Exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalogue, with severity and affected-product data from the National Vulnerability Database. Everything on this list has been observed in real attacks — it is not a forecast.
- 1695
- On the catalogue
- 8
- Added in 7 days
- 7
- Due within 7 days
- 354
- Used in ransomware
| CVE | Affected | CVSS | Added | Due | |
|---|---|---|---|---|---|
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager | 2022-04-14 | 2022-05-05 | ransomware | |
| CVE-2022-2294 | WebRTC WebRTC | 2022-08-25 | 2022-09-15 | ransomware | |
| CVE-2022-21999 | Microsoft Windows | 2022-03-25 | 2022-04-15 | ransomware | |
| CVE-2022-21587 | Oracle E-Business Suite | 2023-02-02 | 2023-02-23 | ransomware | |
| CVE-2022-1388 | F5 BIG-IP | 2022-05-10 | 2022-05-31 | ransomware | |
| CVE-2021-45046 | Apache Log4j2 | 2023-05-01 | 2023-05-22 | ransomware | |
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | 2024-03-25 | 2024-04-15 | ransomware | |
| CVE-2021-43890 | Microsoft Windows | 2021-12-15 | 2021-12-29 | ransomware | |
| CVE-2021-43226 | Microsoft Windows | 2025-10-06 | 2025-10-27 | ransomware | |
| CVE-2021-42321 | Microsoft Exchange | 2021-11-17 | 2021-12-01 | ransomware | |
| CVE-2021-42287 | Microsoft Active Directory | 2022-04-11 | 2022-05-02 | ransomware | |
| CVE-2021-42278 | Microsoft Active Directory | 2022-04-11 | 2022-05-02 | ransomware | |
| CVE-2021-42258 | BQE BillQuick Web Suite | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-42237 | Sitecore XP | 2022-03-25 | 2022-04-15 | ransomware | |
| CVE-2021-42013 | Apache HTTP Server | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-41773 | Apache HTTP Server | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-41379 | Microsoft Windows | 2022-03-03 | 2022-03-17 | ransomware | |
| CVE-2021-40539 | Zoho ManageEngine | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-40449 | Microsoft Windows | 2021-11-17 | 2021-12-01 | ransomware | |
| CVE-2021-40438 | Apache Apache | 2021-12-01 | 2021-12-15 | ransomware | |
| CVE-2021-35464 | ForgeRock Access Management (AM) | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-35211 | SolarWinds Serv-U | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-3129 | Laravel Ignition | 2023-09-18 | 2023-10-09 | ransomware | |
| CVE-2021-31207 | Microsoft Exchange Server | 2021-11-03 | 2021-11-17 | ransomware | |
| CVE-2021-28799 | QNAP Network Attached Storage (NAS) | 2022-03-31 | 2022-04-21 | ransomware |