Threats & CVE Intelligence
Search the locally synchronized CISA known-exploited vulnerabilities catalog, or enter a CVE ID or keyword to search the broader NIST National Vulnerability Database. NVD searches are retrieved on demand and may be rate limited.
Last successful sync: 2026-11-07 22:40:39 UTC · Source catalog updated: 2026-11-06T19:44:45.1797Z · 1769 records in latest import.
CISA Known Exploited Vulnerabilities · 1769 matches
Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability
Microsoft — Windows
Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.
CVE-2019-11634 · KEV 2021-11-03Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Citrix — Workspace Application and Receiver for Windows
Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.
Ransomware use reportedCVE-2019-11580 · KEV 2021-11-03Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
Atlassian — Crowd and Crowd Data Center
Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.
Ransomware use reportedCVE-2019-11539 · KEV 2021-11-03Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
Ivanti — Pulse Connect Secure and Pulse Policy Secure
Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
Ransomware use reportedCVE-2019-11510 · KEV 2021-11-03Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Ivanti — Pulse Connect Secure
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
Ransomware use reportedCVE-2019-0863 · KEV 2021-11-03Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability
Microsoft — Windows
Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.
CVE-2019-0859 · KEV 2021-11-03Microsoft Win32k Privilege Escalation Vulnerability
Microsoft — Win32k
Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
Ransomware use reportedCVE-2019-0808 · KEV 2021-11-03Microsoft Win32k Privilege Escalation Vulnerability
Microsoft — Win32k
Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.
CVE-2019-0803 · KEV 2021-11-03Microsoft Win32k Privilege Escalation Vulnerability
Microsoft — Win32k
Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
Ransomware use reportedCVE-2019-0797 · KEV 2021-11-03Microsoft Win32k Privilege Escalation Vulnerability
Microsoft — Win32k
Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
CVE-2019-0708 · KEV 2021-11-03Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft — Remote Desktop Services
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful e…
Ransomware use reportedCVE-2019-0604 · KEV 2021-11-03Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft — SharePoint
Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm …
Ransomware use reportedCVE-2019-0541 · KEV 2021-11-03Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft — MSHTML
Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.
CVE-2019-0211 · KEV 2021-11-03Apache HTTP Server Privilege Escalation Vulnerability
Apache — HTTP Server
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent pro…
CVE-2018-8653 · KEV 2021-11-03Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft — Internet Explorer
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
CVE-2018-7600 · KEV 2021-11-03Drupal Core Remote Code Execution Vulnerability
Drupal — Drupal Core
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
Ransomware use reportedCVE-2018-6789 · KEV 2021-11-03Exim Buffer Overflow Vulnerability
Exim — Exim
Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
Ransomware use reportedCVE-2018-4939 · KEV 2021-11-03Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe — ColdFusion
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
CVE-2018-4878 · KEV 2021-11-03Adobe Flash Player Use-After-Free Vulnerability
Adobe — Flash Player
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
Ransomware use reportedCVE-2018-2380 · KEV 2021-11-03SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP — Customer Relationship Management (CRM)
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
Ransomware use reportedCVE-2018-20062 · KEV 2021-11-03ThinkPHP "noneCms" Remote Code Execution Vulnerability
ThinkPHP — noneCms
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
CVE-2018-18325 · KEV 2021-11-03DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) — DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
CVE-2018-15961 · KEV 2021-11-03Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe — ColdFusion
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
CVE-2018-15811 · KEV 2021-11-03DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) — DotNetNuke (DNN)
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
CVE-2018-14558 · KEV 2021-11-03Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Tenda — AC7, AC9, and AC10 Routers
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a…
CVE-2018-13379 · KEV 2021-11-03Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet — FortiOS
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Ransomware use reportedCVE-2018-11776 · KEV 2021-11-03Apache Struts Remote Code Execution Vulnerability
Apache — Struts
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in s…
CVE-2018-0802 · KEV 2021-11-03Microsoft Office Memory Corruption Vulnerability
Microsoft — Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained…
Ransomware use reportedCVE-2018-0798 · KEV 2021-11-03Microsoft Office Memory Corruption Vulnerability
Microsoft — Office
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained…
CVE-2018-0296 · KEV 2021-11-03Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
Cisco — Adaptive Security Appliance (ASA)
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
Source: CISA KEV catalog and NIST NVD. “Known” ransomware use is a CISA catalog label, not a real-time incident alert. Always review vendor advisories for patches.