Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2020-11651 | SaltStack Salt Authentication Bypass Vulnerability SaltStack / Salt | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-11652 | SaltStack Salt Path Traversal Vulnerability SaltStack / Salt | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-11738 | WordPress Snap Creek Duplicator Plugin File Download Vulnerability WordPress / Snap Creek Duplicator Plugin | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-12271 | Sophos SFOS SQL Injection Vulnerability Sophos / SFOS | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2020-12812 | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability Fortinet / FortiOS | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2020-1350 | Microsoft Windows DNS Server Remote Code Execution Vulnerability Microsoft / Windows | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-1380 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability Microsoft / Internet Explorer | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-1464 | Microsoft Windows Spoofing Vulnerability Microsoft / Windows | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability Microsoft / Netlogon | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2020-14750 | Oracle WebLogic Server Remote Code Execution Vulnerability Oracle / WebLogic Server | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-14871 | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability Oracle / Solaris and Zettabyte File System (ZFS) | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-14882 | Oracle WebLogic Server Remote Code Execution Vulnerability Oracle / WebLogic Server | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-14883 | Oracle WebLogic Server Unspecified Vulnerability Oracle / WebLogic Server | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-15505 | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability Ivanti / MobileIron Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-15999 | Google Chrome FreeType Heap Buffer Overflow Vulnerability Google / Chrome FreeType | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2020-16009 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-16010 | Google Chrome for Android UI Heap Buffer Overflow Vulnerability Google / Chrome for Android UI | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-16013 | Google Chromium V8 Incorrect Implementation Vulnerabililty Google / Chromium V8 | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-16017 | Google Chrome Use-After-Free Vulnerability Google / Chrome | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-16846 | SaltStack Salt Shell Injection Vulnerability SaltStack / Salt | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-17087 | Microsoft Windows Kernel Privilege Escalation Vulnerability Microsoft / Windows | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-17144 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft / Exchange Server | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-17496 | vBulletin PHP Module Remote Code Execution Vulnerability vBulletin / vBulletin | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-17530 | Apache Struts Remote Code Execution Vulnerability Apache / Struts | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-24557 | Trend Micro Multiple Products Improper Access Control Vulnerability Trend Micro / Apex One, OfficeScan, and Worry-Free Business Security | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-25213 | WordPress File Manager Plugin Remote Code Execution Vulnerability WordPress / File Manager Plugin | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-25506 | D-Link DNS-320 Device Command Injection Vulnerability D-Link / DNS-320 Device | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-2555 | Oracle Multiple Products Remote Code Execution Vulnerability Oracle / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-26919 | Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability NETGEAR / JGS516PE Devices | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-27930 | Apple Multiple Products Memory Corruption Vulnerability Apple / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-27932 | Apple Multiple Products Type Confusion Vulnerability Apple / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-27950 | Apple Multiple Products Memory Initialization Vulnerability Apple / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-29557 | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability D-Link / DIR-825 R1 Devices | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-29583 | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability Zyxel / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3118 | Cisco IOS XR Software Discovery Protocol Format String Vulnerability Cisco / IOS XR | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3161 | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability Cisco / Cisco IP Phones | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3452 | Cisco ASA and FTD Read-Only Path Traversal Vulnerability Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3566 | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Cisco / IOS XR | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3569 | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Cisco / IOS XR | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3580 | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2020-3950 | VMware Multiple Products Privilege Escalation Vulnerability VMware / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3952 | VMware vCenter Server Information Disclosure Vulnerability VMware / vCenter Server | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-3992 | VMware ESXi OpenSLP Use-After-Free Vulnerability VMware / ESXi | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2020-4006 | Multiple VMware Products Command Injection Vulnerability VMware / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-4427 | IBM Data Risk Manager Security Bypass Vulnerability IBM / Data Risk Manager | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-4428 | IBM Data Risk Manager Remote Code Execution Vulnerability IBM / Data Risk Manager | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-4430 | IBM Data Risk Manager Directory Traversal Vulnerability IBM / Data Risk Manager | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-5735 | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability Amcrest / Cameras and Network Video Recorder (NVR) | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-5847 | Unraid Remote Code Execution Vulnerability Unraid / Unraid | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-5849 | Unraid Authentication Bypass Vulnerability Unraid / Unraid | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability F5 / BIG-IP | Nov 3, 2021 | May 3, 2022 | Known |
| CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability SAP / Solution Manager | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability SAP / NetWeaver | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-6418 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-6819 | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability Mozilla / Firefox and Thunderbird | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-6820 | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability Mozilla / Firefox and Thunderbird | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-7961 | Liferay Portal Deserialization of Untrusted Data Vulnerability Liferay / Liferay Portal | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8193 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability Citrix / Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8195 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability Citrix / Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8196 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability Citrix / Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8243 | Ivanti Pulse Connect Secure Code Execution Vulnerability Ivanti / Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8260 | Ivanti Pulse Connect Secure Code Execution Vulnerability Ivanti / Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8467 | Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability Trend Micro / Apex One and OfficeScan | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8468 | Trend Micro Multiple Products Content Validation Escape Vulnerability Trend Micro / Apex One, OfficeScan and Worry-Free Business Security Agents | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8515 | Multiple DrayTek Vigor Routers Web Management Page Vulnerability DrayTek / Multiple Vigor Routers | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8599 | Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability Trend Micro / Apex One and OfficeScan | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8644 | PlaySMS Server-Side Template Injection Vulnerability PlaySMS / PlaySMS | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8655 | EyesOfNetwork Improper Privilege Management Vulnerability EyesOfNetwork / EyesOfNetwork | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-8657 | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability EyesOfNetwork / EyesOfNetwork | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-9818 | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability Apple / iOS, iPadOS, and watchOS | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-9819 | Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability Apple / iOS, iPadOS, and watchOS | Nov 3, 2021 | May 3, 2022 | |
| CVE-2020-9859 | Apple Multiple Products Code Execution Vulnerability Apple / Multiple Products | Nov 3, 2021 | May 3, 2022 | |
| CVE-2021-1497 | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability Cisco / HyperFlex HX | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1498 | Cisco HyperFlex HX Data Platform Command Injection Vulnerability Cisco / HyperFlex HX | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1647 | Microsoft Defender Remote Code Execution Vulnerability Microsoft / Defender | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1675 | Microsoft Windows Print Spooler Remote Code Execution Vulnerability Microsoft / Windows | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-1732 | Microsoft Win32k Privilege Escalation Vulnerability Microsoft / Win32k | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-1782 | Apple Multiple Products Race Condition Vulnerability Apple / Multiple Products | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1870 | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability Apple / iOS, iPadOS, and macOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1871 | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability Apple / iOS, iPadOS, and macOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1879 | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability Apple / iOS, iPadOS, and watchOS | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-1905 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability Qualcomm / Multiple Chipsets | Nov 3, 2021 | May 3, 2022 | |
| CVE-2021-1906 | Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability Qualcomm / Multiple Chipsets | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-20016 | SonicWall SSLVPN SMA100 SQL Injection Vulnerability SonicWall / SSLVPN SMA100 | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-20021 | SonicWall Email Security Improper Privilege Management Vulnerability SonicWall / SonicWall Email Security | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-20022 | SonicWall Email Security Unrestricted Upload of File Vulnerability SonicWall / SonicWall Email Security | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-20023 | SonicWall Email Security Path Traversal Vulnerability SonicWall / SonicWall Email Security | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-20090 | Arcadyan Buffalo Firmware Path Traversal Vulnerability Arcadyan / Buffalo Firmware | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21017 | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability Adobe / Acrobat and Reader | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21148 | Google Chromium V8 Heap Buffer Overflow Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21166 | Google Chromium Race Condition Vulnerability Google / Chromium | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21193 | Google Chromium Blink Use-After-Free Vulnerability Google / Chromium Blink | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21206 | Google Chromium Blink Use-After-Free Vulnerability Google / Chromium Blink | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21220 | Google Chromium V8 Improper Input Validation Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21224 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Nov 3, 2021 | Nov 17, 2021 | |
| CVE-2021-21972 | VMware vCenter Server Remote Code Execution Vulnerability VMware / vCenter Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-21985 | VMware vCenter Server Improper Input Validation Vulnerability VMware / vCenter Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-22005 | VMware vCenter Server File Upload Vulnerability VMware / vCenter Server | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-22205 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability GitLab / Community and Enterprise Editions | Nov 3, 2021 | Nov 17, 2021 | Known |
| CVE-2021-22502 | Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability Micro Focus / Operation Bridge Reporter (OBR) | Nov 3, 2021 | Nov 17, 2021 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses