CISA Known Exploited Vulnerabilities
KEV additions — December 2021
17 CVEs entered the KEV catalog in December 2021.
Added December 15, 20212
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-4102 | Google Chromium V8 Use-After-Free Vulnerability | 8.8 | 5.5 % | December 29, 2021 |
| CVE-2021-43890ransomware | Microsoft Windows AppX Installer Spoofing Vulnerability | 7.1 | 19.6 % | December 29, 2021 |
Added December 10, 202110
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-0193 | Apache Solr DataImportHandler Code Injection Vulnerability | 7.2 | 93.2 % | June 10, 2022 |
| CVE-2019-10758 | MongoDB mongo-express Remote Code Execution Vulnerability | 9.9 | 94.4 % | June 10, 2022 |
| CVE-2019-13272 | Linux Kernel Improper Privilege Management Vulnerability | 7.8 | 81.3 % | June 10, 2022 |
| CVE-2019-7238 | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | 9.8 | 94.4 % | June 10, 2022 |
| CVE-2020-17463 | Fuel CMS SQL Injection Vulnerability | 9.8 | 15.3 % | June 10, 2022 |
| CVE-2020-8816 | Pi-Hole AdminLTE Remote Code Execution Vulnerability | 7.2 | 90.8 % | June 10, 2022 |
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | 9.8 | 94.2 % | December 24, 2021 |
| CVE-2021-44168 | Fortinet FortiOS Arbitrary File Download | 7.8 | 1.4 % | December 24, 2021 |
| CVE-2021-44228ransomware | Apache Log4j2 Remote Code Execution Vulnerability | 10 | 94.4 % | December 24, 2021 |
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | 9.8 | 94.4 % | December 24, 2021 |
Added December 1, 20215
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-14847 | MikroTik Router OS Directory Traversal Vulnerability | 9.1 | 93.6 % | June 1, 2022 |
| CVE-2020-11261 | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | 7.8 | 1.1 % | June 1, 2022 |
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | 9.8 | 92.0 % | December 15, 2021 |
| CVE-2021-40438 | Apache HTTP Server-Side Request Forgery (SSRF) | 9 | 94.4 % | December 15, 2021 |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | 9.8 | 94.3 % | December 15, 2021 |