CISA Known Exploited Vulnerabilities (KEV)
CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks. CVEFeed.io mirrors every entry, joins it to full CVE and severity data, and tracks new additions so you can prioritize remediation the moment a vulnerability enters the catalog.
Because each KEV entry carries direct evidence of active exploitation, the catalog is one of the highest-signal inputs for risk-based patch management — start here before triaging vulnerabilities that are only theoretically exploitable.
9.8
CVE-2022-21587 - Oracle E-Business Suite Unspecified Vulnerability -
Action Due Feb 23, 2023 Target Vendor : Oracle
Description :Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Feb 02, 2023
Notes :https://www.oracle.com/security-alerts/cpuoct2022.html; https://nvd.nist.gov/vuln/detail/CVE-2022-21587
9.8
CVE-2017-11357 - Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability -
Action Due Feb 16, 2023 Target Vendor : Telerik
Description :Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 26, 2023
Notes :https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357
9.8
CVE-2022-47966 - Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability -
Action Due Feb 13, 2023 Target Vendor : Zoho
Description :Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 23, 2023
Notes :https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html; https://nvd.nist.gov/vuln/detail/CVE-2022-47966
9.8
CVE-2022-44877 - CWP Control Web Panel OS Command Injection Vulnerability -
Action Due Feb 07, 2023 Target Vendor : CWP
Description :CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://control-webpanel.com/changelog#1669855527714-450fb335-6194; https://nvd.nist.gov/vuln/detail/CVE-2022-44877
8.8
CVE-2023-21674 - Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability -
Action Due Jan 31, 2023 Target Vendor : Microsoft
Description :Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674; https://nvd.nist.gov/vuln/detail/CVE-2023-21674
9.8
CVE-2022-41080 - Microsoft Exchange Server Privilege Escalation Vulnerability -
Action Due Jan 31, 2023 Target Vendor : Microsoft
Description :Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 10, 2023
Notes :https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080; https://nvd.nist.gov/vuln/detail/CVE-2022-41080
9.9
CVE-2018-18809 - TIBCO JasperReports Library Directory Traversal Vulnerability -
Action Due Jan 19, 2023 Target Vendor : TIBCO
Description :TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809; https://nvd.nist.gov/vuln/detail/CVE-2018-18809
8.8
CVE-2018-5430 - TIBCO JasperReports Server Information Disclosure Vulnerability -
Action Due Jan 19, 2023 Target Vendor : TIBCO
Description :TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430
8.8
CVE-2022-42856 - Apple iOS Type Confusion Vulnerability -
Action Due Jan 04, 2023 Target Vendor : Apple
Description :Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://support.apple.com/en-us/HT213516; https://nvd.nist.gov/vuln/detail/CVE-2022-42856
9.8
CVE-2022-27518 - Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Citrix
Description :Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/; https://nvd.nist.gov/vuln/detail/CVE-2022-27518
5.4
CVE-2022-44698 - Microsoft Defender SmartScreen Security Feature Bypass Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Microsoft
Description :Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Dec 13, 2022
Notes :https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698; https://nvd.nist.gov/vuln/detail/CVE-2022-44698
10.0
CVE-2022-26501 - Veeam Backup & Replication Remote Code Execution Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Veeam
Description :The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Dec 13, 2022
Notes :https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26501
8.8
CVE-2022-26500 - Veeam Backup & Replication Remote Code Execution Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Veeam
Description :The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Dec 13, 2022
Notes :https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26500
9.8
CVE-2022-42475 - Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Fortinet
Description :Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Feb 26, 2026
Notes :https://www.fortiguard.com/psirt/FG-IR-22-398; https://nvd.nist.gov/vuln/detail/CVE-2022-42475
8.8
CVE-2022-4262 - Google Chromium V8 Type Confusion Vulnerability -
Action Due Dec 26, 2022 Target Vendor : Google
Description :Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html; https://nvd.nist.gov/vuln/detail/CVE-2022-4262
9.8
CVE-2021-35587 - Oracle Fusion Middleware Unspecified Vulnerability -
Action Due Dec 19, 2022 Target Vendor : Oracle
Description :Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587
9.6
CVE-2022-4135 - Google Chromium GPU Heap Buffer Overflow Vulnerability -
Action Due Dec 19, 2022 Target Vendor : Google
Description :Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html; https://nvd.nist.gov/vuln/detail/CVE-2022-4135
5.4
CVE-2022-41049 - Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description :Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41049; https://nvd.nist.gov/vuln/detail/CVE-2022-41049
7.1
CVE-2021-25337 - Samsung Mobile Devices Improper Access Control Vulnerability -
Action Due Nov 29, 2022 Target Vendor : Samsung
Description :Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://security.samsungmobile.com/securityUpdate.smsb; https://nvd.nist.gov/vuln/detail/CVE-2021-25337
5.4
CVE-2022-41091 - Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description :Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Feb 26, 2026
Notes :https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091; https://nvd.nist.gov/vuln/detail/CVE-2022-41091