CISA Known Exploited Vulnerabilities (KEV)
CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks. CVEFeed.io mirrors every entry, joins it to full CVE and severity data, and tracks new additions so you can prioritize remediation the moment a vulnerability enters the catalog.
Because each KEV entry carries direct evidence of active exploitation, the catalog is one of the highest-signal inputs for risk-based patch management — start here before triaging vulnerabilities that are only theoretically exploitable.
9.3
CVE-2022-22675 - Apple macOS Out-of-Bounds Write Vulnerability -
Action Due Apr 25, 2022 Target Vendor : Apple
Description :macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-22675
5.5
CVE-2022-22674 - Apple macOS Out-of-Bounds Read Vulnerability -
Action Due Apr 25, 2022 Target Vendor : Apple
Description :macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-22674
9.8
CVE-2022-22965 - Spring Framework JDK 9+ Remote Code Execution Vulnerability -
Action Due Apr 25, 2022 Target Vendor : VMware
Description :Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-22965
9.8
CVE-2022-1040 - Sophos Firewall Authentication Bypass Vulnerability -
Action Due Apr 21, 2022 Target Vendor : Sophos
Description :An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-1040
9.8
CVE-2018-10561 - Dasan GPON Routers Authentication Bypass Vulnerability -
Action Due Apr 21, 2022 Target Vendor : Dasan
Description :Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Action :The impacted product is end-of-life and should be disconnected if still in use.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-10561
9.8
CVE-2022-26871 - Trend Micro Apex Central Arbitrary File Upload Vulnerability -
Action Due Apr 21, 2022 Target Vendor : Trend Micro
Description :An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-26871
7.8
CVE-2021-34484 - Microsoft Windows User Profile Service Privilege Escalation Vulnerability -
Action Due Apr 21, 2022 Target Vendor : Microsoft
Description :Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-34484
10.0
CVE-2021-28799 - QNAP NAS Improper Authorization Vulnerability -
Action Due Apr 21, 2022 Target Vendor : QNAP
Description :QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 31, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-28799
9.8
CVE-2018-10562 - Dasan GPON Routers Command Injection Vulnerability -
Action Due Apr 21, 2022 Target Vendor : Dasan
Description :Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Action :The impacted product is end-of-life and should be disconnected if still in use.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 31, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-10562
8.8
CVE-2021-21551 - Dell dbutil Driver Insufficient Access Control Vulnerability -
Action Due Apr 21, 2022 Target Vendor : Dell
Description :Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-21551
8.8
CVE-2022-1096 - Google Chromium V8 Type Confusion Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Google
Description :Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-1096
10.0
CVE-2022-0543 - Debian-specific Redis Server Lua Sandbox Escape Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Redis
Description :Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2022-0543
7.8
CVE-2021-38646 - Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 28, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-38646
7.8
CVE-2021-34486 - Microsoft Windows Event Tracing Privilege Escalation Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-34486
7.8
CVE-2018-8440 - Microsoft Windows Privilege Escalation Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 28, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-8440
7.8
CVE-2018-8406 - Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 28, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-8406
7.8
CVE-2018-8405 - Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 28, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-8405
7.3
CVE-2017-0213 - Microsoft Windows Privilege Escalation Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Mar 28, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2017-0213
4.3
CVE-2017-0059 - Microsoft Internet Explorer Information Disclosure Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2017-0059
9.3
CVE-2015-1770 - Microsoft Office Uninitialized Memory Use Vulnerability -
Action Due Apr 18, 2022 Target Vendor : Microsoft
Description :Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2015-1770