Vulnerabilities CISA has confirmed as actively exploited. Prioritize these for remediation.
Vulnerabilities newly added to CISA KEV in the last 7 days.
| CVE ID | Title | Severity | Added |
|---|---|---|---|
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | CRITICAL | 2026. 07. 16. | |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests | CRITICAL |
| CVE ID | Title | Severity | References | Ransom | |||||
|---|---|---|---|---|---|---|---|---|---|
| Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322. | CRITICAL | 9.8v3.1 |
| 2026. 07. 16. |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | CRITICAL | 2026. 07. 16. |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C | CRITICAL | 2026. 07. 15. |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX instal | HIGH | 2026. 07. 15. |
95.7% |
KEV KISA |
| 2015. 02. 02. |
| 2022. 04. 13. |
| — |
| CVE-2015-0311 | Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015. | CRITICAL | 9.8v3.1 | 100 | 85.8% | KEV KISA | 2015. 01. 23. | 2022. 04. 13. | — |
| CVE-2014-9163 | Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014. | HIGH | 7.8v3.1 | 100 | 20.4% | KEV KISA | 2014. 12. 10. | 2022. 04. 13. | — |
| CVE-2021-39793 | In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A | HIGH | 7.8v3.1 | 100 | 0.7% | KEV | 2022. 03. 16. | 2022. 04. 11. | — |
| CVE-2022-23176 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3. | HIGH | 8.8v3.1 | 100 | 12.8% | KEV | 2022. 02. 24. | 2022. 04. 11. | — |
| CVE-2021-27852 | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7. | CRITICAL | 9.8v3.1 | 100 | 31.9% | KEV | 2021. 05. 27. | 2022. 04. 11. | — |
| CVE-2020-2509 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS h | CRITICAL | 9.8v3.1 | 100 | 32.8% | KEV | 2021. 04. 17. | 2022. 04. 11. | — |
| CVE-2017-11317 | Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code. | CRITICAL | 9.8v3.1 | 100 | 83.5% | KEV | 2017. 08. 23. | 2022. 04. 11. | — |
| CVE-2021-42278 | — | — | — | 87.50 | 70.2% | KEV | — | 2022. 04. 11. | ⚠️ |
| CVE-2021-22600 | — | — | — | 82.50 | 5.9% | KEV | — | 2022. 04. 11. | — |
| CVE-2021-42287 | — | — | — | 87.50 | 74.3% | KEV | — | 2022. 04. 11. | ⚠️ |
| CVE-2021-31166 | HTTP Protocol Stack Remote Code Execution Vulnerability | CRITICAL | 9.8v3.1 | 100 | 99.7% | KEV | 2021. 05. 11. | 2022. 04. 06. | — |
| CVE-2017-0148 | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146. | HIGH | 8.1v3.1 | 100 | 99.4% | KEV | 2017. 03. 17. | 2022. 04. 06. | ⚠️ |
| CVE-2021-3156 | — | — | — | 82.50 | 99.3% | KEV | — | 2022. 04. 06. | — |
| CVE-2022-22965 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. | CRITICAL | 9.8v3.1 | 100 | 99.7% | KEV | 2022. 04. 01. | 2022. 04. 04. | — |
| CVE-2021-45382 | A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched. | CRITICAL | 9.8v3.1 | 100 | 97.8% | KEV | 2022. 02. 17. | 2022. 04. 04. | — |
| CVE-2022-22675 | — | — | — | 82.50 | 12.6% | KEV | — | 2022. 04. 04. | — |
| CVE-2022-22674 | — | — | — | 82.50 | 1.1% | KEV | — | 2022. 04. 04. | — |
| CVE-2022-26871 | An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution. | CRITICAL | 9.8v3.1 | 100 | 19.6% | KEV | 2022. 03. 29. | 2022. 03. 31. | — |
| CVE-2022-1040 | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. | CRITICAL | 9.8v3.1 | 100 | 99.8% | KEV | 2022. 03. 25. | 2022. 03. 31. | — |