Threats & CVE Intelligence
Search the locally synchronized CISA known-exploited vulnerabilities catalog, or enter a CVE ID or keyword to search the broader NIST National Vulnerability Database. NVD searches are retrieved on demand and may be rate limited.
Last successful sync: 2026-11-07 18:42:25 UTC · Source catalog updated: 2026-11-06T19:44:45.1797Z · 1769 records in latest import.
CISA Known Exploited Vulnerabilities · 1769 matches
Microsoft Internet Explorer Privilege Escalation Vulnerability
Microsoft — Internet Explorer
Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
CVE-2014-4077 · KEV 2022-05-25Microsoft IME Japanese Privilege Escalation Vulnerability
Microsoft — Input Method Editor (IME) Japanese
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability w…
CVE-2014-3153 · KEV 2022-05-25Linux Kernel Privilege Escalation Vulnerability
Linux — Kernel
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
CVE-2014-2817 · KEV 2022-05-25Microsoft Internet Explorer Privilege Escalation Vulnerability
Microsoft — Internet Explorer
Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
CVE-2014-0546 · KEV 2022-05-25Adobe Reader and Acrobat Sandbox Bypass Vulnerability
Adobe — Reader and Acrobat
Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.
CVE-2013-7331 · KEV 2022-05-25Microsoft Internet Explorer Information Disclosure Vulnerability
Microsoft — Internet Explorer
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
CVE-2013-3993 · KEV 2022-05-25IBM InfoSphere BigInsights Invalid Input Vulnerability
IBM — InfoSphere BigInsights
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
Ransomware use reportedCVE-2013-3896 · KEV 2022-05-25Microsoft Silverlight Information Disclosure Vulnerability
Microsoft — Silverlight
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
CVE-2013-2423 · KEV 2022-05-25Oracle JRE Unspecified Vulnerability
Oracle — Java Runtime Environment (JRE)
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
CVE-2013-0431 · KEV 2022-05-25Oracle JRE Sandbox Bypass Vulnerability
Oracle — Java Runtime Environment (JRE)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
Ransomware use reportedCVE-2013-0422 · KEV 2022-05-25Oracle JRE Remote Code Execution Vulnerability
Oracle — Java Runtime Environment (JRE)
A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
Ransomware use reportedCVE-2013-0074 · KEV 2022-05-25Microsoft Silverlight Double Dereference Vulnerability
Microsoft — Silverlight
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
Ransomware use reportedCVE-2012-1710 · KEV 2022-05-25Oracle Fusion Middleware Unspecified Vulnerability
Oracle — Fusion Middleware
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
Ransomware use reportedCVE-2010-1428 · KEV 2022-05-25Red Hat JBoss Information Disclosure Vulnerability
Red Hat — JBoss
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw t…
Ransomware use reportedCVE-2010-0840 · KEV 2022-05-25Oracle JRE Unspecified Vulnerability
Oracle — Java Runtime Environment (JRE)
Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
CVE-2010-0738 · KEV 2022-05-25Red Hat JBoss Authentication Bypass Vulnerability
Red Hat — JBoss
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using…
Ransomware use reportedCVE-2018-8611 · KEV 2022-05-24Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft — Windows
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
CVE-2018-19953 · KEV 2022-05-24QNAP NAS File Station Cross-Site Scripting Vulnerability
QNAP — Network Attached Storage (NAS)
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Ransomware use reportedCVE-2018-19949 · KEV 2022-05-24QNAP NAS File Station Command Injection Vulnerability
QNAP — Network Attached Storage (NAS)
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
Ransomware use reportedCVE-2018-19943 · KEV 2022-05-24QNAP NAS File Station Cross-Site Scripting Vulnerability
QNAP — Network Attached Storage (NAS)
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Ransomware use reportedCVE-2017-8543 · KEV 2022-05-24Microsoft Windows Search Remote Code Execution Vulnerability
Microsoft — Windows
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
CVE-2017-8291 · KEV 2022-05-24Artifex Ghostscript Type Confusion Vulnerability
Artifex — Ghostscript
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
CVE-2017-18362 · KEV 2022-05-24Kaseya VSA SQL Injection Vulnerability
Kaseya — Virtual System/Server Administrator (VSA)
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
Ransomware use reportedCVE-2017-0210 · KEV 2022-05-24Microsoft Internet Explorer Privilege Escalation Vulnerability
Microsoft — Internet Explorer
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
CVE-2017-0149 · KEV 2022-05-24Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft — Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
CVE-2017-0147 · KEV 2022-05-24Microsoft Windows SMBv1 Information Disclosure Vulnerability
Microsoft — SMBv1 server
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
Ransomware use reportedCVE-2017-0022 · KEV 2022-05-24Microsoft XML Core Services Information Disclosure Vulnerability
Microsoft — XML Core Services
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
CVE-2017-0005 · KEV 2022-05-24Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
Microsoft — Windows
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
CVE-2016-6367 · KEV 2022-05-24Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Cisco — Adaptive Security Appliance (ASA)
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
CVE-2016-6366 · KEV 2022-05-24Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
Cisco — Adaptive Security Appliance (ASA)
A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
Source: CISA KEV catalog and NIST NVD. “Known” ransomware use is a CISA catalog label, not a real-time incident alert. Always review vendor advisories for patches.