CISA KEV
Known exploited
The government must-patch list, mapped to our product index so you can go straight to the product affected.
Updated Oct 28, 20:59 UTC
Added this week
8
▼ 11%vs last week
Ransomware-linked
361
known usein ransomware campaigns
Due in 14 days
9
federalremediation deadlines
Total on KEV
1,763
since 2021all entries
| CVE | Product | CVSS | Added | Summary |
|---|---|---|---|---|
| CVE-2023-29300 Ransomware | CO ColdFusion Adobe | 9.8 | Jan 8 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution |
| CVE-2023-38203 Ransomware | CO ColdFusion Adobe | 9.8 | Jan 8 | Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE |
| CVE-2023-41265 Ransomware | QS Qlik Sense Qlik | 9.9 | Dec 7 | Qlik Sense HTTP Tunneling Vulnerability |
| CVE-2023-41266 Ransomware | QS Qlik Sense Qlik | 6.5 | Dec 7 | Qlik Sense Path Traversal Vulnerability |
| CVE-2023-47246 Ransomware | SY Sysaid Sysaid | 9.8 | Nov 13 | SysAid Server Path Traversal Vulnerability |
| CVE-2023-22518 Ransomware | CO Confluence Atlassian | 9.8 | Nov 7 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability |
| CVE-2023-46604 Ransomware | AC ActiveMQ Apache | 9.8 | Nov 2 | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack |
| CVE-2023-46747 Ransomware | BI BIG-IP F5 | 9.8 | Oct 31 | BIG-IP Configuration utility unauthenticated remote code execution vulnerability |
| CVE-2023-4966 Ransomware | NA NetScaler ADC Citrix | 7.5 | Oct 18 | Unauthenticated sensitive information disclosure |
| CVE-2023-22515 Ransomware | CO Confluence Atlassian | 9.8 | Oct 5 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability |
| CVE-2023-40044 Ransomware | WS WS_FTP Server Progress Software Corporation | 8.8 | Oct 5 | WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability |
| CVE-2023-42793 Ransomware | TE TeamCity JetBrains | 9.8 | Oct 4 | JetBrains TeamCity Authentication Bypass Vulnerability |
| CVE-2021-3129 Ransomware | IG Ignition Facade | 9.8 | Sep 18 | Laravel Ignition File Upload Vulnerability |
| CVE-2017-6884 Ransomware | EF Emg2926 Firmware Zyxel | 8.8 | Sep 18 | Zyxel EMG2926 Routers Command Injection Vulnerability |
| CVE-2023-20269 Ransomware | CA Cisco Adaptive Security Appliance (ASA) Software Cisco | 9.1 | Sep 13 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability |
| CVE-2023-38831 Ransomware | WI Winrar Rarlab | 7.8 | Aug 24 | RARLAB WinRAR Code Execution Vulnerability |
| CVE-2023-38035 Ransomware | MS MobileIron Sentry Ivanti | 9.8 | Aug 22 | Ivanti Sentry Authentication Bypass Vulnerability |
| CVE-2023-27532 Ransomware | BR Backup & Replication Veeam | 7.5 | Aug 22 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability |
| CVE-2023-35078 Ransomware | EM Endpoint Manager Mobile Ivanti | 9.8 | Jul 25 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability |
| CVE-2023-3519 Ransomware | NA NetScaler ADC Citrix | 9.8 | Jul 19 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability |
| CVE-2023-36884 Ransomware | WI Windows Microsoft | 7.5 | Jul 17 | Windows Search Remote Code Execution Vulnerability |
| CVE-2022-31199 Ransomware | AU Auditor Netwrix | 9.8 | Jul 11 | Netwrix Auditor Insecure Object Deserialization Vulnerability |
| CVE-2023-27997 Ransomware | FO FortiOS Fortinet | 9.8 | Jun 13 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability |
| CVE-2023-34362 Ransomware | MT MOVEit Transfer Progress | 9.8 | Jun 2 | Progress MOVEit Transfer SQL Injection Vulnerability |
| CVE-2021-45046 Ransomware | LO Log4j Apache | 9.0 | May 1 | Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack |
| CVE-2023-27350 Ransomware | PM PaperCut MF/NG PaperCut | 9.8 | Apr 21 | PaperCut MF/NG Improper Access Control Vulnerability |
| CVE-2023-28252 Ransomware | WI Windows Microsoft | 7.8 | Apr 11 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2021-27877 Ransomware | BE Backup Exec Veritas | 9.8 | Apr 7 | Veritas Backup Exec Agent Improper Authentication Vulnerability |
| CVE-2021-27878 Ransomware | BE Backup Exec Veritas | 8.8 | Apr 7 | Veritas Backup Exec Agent Command Execution Vulnerability |
| CVE-2021-27876 Ransomware | BE Backup Exec Veritas | 8.1 | Apr 7 | Veritas Backup Exec Agent File Access Vulnerability |
| CVE-2019-1388 Ransomware | WI Windows Microsoft | 7.8 | Apr 7 | Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability |
| CVE-2017-7494 Ransomware | SA samba Samba | 9.8 | Mar 30 | Samba Remote Code Execution Vulnerability |
| CVE-2023-24880 Ransomware | WI Windows Microsoft | 4.4 | Mar 14 | Windows SmartScreen Security Feature Bypass Vulnerability |
| CVE-2022-36537 Ransomware | ZF ZK Framework Zkoss | 7.5 | Feb 27 | ZK Framework AuUploader Unspecified Vulnerability |
| CVE-2022-47986 Ransomware | AF Aspera Faspex IBM | 9.8 | Feb 21 | IBM Aspera Faspex code execution |
| CVE-2022-41223 Ransomware | MC Mivoice Connect Mitel | 6.8 | Feb 21 | Mitel MiVoice Connect Code Injection Vulnerability |
| CVE-2022-40765 Ransomware | MC Mivoice Connect Mitel | 6.8 | Feb 21 | Mitel MiVoice Connect Command Injection Vulnerability |
| CVE-2023-23376 Ransomware | WI Windows Microsoft | 7.8 | Feb 14 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2015-2291 Ransomware | ED Ethernet Diagnostics Driver Iqvw32.sys Intel | 7.8 | Feb 10 | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability |
| CVE-2022-24990 Ransomware | TO Terramaster Operating System Terra-master | 7.5 | Feb 10 | TerraMaster OS Remote Command Execution Vulnerability |
| CVE-2023-0669 Ransomware | GM GoAnywhere MFT Fortra | 7.2 | Feb 10 | Fortra GoAnywhere MFT License Response Servlet Command Injection |
| CVE-2022-21587 Ransomware | WA Web Applications Desktop Integrator Oracle Corporation | 9.8 | Feb 2 | Oracle E-Business Suite Unspecified Vulnerability |
| CVE-2017-11357 Ransomware | TU Telerik UI For Asp.net Ajax Progress | 9.8 | Jan 26 | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability |
| CVE-2022-47966 Ransomware | MA ManageEngine ADSelfService Plus Zoho | 9.8 | Jan 23 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability |
| CVE-2022-41080 Ransomware | ES Exchange Server Microsoft | 8.8 | Jan 10 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-26501 Ransomware | BR Backup & Replication Veeam | 9.8 | Dec 13 | Veeam Backup & Replication Remote Code Execution Vulnerability |
| CVE-2022-42475 Ransomware | FO FortiOS Fortinet | 9.8 | Dec 13 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability |
| CVE-2022-26500 Ransomware | BR Backup & Replication Veeam | 8.8 | Dec 13 | Veeam Backup & Replication Remote Code Execution Vulnerability |
| CVE-2022-44698 Ransomware | W1 Windows 10 Version 1607 Microsoft | 5.4 | Dec 13 | Windows SmartScreen Security Feature Bypass Vulnerability |
| CVE-2022-41073 Ransomware | WI Windows Microsoft | 7.8 | Nov 8 | Windows Print Spooler Elevation of Privilege Vulnerability |