Threats & CVE Intelligence
Search the locally synchronized CISA known-exploited vulnerabilities catalog, or enter a CVE ID or keyword to search the broader NIST National Vulnerability Database. NVD searches are retrieved on demand and may be rate limited.
Last successful sync: 2026-11-07 18:42:25 UTC · Source catalog updated: 2026-11-06T19:44:45.1797Z · 1769 records in latest import.
CISA Known Exploited Vulnerabilities · 1769 matches
Apache Airflow's Experimental API Authentication Bypass
Apache — Airflow's Experimental API
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
CVE-2020-13671 · KEV 2022-01-18Drupal core Un-restricted Upload of File
Drupal — Drupal core
Improper sanitization in the extension file names is present in Drupal core.
CVE-2020-11978 · KEV 2022-01-18Apache Airflow Command Injection
Apache — Airflow
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
CVE-2021-36260 · KEV 2022-01-10Hikvision Improper Input Validation
Hikvision — Security cameras web server
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
CVE-2021-27860 · KEV 2022-01-10FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
FatPipe — WARP, IPVPN, and MPVPN software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
CVE-2021-22017 · KEV 2022-01-10VMware vCenter Server Improper Access Control
VMware — vCenter Server
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
CVE-2020-6572 · KEV 2022-01-10Google Chrome Media Use-After-Free Vulnerability
Google — Chrome Media
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
CVE-2019-9670 · KEV 2022-01-10Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor — Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
CVE-2019-7609 · KEV 2022-01-10Kibana Arbitrary Code Execution
Elastic — Kibana
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
CVE-2019-2725 · KEV 2022-01-10Oracle WebLogic Server, Injection
Oracle — WebLogic Server
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Ransomware use reportedCVE-2019-1579 · KEV 2022-01-10Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Palo Alto Networks — PAN-OS
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Ransomware use reportedCVE-2019-1458 · KEV 2022-01-10Microsoft Win32k Privilege Escalation Vulnerability
Microsoft — Win32k
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
Ransomware use reportedCVE-2019-10149 · KEV 2022-01-10Exim Mail Transfer Agent (MTA) Improper Input Validation
Exim — Mail Transfer Agent (MTA)
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-13383 · KEV 2022-01-10Fortinet FortiOS and FortiProxy Out-of-bounds Write
Fortinet — FortiOS and FortiProxy
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Ransomware use reportedCVE-2018-13382 · KEV 2022-01-10Fortinet FortiOS and FortiProxy Improper Authorization
Fortinet — FortiOS and FortiProxy
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Ransomware use reportedCVE-2017-1000486 · KEV 2022-01-10Primetek Primefaces Remote Code Execution Vulnerability
Primetek — Primefaces Application
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
CVE-2015-7450 · KEV 2022-01-10IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
IBM — WebSphere Application Server and Server Hypervisor Edition
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
CVE-2013-3900 · KEV 2022-01-10Microsoft WinVerifyTrust function Remote Code Execution
Microsoft — WinVerifyTrust function
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
CVE-2021-43890 · KEV 2021-12-15Microsoft Windows AppX Installer Spoofing Vulnerability
Microsoft — Windows
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
Ransomware use reportedCVE-2021-4102 · KEV 2021-12-15Google Chromium V8 Use-After-Free Vulnerability
Google — Chromium V8
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, inc…
CVE-2021-44515 · KEV 2021-12-10Zoho Desktop Central Authentication Bypass Vulnerability
Zoho — Desktop Central
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
CVE-2021-44228 · KEV 2021-12-10Apache Log4j2 Remote Code Execution Vulnerability
Apache — Log4j2
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Ransomware use reportedCVE-2021-44168 · KEV 2021-12-10Fortinet FortiOS Arbitrary File Download
Fortinet — FortiOS
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
CVE-2021-35394 · KEV 2021-12-10Realtek Jungle SDK Remote Code Execution Vulnerability
Realtek — Jungle Software Development Kit (SDK)
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
CVE-2020-8816 · KEV 2021-12-10Pi-Hole AdminLTE Remote Code Execution Vulnerability
Pi-hole — AdminLTE
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
CVE-2020-17463 · KEV 2021-12-10Fuel CMS SQL Injection Vulnerability
Fuel CMS — Fuel CMS
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVE-2019-7238 · KEV 2021-12-10Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
Sonatype — Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
CVE-2019-13272 · KEV 2021-12-10Linux Kernel Improper Privilege Management Vulnerability
Linux — Kernel
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
CVE-2019-10758 · KEV 2021-12-10MongoDB mongo-express Remote Code Execution Vulnerability
MongoDB — mongo-express
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
CVE-2019-0193 · KEV 2021-12-10Apache Solr DataImportHandler Code Injection Vulnerability
Apache — Solr
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Source: CISA KEV catalog and NIST NVD. “Known” ransomware use is a CISA catalog label, not a real-time incident alert. Always review vendor advisories for patches.