CISA Known Exploited Vulnerabilities
1,779 vulnerabilities confirmed exploited in the wild. 114 were added in the last 90 days, of which 100 are past their federal remediation deadline. 361 are linked to ransomware campaigns.
Source: CISA KEV · synced 11 Nov 2026, 12:26 · nothing on this page is our own assessment
Oracle Multiple Products Oracle Multiple Products Remote Code Execution Vulnerability
CVE-2020-2555
Past due
Oracle Fusion Middleware Oracle Fusion Middleware Unspecified Vulnerability
CVE-2012-3152
Past due
Oracle Solaris and Zettabyte File System (ZFS) Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
CVE-2020-14871
Past due
Oracle WebLogic Server Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
CVE-2015-4852
Past due
Oracle WebLogic Server Oracle WebLogic Server Remote Code Execution Vulnerability
CVE-2020-14750
Past due
Oracle WebLogic Server Oracle WebLogic Server Remote Code Execution Vulnerability
CVE-2020-14882
Past due
Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability
CVE-2020-14883
Past due
PlaySMS PlaySMS PlaySMS Server-Side Template Injection Vulnerability
CVE-2020-8644
Past due
Progress Telerik UI for ASP.NET AJAX Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
CVE-2019-18935
Ransomware
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Use-After-Free Vulnerability
CVE-2021-22893
Ransomware
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Code Execution Vulnerability
CVE-2020-8243
Past due
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
CVE-2021-22900
Past due
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
CVE-2021-22894
Past due
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Code Execution Vulnerability
CVE-2020-8260
Past due
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Command Injection Vulnerability
CVE-2021-22899
Past due
Ivanti Pulse Connect Secure Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
CVE-2019-11510
Ransomware
Ivanti Pulse Connect Secure and Pulse Policy Secure Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
CVE-2019-11539
Ransomware
Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
CVE-2021-1906
Past due
Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Use-After-Free Vulnerability
CVE-2021-1905
Past due
rConfig rConfig rConfig OS Command Injection Vulnerability
CVE-2020-10221
Past due
Realtek AP-Router SDK Realtek AP-Router SDK Buffer Overflow Vulnerability
CVE-2021-35395
Past due
Roundcube Roundcube Webmail Roundcube Webmail File Disclosure Vulnerability
CVE-2017-16651
Past due
SaltStack Salt SaltStack Salt Path Traversal Vulnerability
CVE-2020-11652
Past due
SaltStack Salt SaltStack Salt Authentication Bypass Vulnerability
CVE-2020-11651
Past due
SaltStack Salt SaltStack Salt Shell Injection Vulnerability
CVE-2020-16846
Past due
SAP Customer Relationship Management (CRM) SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
CVE-2018-2380
Ransomware
SAP NetWeaver SAP NetWeaver Remote Code Execution Vulnerability
CVE-2010-5326
Past due
SAP NetWeaver SAP NetWeaver XML External Entity (XXE) Vulnerability
CVE-2016-9563
Past due
SAP NetWeaver SAP NetWeaver Missing Authentication for Critical Function Vulnerability
CVE-2020-6287
Past due
SAP Solution Manager SAP Solution Manager Missing Authentication for Critical Function Vulnerability
CVE-2020-6207
Past due
SAP NetWeaver SAP NetWeaver Directory Traversal Vulnerability
CVE-2016-3976
Past due
SIMalliance Toolbox Browser SIMalliance Toolbox Browser Command Injection Vulnerability
CVE-2019-16256
Past due
SolarWinds Orion SolarWinds Orion Authentication Bypass Vulnerability
CVE-2020-10148
Past due
SolarWinds Serv-U SolarWinds Serv-U Remote Code Execution Vulnerability
CVE-2021-35211
Ransomware
SolarWinds Virtualization Manager SolarWinds Virtualization Manager Privilege Escalation Vulnerability
CVE-2016-3643
Past due
Sonatype Nexus Repository Sonatype Nexus Repository Remote Code Execution Vulnerability
CVE-2020-10199
Past due
SonicWall SonicWall Email Security SonicWall Email Security Improper Privilege Management Vulnerability
CVE-2021-20021
Ransomware
SonicWall SMA100 SonicWall SMA100 SQL Injection Vulnerability
CVE-2019-7481
Ransomware
SonicWall SonicWall Email Security SonicWall Email Security Unrestricted Upload of File Vulnerability
CVE-2021-20022
Ransomware
SonicWall SonicWall Email Security SonicWall Email Security Path Traversal Vulnerability
CVE-2021-20023
Ransomware
SonicWall SSLVPN SMA100 SonicWall SSLVPN SMA100 SQL Injection Vulnerability
CVE-2021-20016
Ransomware
Sophos SFOS Sophos SFOS SQL Injection Vulnerability
CVE-2020-12271
Ransomware
Sumavision Enhanced Multimedia Router (EMR) Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability
CVE-2020-10181
Past due
Symantec Symantec Messaging Gateway Symantec Messaging Gateway Remote Code Execution Vulnerability
CVE-2017-6327
Past due
TeamViewer Desktop TeamViewer Desktop Bypass Remote Login Vulnerability
CVE-2019-18988
Past due
Progress ASP.NET AJAX and Sitefinity Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
CVE-2017-9248
Past due
Tenda AC11 Router Tenda AC11 Router Stack Buffer Overflow Vulnerability
CVE-2021-31755
Past due
Tenda AC1900 Router AC15 Model Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
CVE-2020-10987
Past due
Tenda AC7, AC9, and AC10 Routers Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
CVE-2018-14558
Past due
ThinkPHP noneCms ThinkPHP "noneCms" Remote Code Execution Vulnerability
CVE-2018-20062
Past due