CISA Known Exploited Vulnerabilities (KEV)
CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities actively used in real-world attacks. CVEFeed.io tracks the latest additions so you can prioritize remediation as new entries are published.
9.8
CVE-2019-2725 - Oracle WebLogic Server, Injection -
Action Due Jul 10, 2022 Target Vendor : Oracle
Description :Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 10, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-2725
9.8
CVE-2019-9670 - Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference -
Action Due Jul 10, 2022 Target Vendor : Synacor
Description :Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-9670
9.1
CVE-2018-13382 - Fortinet FortiOS and FortiProxy Improper Authorization -
Action Due Jul 10, 2022 Target Vendor : Fortinet
Description :An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 10, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-13382
6.5
CVE-2018-13383 - Fortinet FortiOS and FortiProxy Out-of-bounds Write -
Action Due Jul 10, 2022 Target Vendor : Fortinet
Description :A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 10, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2018-13383
8.1
CVE-2019-1579 - Palo Alto Networks PAN-OS Remote Code Execution Vulnerability -
Action Due Jul 10, 2022 Target Vendor : Palo Alto Networks
Description :Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Jan 10, 2022
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-1579
10.0
CVE-2015-7450 - IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. -
Action Due Jul 10, 2022 Target Vendor : IBM
Description :Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2015-7450
9.8
CVE-2017-1000486 - Primetek Primefaces Remote Code Execution Vulnerability -
Action Due Jul 10, 2022 Target Vendor : Primetek
Description :Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
10.0
CVE-2019-7609 - Kibana Arbitrary Code Execution -
Action Due Jul 10, 2022 Target Vendor : Elastic
Description :Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-7609
9.8
CVE-2021-27860 - FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit -
Action Due Jan 24, 2022 Target Vendor : FatPipe
Description :A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-27860
7.1
CVE-2021-43890 - Microsoft Windows AppX Installer Spoofing Vulnerability -
Action Due Dec 29, 2021 Target Vendor : Microsoft
Description :Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Feb 26, 2026
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-43890
8.8
CVE-2021-4102 - Google Chromium V8 Use-After-Free Vulnerability -
Action Due Dec 29, 2021 Target Vendor : Google
Description :Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-4102
10.0
CVE-2021-44228 - Apache Log4j2 Remote Code Execution Vulnerability -
Action Due Dec 24, 2021 Target Vendor : Apache
Description :Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Action :For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Known To Be Used in Ransomware Campaigns? : Known Detected Dec 10, 2021
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-44228
7.8
CVE-2021-44168 - Fortinet FortiOS Arbitrary File Download -
Action Due Dec 24, 2021 Target Vendor : Fortinet
Description :Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-44168
9.8
CVE-2017-12149 - Red Hat JBoss Application Server Remote Code Execution Vulnerability -
Action Due Jun 10, 2022 Target Vendor : Red Hat
Description :The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known Detected Dec 10, 2021
Notes :https://nvd.nist.gov/vuln/detail/CVE-2017-12149
10.0
CVE-2021-44515 - Zoho Desktop Central Authentication Bypass Vulnerability -
Action Due Dec 24, 2021 Target Vendor : Zoho
Description :Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-44515
7.8
CVE-2019-13272 - Linux Kernel Improper Privilege Management Vulnerability -
Action Due Jun 10, 2022 Target Vendor : Linux
Description :Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-13272
10.0
CVE-2021-35394 - Realtek Jungle SDK Remote Code Execution Vulnerability -
Action Due Dec 24, 2021 Target Vendor : Realtek
Description :RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2021-35394
9.8
CVE-2019-7238 - Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability -
Action Due Jun 10, 2022 Target Vendor : Sonatype
Description :Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-7238
9.0
CVE-2019-0193 - Apache Solr DataImportHandler Code Injection Vulnerability -
Action Due Jun 10, 2022 Target Vendor : Apache
Description :The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2019-0193
8.1
CVE-2017-17562 - Embedthis GoAhead Remote Code Execution Vulnerability -
Action Due Jun 10, 2022 Target Vendor : Embedthis
Description :Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
Action :Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes :https://nvd.nist.gov/vuln/detail/CVE-2017-17562