Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.
Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.
| CVE | Vendor | Product | Vulnerability | CVSS | Added | Federal due date | BOD 26-04 | Ransomware |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-35464 | ForgeRock | Access Management (AM) | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend). | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Known |
| CVE-2021-22986 | F5 | BIG-IP and BIG-IQ Centralized Management | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services. | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Known |
| CVE-2020-5902 | F5 | BIG-IP | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2020-8655 | EyesOfNetwork | EyesOfNetwork | EyesOfNetwork Improper Privilege Management Vulnerability EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7. | 7.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2020-8657 | EyesOfNetwork | EyesOfNetwork | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2018-6789 | Exim | Exim | Exim Buffer Overflow Vulnerability Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2021-22205 | GitLab | Community and Enterprise Editions | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. | 10.0 CNA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Known |
| CVE-2018-7600 | Drupal | Drupal Core | Drupal Core Remote Code Execution Vulnerability Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2020-8515 | DrayTek | Multiple Vigor Routers | Multiple DrayTek Vigor Routers Web Management Page Vulnerability DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2019-15752 | Docker | Desktop Community Edition | Docker Desktop Community Edition Privilege Escalation Vulnerability Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\. | 7.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2017-9822 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Remote Code Execution Vulnerability DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization. | 8.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Known |
| CVE-2020-25506 | D-Link | DNS-320 Device | D-Link DNS-320 Device Command Injection Vulnerability D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2020-29557 | D-Link | DIR-825 R1 Devices | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2019-11634 | Citrix | Workspace Application and Receiver for Windows | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2019-19781 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2020-3161 | Cisco | Cisco IP Phones | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition. | 9.8 CNA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2020-3118 | Cisco | IOS XR | Cisco IOS XR Software Discovery Protocol Format String Vulnerability Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device. | 8.8 CNA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2018-0171 | Cisco | IOS and IOS XE | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device. | 7.5 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2021-1498 | Cisco | HyperFlex HX | Cisco HyperFlex HX Data Platform Command Injection Vulnerability Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user. | 9.8 CNA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2021-1497 | Cisco | HyperFlex HX | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user. | 9.8 CNA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2021-42258 | BQE | BillQuick Web Suite | BQE BillQuick Web Suite SQL Injection Vulnerability BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution. | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Known |
| CVE-2019-3396 | Atlassian | Confluence Server and Data Server | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2019-11580 | Atlassian | Crowd and Crowd Data Center | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |
| CVE-2021-26084 | Atlassian | Confluence Server and Data Center | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total |
Known
A method to assess 'forgivable' vs 'unforgivable' vulnerabilities
2023 Top Routinely Exploited Vulnerabilities
Russian Military Cyber Actors Target US and Global Critical Infrastructure
Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure
People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action
APT40 Advisory: PRC MSS Tradecraft in Action
|
| CVE-2019-3398 | Atlassian | Confluence Server and Data Center | Atlassian Confluence Server and Data Center Path Traversal Vulnerability Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution. | 8.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-28663 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-28664 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-20090 | Arcadyan | Buffalo Firmware | Arcadyan Buffalo Firmware Path Traversal Vulnerability Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors. | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2020-9859 | Apple | Multiple Products | Apple Multiple Products Code Execution Vulnerability Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges. | 7.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30869 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Type Confusion Vulnerability Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges. | 7.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30761 | Apple | iOS | Apple iOS WebKit Memory Corruption Vulnerability Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30663 | Apple | Multiple Products | Apple Multiple Products WebKit Integer Overflow Vulnerability Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 7.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30665 | Apple | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30713 | Apple | macOS | Apple macOS Unspecified Vulnerability Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. | 7.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30666 | Apple | iOS | Apple iOS WebKit Buffer Overflow Vulnerability Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30661 | Apple | Multiple Products | Apple Multiple Products WebKit Storage Use-After-Free Vulnerability Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-1871 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2021-1870 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 9.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage automatable · total | Unknown |
| CVE-2021-1782 | Apple | Multiple Products | Apple Multiple Products Race Condition Vulnerability Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges. | 7.0 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30762 | Apple | iOS | Apple iOS WebKit Use-After-Free Vulnerability Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2020-9819 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message. | 4.3 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2020-9818 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message. | 8.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2020-27932 | Apple | Multiple Products | Apple Multiple Products Type Confusion Vulnerability Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges. | 7.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30807 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges. | 7.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2020-27930 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front. | 7.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30860 | Apple | Multiple Products | Apple Multiple Products Integer Overflow Vulnerability Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY. | 7.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2019-6223 | Apple | iOS and macOS | Apple iOS and macOS Group Facetime Vulnerability Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction. | 7.5 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2021-30858 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, macOS Use-After-Free Vulnerability Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | 8.8 CISA | 2021-11-03 | 2021-11-17 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2018-11776 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. | 8.1 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage not automatable · total | Unknown |
| CVE-2017-5638 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. | 9.8 CISA | 2021-11-03 | 2022-05-03 | 3 days + forensic triage automatable · total | Known |