Verified source records · CISA Known Exploited Vulnerabilities

Threats & CVE Intelligence

Search the locally synchronized CISA known-exploited vulnerabilities catalog, or enter a CVE ID or keyword to search the broader NIST National Vulnerability Database. NVD searches are retrieved on demand and may be rate limited.

Last successful sync: 2026-11-07 22:40:39 UTC · Source catalog updated: 2026-11-06T19:44:45.1797Z · 1769 records in latest import.

CISA Known Exploited Vulnerabilities · 1769 matches

CVE-2021-22506 · KEV 2021-11-03

Micro Focus Access Manager Information Leakage Vulnerability

Micro Focus — Micro Focus Access Manager

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

CVE-2021-22502 · KEV 2021-11-03

Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Micro Focus — Operation Bridge Reporter (OBR)

Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-22205 · KEV 2021-11-03

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

GitLab — Community and Enterprise Editions

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the ima…

Ransomware use reported CVE-2021-22005 · KEV 2021-11-03

VMware vCenter Server File Upload Vulnerability

VMware — vCenter Server

VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.

Ransomware use reported CVE-2021-21985 · KEV 2021-11-03

VMware vCenter Server Improper Input Validation Vulnerability

VMware — vCenter Server

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

Ransomware use reported CVE-2021-21972 · KEV 2021-11-03

VMware vCenter Server Remote Code Execution Vulnerability

VMware — vCenter Server

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying opera…

Ransomware use reported CVE-2021-21224 · KEV 2021-11-03

Google Chromium V8 Type Confusion Vulnerability

Google — Chromium V8

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including…

CVE-2021-21220 · KEV 2021-11-03

Google Chromium V8 Improper Input Validation Vulnerability

Google — Chromium V8

Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize C…

CVE-2021-21206 · KEV 2021-11-03

Google Chromium Blink Use-After-Free Vulnerability

Google — Chromium Blink

Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, includi…

CVE-2021-21193 · KEV 2021-11-03

Google Chromium Blink Use-After-Free Vulnerability

Google — Chromium Blink

CVE-2021-21166 · KEV 2021-11-03

Google Chromium Race Condition Vulnerability

Google — Chromium

Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, bu…

CVE-2021-21148 · KEV 2021-11-03

Google Chromium V8 Heap Buffer Overflow Vulnerability

Google — Chromium V8

Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromiu…

CVE-2021-21017 · KEV 2021-11-03

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Adobe — Acrobat and Reader

Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

CVE-2021-20090 · KEV 2021-11-03

Arcadyan Buffalo Firmware Path Traversal Vulnerability

Arcadyan — Buffalo Firmware

Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several diffe…

CVE-2021-20023 · KEV 2021-11-03

SonicWall Email Security Path Traversal Vulnerability

SonicWall — SonicWall Email Security

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-…

Ransomware use reported CVE-2021-20022 · KEV 2021-11-03

SonicWall Email Security Unrestricted Upload of File Vulnerability

SonicWall — SonicWall Email Security

SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Securi…

Ransomware use reported CVE-2021-20021 · KEV 2021-11-03

SonicWall Email Security Improper Privilege Management Vulnerability

SonicWall — SonicWall Email Security

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a Sonic…

Ransomware use reported CVE-2021-20016 · KEV 2021-11-03

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

SonicWall — SSLVPN SMA100

SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

Ransomware use reported CVE-2021-1906 · KEV 2021-11-03

Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

Qualcomm — Multiple Chipsets

Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.

CVE-2021-1905 · KEV 2021-11-03

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Qualcomm — Multiple Chipsets

Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.

CVE-2021-1879 · KEV 2021-11-03

Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

Apple — iOS, iPadOS, and watchOS

Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, i…

CVE-2021-1871 · KEV 2021-11-03

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Apple — iOS, iPadOS, and macOS

Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Ap…

CVE-2021-1870 · KEV 2021-11-03

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Apple — iOS, iPadOS, and macOS

CVE-2021-1782 · KEV 2021-11-03

Apple Multiple Products Race Condition Vulnerability

Apple — Multiple Products

Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.

CVE-2021-1732 · KEV 2021-11-03

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft — Win32k

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Ransomware use reported CVE-2021-1675 · KEV 2021-11-03

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft — Windows

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.

Ransomware use reported CVE-2021-1647 · KEV 2021-11-03

Microsoft Defender Remote Code Execution Vulnerability

Microsoft — Defender

Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-1498 · KEV 2021-11-03

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco — HyperFlex HX

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

CVE-2021-1497 · KEV 2021-11-03

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Cisco — HyperFlex HX

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

CVE-2020-9859 · KEV 2021-11-03

Apple Multiple Products Code Execution Vulnerability

Apple — Multiple Products

Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.

Previous Next

Source: CISA KEV catalog and NIST NVD. “Known” ransomware use is a CISA catalog label, not a real-time incident alert. Always review vendor advisories for patches.