CISA KEV · exploited vulnerabilities

InformationCISA KEV · updated 3h ago

Known Exploited Vulnerabilities from CISA, cross-referenced against ingested MENA cases. “MENA-relevant” means a CVE surfaced in a tracked case — not the full undifferentiated catalog. Each carries a remediation priority (P1–P3) so it's clear which to patch first, and why. For direct SIEM/SOAR ingestion, the same data is available as a machine-readable JSON feed →.

Sort

MENA-RELEVANT FULL CATALOG

50 of ~1,722

Comfortable Compact

CVECVE-2018-8174

Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

Microsoft · Windowsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-15due 2022-08-15

⋮

CVECVE-2019-0752

Microsoft Internet Explorer Type Confusion Vulnerability

Microsoft · Internet Explorerremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-15due 2022-08-15

⋮

CVECVE-2022-0609

Google Chromium Animation Use-After-Free Vulnerability

Google · Chromium Animationremediation: past CISA due date

P2added 2022-02-15due 2022-03-01

⋮

CVECVE-2022-24086

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe · Commerce and Magento Open Sourceremediation: past CISA due date

ATT&CKT1190exploitation T1213secondary impact T1027primary impact

P2added 2022-02-15due 2022-03-01

⋮

CVECVE-2022-22620

Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Apple · iOS, iPadOS, and macOSremediation: past CISA due date

P2added 2022-02-11due 2022-02-25

⋮

CVECVE-2014-4404

Apple OS X Heap-Based Buffer Overflow Vulnerability

Apple · OS Xremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2015-1130

Apple OS X Authentication Bypass Vulnerability

Apple · OS Xremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2015-1635

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft · HTTP.sysremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2015-2051

D-Link DIR-645 Router Remote Code Execution Vulnerability

D-Link · DIR-645 Routerremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2016-3088

Apache ActiveMQ Improper Input Validation Vulnerability

Apache · ActiveMQremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-0144

Microsoft SMBv1 Remote Code Execution Vulnerability

Microsoft · SMBv1remediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-0145

Microsoft SMBv1 Remote Code Execution Vulnerability

Microsoft · SMBv1remediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-0262

Microsoft Office Remote Code Execution Vulnerability

Microsoft · Officeremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-0263

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32kremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-10271

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Serverremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-8464

Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Microsoft · Windowsremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2017-9791

Apache Struts 1 Improper Input Validation Vulnerability

Apache · Struts 1remediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2018-1000861

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Jenkins · Jenkins Stapler Web Frameworkremediation: past CISA due date

P2added 2022-02-10due 2022-08-10

⋮

CVECVE-2020-0796

Microsoft SMBv3 Remote Code Execution Vulnerability

Microsoft · SMBv3remediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-10due 2022-08-10

⋮

CVECVE-2021-36934

Microsoft Windows SAM Local Privilege Escalation Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1078exploitation T1068primary impact

P2added 2022-02-10due 2022-02-24

⋮

CVECVE-2022-21882

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32kremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-02-04due 2022-02-18

⋮

CVECVE-2014-1776

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft · Internet Explorerremediation: past CISA due date

P2added 2022-01-28due 2022-07-28

⋮

CVECVE-2014-6271

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash)remediation: past CISA due date

ATT&CKT1190exploitation T1133exploitation T1059.004primary impact

P2added 2022-01-28due 2022-07-28

⋮

CVECVE-2014-7169

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash)remediation: past CISA due date

ATT&CKT1190exploitation T1133exploitation T1059.004primary impact

P2added 2022-01-28due 2022-07-28

⋮

CVECVE-2017-5689

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability

Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageabilityremediation: past CISA due date

P2added 2022-01-28due 2022-07-28

⋮

CVECVE-2020-0787

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

Microsoft · Windowsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1059primary impact T1068exploitation

P1added 2022-01-28due 2022-07-28

⋮

CVECVE-2020-5722

Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Grandstream · UCM6200remediation: past CISA due date

P2added 2022-01-28due 2022-07-28

⋮

CVECVE-2021-20038

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

SonicWall · SMA 100 Appliancesremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-01-28due 2022-02-11

⋮

CVECVE-2022-22587

Apple Memory Corruption Vulnerability

Apple · iOS and macOSremediation: past CISA due date

P2added 2022-01-28due 2022-02-11

⋮

CVECVE-2006-1547

Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Apache · Struts 1remediation: past CISA due date

P2added 2022-01-21due 2022-07-21

⋮

CVECVE-2012-0391

Apache Struts 2 Improper Input Validation Vulnerability

Apache · Struts 2remediation: past CISA due date

P2added 2022-01-21due 2022-07-21

⋮

CVECVE-2018-8453

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32kremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-01-21due 2022-07-21

⋮

CVECVE-2021-35247

SolarWinds Serv-U Improper Input Validation Vulnerability

SolarWinds · Serv-Uremediation: past CISA due date

P2added 2022-01-21due 2022-02-04

⋮

CVECVE-2020-11978

Apache Airflow Command Injection

Apache · Airflowremediation: past CISA due date

P2added 2022-01-18due 2022-07-18

⋮

CVECVE-2020-13671

Drupal core Un-restricted Upload of File

Drupal · Drupal coreremediation: past CISA due date

P2added 2022-01-18due 2022-07-18

⋮

CVECVE-2020-13927

Apache Airflow's Experimental API Authentication Bypass

Apache · Airflow's Experimental APIremediation: past CISA due date

P2added 2022-01-18due 2022-07-18

⋮

CVECVE-2020-14864

Oracle Business Intelligence Enterprise Edition Path Transversal

Oracle · Intelligence Enterprise Editionremediation: past CISA due date

P2added 2022-01-18due 2022-07-18

⋮

CVECVE-2021-21315

System Information Library for Node.JS Command Injection

Npm package · System Information Library for Node.JSremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-21975

VMware Server Side Request Forgery in vRealize Operations Manager API

VMware · vRealize Operations Manager APIremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation

P1added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-22991

F5 BIG-IP Traffic Management Microkernel Buffer Overflow

F5 · BIG-IP Traffic Management Microkernelremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-25296

Nagios XI OS Command Injection

Nagios · Nagios XIremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-25297

Nagios XI OS Command Injection

Nagios · Nagios XIremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-25298

Nagios XI OS Command Injection

Nagios · Nagios XIremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-32648

October CMS Improper Authentication

October CMS · October CMSremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-33766

Microsoft Exchange Server Information Disclosure

Microsoft · Exchange Serverremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2021-40870

Aviatrix Controller Unrestricted Upload of File

Aviatrix · Aviatrix Controllerremediation: past CISA due date

P2added 2022-01-18due 2022-02-01

⋮

CVECVE-2013-3900

Microsoft WinVerifyTrust function Remote Code Execution

Microsoft · WinVerifyTrust functionremediation: past CISA due date

P2added 2022-01-10due 2022-07-10

⋮

CVECVE-2015-7450

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

IBM · WebSphere Application Server and Server Hypervisor Editionremediation: past CISA due date

P2added 2022-01-10due 2022-07-10

⋮

CVECVE-2017-1000486

Primetek Primefaces Remote Code Execution Vulnerability

Primetek · Primefaces Applicationremediation: past CISA due date

P2added 2022-01-10due 2022-07-10

⋮

CVECVE-2018-13382

Fortinet FortiOS and FortiProxy Improper Authorization

Fortinet · FortiOS and FortiProxyremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2022-01-10due 2022-07-10

⋮

1,351–1,400 of ~1,722

← Prev Next →