CISA Known Exploited Vulnerabilities
KEV additions — March 2022
94 CVEs entered the KEV catalog in March 2022.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added March 31, 20227
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-10561 | Dasan GPON Routers Authentication Bypass Vulnerability | 9.8 | 92.8 % | Apr 21, 2022 |
| CVE-2018-10562ransomware | Dasan GPON Routers Command Injection Vulnerability | 9.8 | 99.9 % | Apr 21, 2022 |
| CVE-2021-21551 | Dell dbutil Driver Insufficient Access Control Vulnerability | 7.8 | 80.1 % | Apr 21, 2022 |
| CVE-2021-28799ransomware | QNAP NAS Improper Authorization Vulnerability | 9.8 | 78.3 % | Apr 21, 2022 |
| CVE-2021-34484 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7.8 | 21.8 % | Apr 21, 2022 |
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | 9.8 | 99.8 % | Apr 21, 2022 |
| CVE-2022-26871 | Trend Micro Apex Central Arbitrary File Upload Vulnerability | 9.8 | 19.5 % | Apr 21, 2022 |
Added March 28, 202210
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-8405ransomware | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 7.8 | 3.4 % | Apr 18, 2022 |
| CVE-2018-8406ransomware | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 7.8 | 3.4 % | Apr 18, 2022 |
| CVE-2018-8440ransomware | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 18.4 % | Apr 18, 2022 |
| CVE-2019-7483 | SonicWall SMA100 Directory Traversal Vulnerability | 7.5 | 4.0 % | Apr 18, 2022 |
| CVE-2021-20028ransomware | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | 9.8 | 30.1 % | Apr 18, 2022 |
| CVE-2021-26085ransomware | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | 5.3 | 99.9 % | Apr 18, 2022 |
| CVE-2021-34486 | Microsoft Windows Event Tracing Privilege Escalation Vulnerability | 7.8 | 9.3 % | Apr 18, 2022 |
| CVE-2021-38646ransomware | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | 7.8 | 8.0 % | Apr 18, 2022 |
| CVE-2022-0543 | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | 10 | 99.4 % | Apr 18, 2022 |
| CVE-2022-1096 | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 24.7 % | Apr 18, 2022 |
Added March 25, 202232
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2016-11021 | D-Link DCS-930L Devices OS Command Injection Vulnerability | 7.2 | 68.9 % | Apr 15, 2022 |
| CVE-2017-12617 | Apache Tomcat Remote Code Execution Vulnerability | 8.1 | 100.0 % | Apr 15, 2022 |
| CVE-2018-11138ransomware | Quest KACE System Management Appliance Remote Command Execution Vulnerability | 9.8 | 91.7 % | Apr 15, 2022 |
| CVE-2018-1273ransomware | VMware Tanzu Spring Data Commons Property Binder Vulnerability | 9.8 | 97.0 % | Apr 15, 2022 |
| CVE-2018-14839 | LG N1A1 NAS Remote Command Execution Vulnerability | 9.8 | 89.4 % | Apr 15, 2022 |
| CVE-2018-6961 | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 8.1 | 85.3 % | Apr 15, 2022 |
| CVE-2018-8373 | Microsoft Scripting Engine Memory Corruption Vulnerability | 7.5 | 61.9 % | Apr 15, 2022 |
| CVE-2018-8414 | Microsoft Windows Shell Remote Code Execution Vulnerability | 8.8 | 72.9 % | Apr 15, 2022 |
| CVE-2019-0903 | Microsoft GDI Remote Code Execution Vulnerability | 8.8 | 21.7 % | Apr 15, 2022 |
| CVE-2019-1003030 | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability | 9.9 | 97.1 % | Apr 15, 2022 |
| CVE-2019-10068 | Kentico Xperience Deserialization of Untrusted Data Vulnerability | 9.8 | 95.1 % | Apr 15, 2022 |
| CVE-2019-11043ransomware | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability | 9.8 | 99.7 % | Apr 15, 2022 |
| CVE-2019-12989 | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | 9.8 | 94.9 % | Apr 15, 2022 |
| CVE-2019-12991 | Citrix SD-WAN and NetScaler Command Injection Vulnerability | 8.8 | 74.5 % | Apr 15, 2022 |
| CVE-2019-15107 | Webmin Command Injection Vulnerability | 9.8 | 99.7 % | Apr 15, 2022 |
| CVE-2019-16920 | D-Link Multiple Routers Command Injection Vulnerability | 9.8 | 100.0 % | Apr 15, 2022 |
| CVE-2019-2616 | Oracle BI Publisher Unauthorized Access Vulnerability | 7.2 | 92.2 % | Apr 15, 2022 |
| CVE-2019-6340 | Drupal Core Remote Code Execution Vulnerability | 8.1 | 92.0 % | Apr 15, 2022 |
| CVE-2020-1631 | Juniper Junos OS Path Traversal Vulnerability | 9.8 | 4.9 % | Apr 15, 2022 |
| CVE-2020-1956 | Apache Kylin OS Command Injection Vulnerability | 8.8 | 97.3 % | Apr 15, 2022 |
| CVE-2020-2021ransomware | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 10 | 4.4 % | Apr 15, 2022 |
| CVE-2020-2506 | QNAP Helpdesk Improper Access Control Vulnerability | 9.8 | 2.0 % | Apr 15, 2022 |
| CVE-2020-25223 | Sophos SG UTM Remote Code Execution Vulnerability | 9.8 | 96.8 % | Apr 15, 2022 |
| CVE-2020-5410 | VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability | 7.5 | 95.6 % | Apr 15, 2022 |
| CVE-2020-7247 | OpenSMTPD Remote Code Execution Vulnerability | 9.8 | 99.0 % | Apr 15, 2022 |
| CVE-2020-9054 | Zyxel Multiple NAS Devices OS Command Injection Vulnerability | 9.8 | 100.0 % | Apr 15, 2022 |
| CVE-2020-9377 | D-Link DIR-610 Devices Remote Command Execution | 8.8 | 21.3 % | Apr 15, 2022 |
| CVE-2021-22941ransomware | Citrix ShareFile Improper Access Control Vulnerability | 9.8 | 53.6 % | Apr 15, 2022 |
| CVE-2021-42237ransomware | Sitecore XP Remote Command Execution Vulnerability | 9.8 | 97.6 % | Apr 15, 2022 |
| CVE-2022-21999ransomware | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 | 41.0 % | Apr 15, 2022 |
| CVE-2022-26143 | MiCollab, MiVoice Business Express Access Control Vulnerability | 9.8 | 87.3 % | Apr 15, 2022 |
| CVE-2022-26318 | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | 9.8 | 78.2 % | Apr 15, 2022 |
Added March 15, 202212
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-8120ransomware | Microsoft Win32k Privilege Escalation Vulnerability | 7 | 73.3 % | Apr 5, 2022 |
| CVE-2019-0543ransomware | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 4.7 % | Apr 5, 2022 |
| CVE-2019-0841ransomware | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 | 41.4 % | Apr 5, 2022 |
| CVE-2019-1064ransomware | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 | 6.9 % | Apr 5, 2022 |
| CVE-2019-1069ransomware | Microsoft Task Scheduler Privilege Escalation Vulnerability | 7.8 | 6.1 % | Apr 5, 2022 |
| CVE-2019-1129ransomware | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 | 1.8 % | Apr 5, 2022 |
| CVE-2019-1132 | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 | 9.9 % | Apr 5, 2022 |
| CVE-2019-1253ransomware | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | 7.8 | 11.6 % | Apr 5, 2022 |
| CVE-2019-1315ransomware | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | 7.8 | 3.5 % | Apr 5, 2022 |
| CVE-2019-1322ransomware | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 19.2 % | Apr 5, 2022 |
| CVE-2019-1405ransomware | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability | 7.8 | 30.2 % | Apr 5, 2022 |
| CVE-2020-5135 | SonicWall SonicOS Buffer Overflow Vulnerability | 9.8 | 26.9 % | Apr 5, 2022 |
Added March 7, 20225
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-11581 | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability | 9.8 | 84.6 % | Sep 7, 2022 |
| CVE-2020-8218 | Pulse Connect Secure Code Injection Vulnerability | 7.2 | 32.3 % | Sep 7, 2022 |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 5.3 | 88.0 % | Mar 21, 2022 |
| CVE-2022-26485 | Mozilla Firefox Use-After-Free Vulnerability | 8.8 | 14.3 % | Mar 21, 2022 |
| CVE-2022-26486 | Mozilla Firefox Use-After-Free Vulnerability | 9.6 | 2.4 % | Mar 21, 2022 |
Added March 3, 202228
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2017-12319 | Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | 5.9 | 5.2 % | Mar 24, 2022 |
| CVE-2018-0151 | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability | 9.8 | 14.2 % | Mar 17, 2022 |
| CVE-2018-0154 | Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | 7.5 | 7.1 % | Mar 17, 2022 |
| CVE-2018-0155 | Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability | 8.6 | 7.7 % | Mar 17, 2022 |
| CVE-2018-0156 | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability | 7.5 | 9.4 % | Mar 17, 2022 |
| CVE-2018-0158 | Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability | 8.6 | 7.2 % | Mar 17, 2022 |
| CVE-2018-0159 | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | 7.5 | 6.9 % | Mar 17, 2022 |
| CVE-2018-0161 | Cisco IOS Software Resource Management Errors Vulnerability | 6.3 | 4.1 % | Mar 17, 2022 |
| CVE-2018-0167 | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 8.8 | 3.4 % | Mar 17, 2022 |
| CVE-2018-0172 | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 8.6 | 7.8 % | Mar 17, 2022 |
| CVE-2018-0173 | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 8.6 | 7.6 % | Mar 17, 2022 |
| CVE-2018-0174 | Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability | 8.6 | 7.6 % | Mar 17, 2022 |
| CVE-2018-0175 | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 8 | 3.5 % | Mar 17, 2022 |
| CVE-2018-0179 | Cisco IOS Software Denial-of-Service Vulnerability | 5.9 | 4.9 % | Mar 17, 2022 |
| CVE-2018-0180 | Cisco IOS Software Denial-of-Service Vulnerability | 5.9 | 4.9 % | Mar 17, 2022 |
| CVE-2018-8298 | ChakraCore Scripting Engine Type Confusion Vulnerability | 7.5 | 74.7 % | Mar 17, 2022 |
| CVE-2018-8581ransomware | Microsoft Exchange Server Privilege Escalation Vulnerability | 7.4 | 27.4 % | Mar 17, 2022 |
| CVE-2019-1297 | Microsoft Excel Remote Code Execution Vulnerability | 8.8 | 21.8 % | Mar 17, 2022 |
| CVE-2019-1652 | Cisco Small Business Routers Improper Input Validation Vulnerability | 7.2 | 95.9 % | Mar 17, 2022 |
| CVE-2019-16928 | Exim Out-of-bounds Write Vulnerability | 9.8 | 41.6 % | Mar 17, 2022 |
| CVE-2020-11899 | Treck TCP/IP stack Out-of-Bounds Read Vulnerability | 5.4 | 18.4 % | Mar 17, 2022 |
| CVE-2020-1938 | Apache Tomcat Improper Privilege Management Vulnerability | 9.8 | 99.3 % | Mar 17, 2022 |
| CVE-2021-41379ransomware | Microsoft Windows Installer Privilege Escalation Vulnerability | 5.5 | 19.5 % | Mar 17, 2022 |
| CVE-2022-20699 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 9.8 | 72.5 % | Mar 17, 2022 |
| CVE-2022-20700 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 9.8 | 5.7 % | Mar 17, 2022 |
| CVE-2022-20701 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 7.8 | 9.7 % | Mar 17, 2022 |
| CVE-2022-20703 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 8 | 9.2 % | Mar 17, 2022 |
| CVE-2022-20708 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 8 | 14.9 % | Mar 17, 2022 |