Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being exploited, newest additions first — with the remediation deadline federal agencies must meet.
| Score | CVE | Affected | EPSS | Added to KEV |
|---|---|---|---|---|
| 7.8 high | CVE-2022-24521 KEV | Microsoft Windows 10 Version 1809 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 7.1% | 13 Apr 2022 |
| 9.8 critical | CVE-2018-20753 KEV | kaseya virtual system administrator Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild. | 30% | 13 Apr 2022 |
| 9.8 critical | CVE-2018-7602 KEV | Drupal core A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. | 99% | 13 Apr 2022 |
| 8.8 high | CVE-2015-2502 KEV | microsoft internet explorer Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015. | 51% | 13 Apr 2022 |
| 9.8 critical | CVE-2015-5123 KEV | redhat enterprise linux desktop Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015. | 19% | 13 Apr 2022 |
| 9.8 critical | CVE-2015-5122 KEV | adobe flash player Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015. | 94% | 13 Apr 2022 |
| 9.8 critical | CVE-2015-3113 KEV | adobe flash player Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015. | >99% | 13 Apr 2022 |
| 9.8 critical | CVE-2015-0313 KEV | adobe flash player Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322. | 95% | 13 Apr 2022 |
| 9.8 critical | CVE-2015-0311 KEV | adobe flash player Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015. | 86% | 13 Apr 2022 |
| 7.8 high | CVE-2014-9163 KEV | adobe flash player Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014. | 21% | 13 Apr 2022 |
| 7.8 high | CVE-2021-39793 KEV | Android In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A | 0.69% | 11 Apr 2022 |
| 8.8 high | CVE-2022-23176 KEV | watchguard fireware WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3. | 11% | 11 Apr 2022 |
| 7.0 high | CVE-2021-22600 KEV | Linux Kernel Kernel A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 | 6.6% | 11 Apr 2022 |
| 7.5 high | CVE-2021-42287 KEV | Microsoft Windows Server 2008 R2 Service Pack 1 Active Directory Domain Services Elevation of Privilege Vulnerability | 77% | 11 Apr 2022 |
| 7.5 high | CVE-2021-42278 KEV | Microsoft Windows Server 2008 R2 Service Pack 1 Active Directory Domain Services Elevation of Privilege Vulnerability | 73% | 11 Apr 2022 |
| 9.8 critical | CVE-2021-27852 KEV | Checkbox Survey Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7. | 30% | 11 Apr 2022 |
| 9.8 critical | CVE-2020-2509 KEV | QNAP Systems Inc. QTS A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later | 34% | 11 Apr 2022 |
| 9.8 critical | CVE-2017-11317 KEV | telerik ui for asp.net ajax Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code. | 84% | 11 Apr 2022 |
| 9.8 critical | CVE-2021-31166 KEV | Microsoft Windows 10 Version 2004 HTTP Protocol Stack Remote Code Execution Vulnerability | >99% | 6 Apr 2022 |
| 7.8 high | CVE-2021-3156 KEV | sudo project sudo Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | >99% | 6 Apr 2022 |