-01 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-50302']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22205
Vendor/Project: GitLab
Product: Community and Enterprise Editions
Vulnerability Name: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-22205']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20353
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerability Name: Cisco ASA and FTD Denial of Service Vulnerability
Date Added to KEV: 2024-04-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-05-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2', '   https://nvd.nist.gov/vuln/detail/CVE-2024-20353']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-31955
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Kernel Information Disclosure Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-31955']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-8174
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
Date Added to KEV: 2022-02-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-08-15
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-8174']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-30088
Vendor/Project: Microsoft
Product: Windows 
Vulnerability Name: Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
Date Added to KEV: 2024-10-15
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-11-05
Known Ransomware Campaign Use: Known
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-30088']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-30952
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Date Added to KEV: 2026-03-05
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-26
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT212975 ', ' https://support.apple.com/en-us/HT212976 ', ' https://support.apple.com/en-us/HT212978 ', ' https://support.apple.com/en-us/HT212980 ', ' https://support.apple.com/en-us/HT212982 ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-30952']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-6367
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA)
Vulnerability Name: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Date Added to KEV: 2022-05-24
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-6367']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-29360
Vendor/Project: Microsoft
Product: Streaming Service
Vulnerability Name: Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability
Date Added to KEV: 2024-02-29
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-03-21
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29360 ', 'https://nvd.nist.gov/vuln/detail/CVE-2023-29360']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-21533
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Improper Privilege Management Vulnerability
Date Added to KEV: 2026-02-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2026-03-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533 ', ' https://nvd.nist.gov/vuln/detail/CVE-2026-21533']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-0185
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Heap-Based Buffer Overflow Vulnerability
Date Added to KEV: 2024-08-21
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2024-09-11
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=722d94847de2', ' https://nvd.nist.gov/vuln/detail/CVE-2022-0185']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-17562
Vendor/Project: Embedthis
Product: GoAhead
Vulnerability Name: Embedthis GoAhead Remote Code Execution Vulnerability
Date Added to KEV: 2021-12-10
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2017-17562']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22899
Vendor/Project: Ivanti
Product: Pulse Connect Secure
Vulnerability Name: Ivanti Pulse Connect Secure Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ["Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22899"]
Severity: Critical
Known Exploited Vulnerability: CVE-2023-36846
Vendor/Project: Juniper
Product: Junos OS
Vulnerability Name: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Date Added to KEV: 2023-11-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-36846']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38475
Vendor/Project: Apache
Product: HTTP Server
Vulnerability Name: Apache HTTP Server Improper Escaping of Output Vulnerability
Date Added to KEV: 2025-05-01
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-05-22
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://httpd.apache.org/security/vulnerabilities_24.html ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38475']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-57727
Vendor/Project: SimpleHelp 
Product: SimpleHelp
Vulnerability Name: SimpleHelp Path Traversal Vulnerability
Date Added to KEV: 2025-02-13
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-06
Known Ransomware Campaign Use: Known
Notes: ['https://simple-help.com/kb---security-vulnerabilities-01-2025 ', ' Additional CISA Mitigation Instructions: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-57727']
Severity: Critical
Known Exploited Vulnerability: CVE-2019-20085
Vendor/Project: TVT
Product: NVMS-1000
Vulnerability Name: TVT NVMS-1000 Directory Traversal Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2019-20085']
Severity: Critical
Known Exploited Vulnerability: CVE-2015-0311
Vendor/Project: Adobe
Product: Flash Player
Vulnerability Name: Adobe Flash Player Remote Code Execution Vulnerability
Date Added to KEV: 2022-04-13
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Due Date: 2022-05-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2015-0311']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-38205
Vendor/Project: Adobe
Product: ColdFusion
Vulnerability Name: Adobe ColdFusion Improper Access Control Vulnerability
Date Added to KEV: 2023-07-20
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html ', '  https://nvd.nist.gov/vuln/detail/CVE-2023-38205']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-41352
Vendor/Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Date Added to KEV: 2022-10-20
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-10
Known Ransomware Campaign Use: Unknown
Notes: ['https://wiki.zimbra.com/wiki/Security_Center', '  https://nvd.nist.gov/vuln/detail/CVE-2022-41352']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7256
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Open Type Font Remote Code Execution Vulnerability
Date Added to KEV: 2022-05-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-06-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7256']
Severity: Critical
Known Exploited Vulnerability: CVE-2018-18809
Vendor/Project: TIBCO
Product: JasperReports
Vulnerability Name: TIBCO JasperReports Library Directory Traversal Vulnerability
Date Added to KEV: 2022-12-29
Required Action: Apply updates per vendor instructions.
Due Date: 2023-01-19
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809', ' https://nvd.nist.gov/vuln/detail/CVE-2018-18809']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-16846
Vendor/Project: SaltStack
Product: Salt
Vulnerability Name: SaltStack Salt Shell Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2020-16846']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-24990
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows Untrusted Pointer Dereference Vulnerability
Date Added to KEV: 2025-10-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-11-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24990 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-24990']
Severity: Critical
Known Exploited Vulnerability: CVE-2026-20122
Vendor/Project: Cisco
Product: Catalyst SD-WAN Manger
Vulnerability Name: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Date Added to KEV: 2026-04-20
Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Due Date: 2026-04-23
Known Ransomware Campaign Use: Unknown
Notes: ['CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ', ' https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ', ' https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ', ' https://nvd.nist.gov/vuln/detail/ CVE-2026-20122']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-13160
Vendor/Project: Ivanti
Product: Endpoint Manager (EPM)
Vulnerability Name: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Date Added to KEV: 2025-03-10
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-03-31
Known Ransomware Campaign Use: Unknown
Notes: ['https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-13160']
Severity: Critical
Known Exploited Vulnerability: CVE-2020-0601
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows CryptoAPI Spoofing Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ["Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601"]
Severity: Critical
Known Exploited Vulnerability: CVE-2023-32434
Vendor/Project: Apple
Product: Multiple Products
Vulnerability Name: Apple Multiple Products Integer Overflow Vulnerability
Date Added to KEV: 2023-06-23
Required Action: Apply updates per vendor instructions.
Due Date: 2023-07-14
Known Ransomware Campaign Use: Unknown
Notes: ['https://support.apple.com/en-us/HT213808, https://support.apple.com/en-us/HT213812, https://support.apple.com/en-us/HT213809, https://support.apple.com/en-us/HT213810, https://support.apple.com/en-us/HT213813, https://support.apple.com/en-us/HT213811, https://support.apple.com/en-us/HT213814', '  https://nvd.nist.gov/vuln/detail/CVE-2023-32434']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-4523
Vendor/Project: Trihedral
Product: VTScada (formerly VTS)
Vulnerability Name: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
Date Added to KEV: 2022-04-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-4523']
Severity: Critical
Known Exploited Vulnerability: CVE-2023-38180
Vendor/Project: Microsoft
Product: .NET Core and Visual Studio
Vulnerability Name: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
Date Added to KEV: 2023-08-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-08-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180', '  https://nvd.nist.gov/vuln/detail/CVE-2023-38180']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-25369
Vendor/Project: Samsung
Product: Mobile Devices
Vulnerability Name: Samsung Mobile Devices Improper Access Control Vulnerability
Date Added to KEV: 2022-11-08
Required Action: Apply updates per vendor instructions.
Due Date: 2022-11-29
Known Ransomware Campaign Use: Unknown
Notes: ['https://security.samsungmobile.com/securityUpdate.smsb', ' https://nvd.nist.gov/vuln/detail/CVE-2021-25369']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-43798
Vendor/Project: Grafana Labs
Product: Grafana
Vulnerability Name: Grafana Path Traversal Vulnerability
Date Added to KEV: 2025-10-09
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-10-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/ ', ' https://nvd.nist.gov/vuln/detail/CVE-2021-43798']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-26857
Vendor/Project: Microsoft
Product: Exchange Server
Vulnerability Name: Microsoft Exchange Server Remote Code Execution Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Known
Notes: ["Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26857"]
Severity: Critical
Known Exploited Vulnerability: CVE-2018-0173
Vendor/Project: Cisco
Product: IOS and IOS XE Software
Vulnerability Name: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2018-0173']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-38112
Vendor/Project: Microsoft
Product: Windows
Vulnerability Name: Microsoft Windows MSHTML Platform Spoofing Vulnerability
Date Added to KEV: 2024-07-09
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-30
Known Ransomware Campaign Use: Unknown
Notes: ['https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112', ' https://nvd.nist.gov/vuln/detail/CVE-2024-38112']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-22894
Vendor/Project: Ivanti
Product: Pulse Connect Secure
Vulnerability Name: Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-05-03
Known Ransomware Campaign Use: Unknown
Notes: ["Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22894"]
Severity: Critical
Known Exploited Vulnerability: CVE-2025-20337
Vendor/Project: Cisco
Product: Identity Services Engine
Vulnerability Name: Cisco Identity Services Engine Injection Vulnerability
Date Added to KEV: 2025-07-28
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-18
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-20337']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-24919
Vendor/Project: Check Point
Product: Quantum Security Gateways
Vulnerability Name: Check Point Quantum Security Gateways Information Disclosure Vulnerability
Date Added to KEV: 2024-05-30
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-06-20
Known Ransomware Campaign Use: Known
Notes: ['https://support.checkpoint.com/results/sk/sk182336 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-24919']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-1498
Vendor/Project: Cisco
Product: HyperFlex HX
Vulnerability Name: Cisco HyperFlex HX Data Platform Command Injection Vulnerability
Date Added to KEV: 2021-11-03
Required Action: Apply updates per vendor instructions.
Due Date: 2021-11-17
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-1498']
Severity: Critical
Known Exploited Vulnerability: CVE-2013-2597
Vendor/Project: Code Aurora
Product: ACDB Audio Driver
Vulnerability Name: Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability
Date Added to KEV: 2022-09-15
Required Action: Apply updates per vendor instructions.
Due Date: 2022-10-06
Known Ransomware Campaign Use: Unknown
Notes: ['https://web.archive.org/web/20161226013354/https:/www.codeaurora.org/news/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597', ' https://nvd.nist.gov/vuln/detail/CVE-2013-2597']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-11182
Vendor/Project: MDaemon
Product: Email Server
Vulnerability Name: MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability
Date Added to KEV: 2025-05-19
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-06-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html ', ' https://mdaemon.com/pages/downloads-critical-updates ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-11182']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-24682
Vendor/Project: Synacor
Product: Zimbra Collaborate Suite (ZCS)
Vulnerability Name: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Date Added to KEV: 2022-02-25
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-11
Known Ransomware Campaign Use: Known
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2022-24682']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-1212
Vendor/Project: Progress
Product: Kemp LoadMaster
Vulnerability Name: Progress Kemp LoadMaster OS Command Injection Vulnerability
Date Added to KEV: 2024-11-18
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-12-09
Known Ransomware Campaign Use: Unknown
Notes: ['https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 ', ' https://nvd.nist.gov/vuln/detail/CVE-2024-1212']
Severity: Critical
Known Exploited Vulnerability: CVE-2024-20359
Vendor/Project: Cisco
Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerability Name: Cisco ASA and FTD Privilege Escalation Vulnerability
Date Added to KEV: 2024-04-24
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-05-01
Known Ransomware Campaign Use: Unknown
Notes: ['https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h', '  https://nvd.nist.gov/vuln/detail/CVE-2024-20359']
Severity: Critical
Known Exploited Vulnerability: CVE-2022-2586
Vendor/Project: Linux
Product: Kernel
Vulnerability Name: Linux Kernel Use-After-Free Vulnerability
Date Added to KEV: 2024-06-26
Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Due Date: 2024-07-17
Known Ransomware Campaign Use: Unknown
Notes: ['This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://seclists.org/oss-sec/2022/q3/131', '  https://nvd.nist.gov/vuln/detail/CVE-2022-2586']
Severity: Critical
Known Exploited Vulnerability: CVE-2017-11357
Vendor/Project: Telerik
Product: User Interface (UI) for ASP.NET AJAX
Vulnerability Name: Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Date Added to KEV: 2023-01-26
Required Action: Apply updates per vendor instructions.
Due Date: 2023-02-16
Known Ransomware Campaign Use: Known
Notes: ['https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference', ' https://nvd.nist.gov/vuln/detail/CVE-2017-11357']
Severity: Critical
Known Exploited Vulnerability: CVE-2021-40438
Vendor/Project: Apache
Product: Apache
Vulnerability Name: Apache HTTP Server-Side Request Forgery (SSRF)
Date Added to KEV: 2021-12-01
Required Action: Apply updates per vendor instructions.
Due Date: 2021-12-15
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2021-40438']
Severity: Critical
Known Exploited Vulnerability: CVE-2025-47812
Vendor/Project: Wing FTP Server
Product: Wing FTP Server
Vulnerability Name: Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
Date Added to KEV: 2025-07-14
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2025-08-04
Known Ransomware Campaign Use: Unknown
Notes: ['https://www.wftpserver.com/serverhistory.htm ', ' https://nvd.nist.gov/vuln/detail/CVE-2025-47812']
Severity: Critical
Known Exploited Vulnerability: CVE-2016-7262
Vendor/Project: Microsoft
Product: Excel
Vulnerability Name: Microsoft Office Security Feature Bypass Vulnerability
Date Added to KEV: 2022-03-03
Required Action: Apply updates per vendor instructions.
Due Date: 2022-03-24
Known Ransomware Campaign Use: Unknown
Notes: ['https://nvd.nist.gov/vuln/detail/CVE-2016-7262']
Severity: Critical