Actively exploited vulnerabilities

Vulnerabilities from CISA's Known Exploited Vulnerabilities (KEV) catalog that are confirmed to be exploited. Close these gaps before anything else.

1,766 CVEs in the CISA KEV catalog · How we calculate priority

Export (max. 1,000 rows):CSV JSON

Entries in the CISA KEV catalog
Severity	CVE	Title	Priority (0–325)	Published (CVE)
Critical	CVE-2022-1388	F5 BIG-IP Missing Authentication Vulnerability	254.7	05.05.2022
Critical	CVE-2024-21887	Ivanti Connect Secure and Policy Secure Command Injection Vulnerability	254.7	12.01.2024
Critical	CVE-2022-29464	WSO2 Multiple Products Unrestrictive Upload of File Vulnerability	254.7	18.04.2022
Critical	CVE-2022-22954	VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability	254.7	11.04.2022
Critical	CVE-2021-30116	Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6	254.6	09.07.2021
Critical	CVE-2019-11510	Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability	254.5	08.05.2019
Critical	CVE-2021-28799	Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)	254.3	13.05.2021
Critical	CVE-2026-94127	BIG-IP APM OAuth vulnerability	254.2	22.09.2026
Critical	CVE-2021-20038	SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability	254.1	08.12.2021
Critical	CVE-2021-44529	Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability	254.0	08.12.2021
Critical	CVE-2021-22005	VMware vCenter Server File Upload Vulnerability	254.0	23.09.2021
Critical	CVE-2021-35464	ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability	254.0	22.07.2021
Critical	CVE-2020-5902	F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability	254.0	01.07.2020
Critical	CVE-2019-19781	Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability	254.0	27.12.2019
Critical	CVE-2019-0708	Microsoft Remote Desktop Services Remote Code Execution Vulnerability	254.0	16.05.2019
Critical	CVE-2021-41773	Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49	254.0	05.10.2021
Critical	CVE-2021-26084	Atlassian Confluence Server: Code Execution	254.0	30.08.2021
Critical	CVE-2021-21985	VMware vCenter Server Improper Input Validation Vulnerability	254.0	26.05.2021
Critical	CVE-2018-7600	Drupal Core Remote Code Execution Vulnerability	254.0	29.03.2018
Critical	CVE-2017-5638	Apache Struts Remote Code Execution Vulnerability	254.0	11.03.2017
Critical	CVE-2021-42013	Apache HTTP Server Path Traversal Vulnerability	254.0	07.10.2021
Critical	CVE-2021-38647	Open Management Infrastructure (OMI) Remote Code Execution Vulnerability	254.0	15.09.2021
Critical	CVE-2021-22986	F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability	254.0	31.03.2021
Critical	CVE-2021-3129	Laravel Ignition File Upload Vulnerability	254.0	12.01.2021
Critical	CVE-2019-3396	Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability	254.0	25.03.2019
Critical	CVE-2019-0604	Microsoft SharePoint Remote Code Execution Vulnerability	254.0	06.03.2019
Critical	CVE-2018-10562	Dasan GPON Routers Command Injection Vulnerability	254.0	04.05.2018
Critical	CVE-2021-21972	VMware vCenter Server Remote Code Execution Vulnerability	253.9	24.02.2021
Critical	CVE-2019-18935	Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability	253.9	11.12.2019
Critical	CVE-2019-15107	Webmin Command Injection Vulnerability	253.9	16.08.2019
Critical	CVE-2010-2861	Adobe ColdFusion Directory Traversal Vulnerability	253.9	11.08.2010
Critical	CVE-2017-7494	Samba Remote Code Execution Vulnerability	253.9	30.05.2017
Critical	CVE-2021-40539	Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability	253.9	07.09.2021
Critical	CVE-2018-7602	Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004	253.9	19.07.2018
Critical	CVE-2013-2465	Oracle Java SE Unspecified Vulnerability	253.9	18.06.2013
Critical	CVE-2012-4681	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	253.9	28.08.2012
Critical	CVE-2019-5544	VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability	253.9	06.12.2019
Critical	CVE-2012-0507	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	253.9	07.06.2012
Critical	CVE-2021-42237	Sitecore XP Remote Command Execution Vulnerability	253.8	05.11.2021
Critical	CVE-2018-1273	VMware Tanzu Spring Data Commons Property Binder Vulnerability	253.8	11.04.2018
Critical	CVE-2013-0422	Oracle JRE Remote Code Execution Vulnerability	253.8	10.01.2013
Critical	CVE-2018-6530	D-Link Multiple Routers OS Command Injection Vulnerability	253.8	06.03.2018
Critical	CVE-2019-11580	Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability	253.8	03.06.2019
Critical	CVE-2016-4117	Adobe Flash Player Arbitrary Code Execution Vulnerability	253.8	11.05.2016
Critical	CVE-2012-1723	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	253.7	16.06.2012
Critical	CVE-2018-11138	Quest KACE System Management Appliance Remote Command Execution Vulnerability	253.7	31.05.2018
Critical	CVE-2017-12149	Red Hat JBoss Application Server Remote Code Execution Vulnerability	253.7	04.10.2017
Critical	CVE-2025-61884	Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability	253.7	12.10.2025
Critical	CVE-2021-20021	SonicWall Email Security Improper Privilege Management Vulnerability	253.7	09.04.2021
Critical	CVE-2019-7195	QNAP Photo Station Path Traversal Vulnerability	253.7	05.12.2019