Vulnerabilities CISA has confirmed as actively exploited. Prioritize these for remediation.
Vulnerabilities newly added to CISA KEV in the last 7 days.
| CVE ID | Title | Severity | Added |
|---|---|---|---|
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | CRITICAL | 2026. 07. 16. | |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests | CRITICAL |
| CVE ID | Title | Severity | References | Ransom | |||||
|---|---|---|---|---|---|---|---|---|---|
| Windows Print Spooler Elevation of Privilege Vulnerability | HIGH | 7.8v3.1 | 100 | 18.5% |
| 2026. 07. 16. |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | CRITICAL | 2026. 07. 16. |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C | CRITICAL | 2026. 07. 15. |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX instal | HIGH | 2026. 07. 15. |
KEV |
| 2022. 02. 09. |
| 2022. 04. 19. |
| — |
| CVE-2018-6882 | Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. | MEDIUM | 6.1v3.1 | 96.50 | 23.7% | KEV | 2018. 03. 27. | 2022. 04. 19. | ⚠️ |
| CVE-2019-3568 | — | — | — | 82.50 | 39.2% | KEV | — | 2022. 04. 19. | — |
| CVE-2022-1364 | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH | 8.8v3.1 | 100 | 13.7% | KEV | 2022. 07. 26. | 2022. 04. 15. | — |
| CVE-2022-22960 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'. | HIGH | 7.8v3.1 | 100 | 37.2% | KEV | 2022. 04. 13. | 2022. 04. 15. | — |
| CVE-2019-16057 | The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. | CRITICAL | 9.8v3.1 | 100 | 87.2% | KEV | 2019. 09. 16. | 2022. 04. 15. | ⚠️ |
| CVE-2010-5330 | On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected. | CRITICAL | 9.8v3.1 | 100 | 34.6% | KEV | 2019. 06. 11. | 2022. 04. 15. | — |
| CVE-2018-7841 | A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered. | CRITICAL | 9.8v3.1 | 100 | 72.5% | KEV | 2019. 05. 22. | 2022. 04. 15. | — |
| CVE-2016-4523 | The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors. | HIGH | 7.5v3.1 | 100 | 31.4% | KEV | 2016. 06. 09. | 2022. 04. 15. | — |
| CVE-2014-0780 | Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. | CRITICAL | 9.8v3.1 | 100 | 74.5% | KEV | 2014. 04. 25. | 2022. 04. 15. | — |
| CVE-2007-3010 | masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action. | CRITICAL | 9.8v3.1 | 100 | 97.8% | KEV | 2007. 09. 18. | 2022. 04. 15. | — |
| CVE-2019-3929 | — | — | — | 82.50 | 99.0% | KEV | — | 2022. 04. 15. | — |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. | CRITICAL | 9.8v3.1 | 100 | 100.0% | KEV | 2022. 04. 11. | 2022. 04. 14. | ⚠️ |
| CVE-2022-24521 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | HIGH | 7.8v3.1 | 100 | 7.3% | KEV | 2022. 04. 15. | 2022. 04. 13. | ⚠️ |
| CVE-2018-20753 | Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild. | CRITICAL | 9.8v3.1 | 100 | 29.3% | KEV | 2019. 02. 05. | 2022. 04. 13. | ⚠️ |
| CVE-2018-7602 | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. | CRITICAL | 9.8v3.1 | 100 | 99.2% | KEV | 2018. 07. 19. | 2022. 04. 13. | ⚠️ |
| CVE-2015-2502 | Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015. | HIGH | 8.8v3.1 | 100 | 51.1% | KEV KISA | 2015. 08. 19. | 2022. 04. 13. | — |
| CVE-2015-5123 | Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015. | CRITICAL | 9.8v3.1 | 100 | 18.5% | KEV | 2015. 07. 14. | 2022. 04. 13. | — |
| CVE-2015-5122 | Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as | CRITICAL | 9.8v3.1 | 100 | 93.7% | KEV | 2015. 07. 14. | 2022. 04. 13. | — |
| CVE-2015-3113 | Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015. | CRITICAL | 9.8v3.1 | 100 | 99.9% | KEV KISA | 2015. 06. 23. | 2022. 04. 13. | — |