The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
3 Mar 2022 Linux Kernel Race condition
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- paloaltonetworks pan-os 7.1.8, paloaltonetworks pan-os 7.0.14, linux kernel 4.8.3, linux kernel 4.7.9, linux kernel 4.4.26 and 7 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-362
3 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Mozilla Firefox Memory corruption
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 21.0, mozilla firefox 17.0.6, mozilla thunderbird 17.0.6, mozilla thunderbird esr 17.0.6
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-119
3 Mar 2022 Oracle Java SE Access control flaw
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- redhat icedtea6 1.11.3, redhat icedtea6 1.10.8
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
On Hacker News
The rise of a new Java vulnerability - CVE-2012-17233 Mar 2022 Oracle Java SE Memory corruption
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-843
3 Mar 2022 Oracle Java SE JDK and JRE Access control flaw
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle jdk 1.6.0, oracle jre 1.6.0
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
22 Feb 2022 Zabbix Frontend Authentication bypass
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 8 Mar 2022
- Weakness
- CWE-284
10 Jan 2022 Exim Mail Transfer Agent (MTA) Command injection
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-78
10 Dec 2021 Linux Kernel Privilege escalation
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 5.1.17, linux kernel 4.19.58, linux kernel 4.14.133, linux kernel 4.9.185, linux kernel 4.9 and 3 older
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-269
10 Dec 2021 Apache Solr Remote code execution
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.1.2, apache solr 7.7.3
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-94
1 Dec 2021 Apache Server-side request forgery
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens sinema remote connect server 3.1, siemens sinec nms 1.0.3
- CISA due date
- 15 Dec 2021
- Weakness
- CWE-918
On Hacker News
Building a POC for CVE-2021-4043817 Nov 2021 Perl Exiftool Remote code execution
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exiftool project exiftool 12.24
- CISA due date
- 1 Dec 2021
- Weakness
- CWE-95
3 Nov 2021 Google Chromium V8 Memory corruption
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 95.0.4638.69
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-755
3 Nov 2021 Google Chromium Intents Open redirect
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 95.0.4638.69
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20
3 Nov 2021 Google Chromium Access control flaw
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.71
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-862
3 Nov 2021 Google Chromium V8 Memory corruption
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.71
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Portals Memory corruption
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.61
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Apple iOS, iPadOS, and macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 90.0.4430.85
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-843
3 Nov 2021 Google Chromium Blink Memory corruption
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.90
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Race condition
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.72
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-362
3 Nov 2021 Google Chromium V8 Memory corruption
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 88.0.4324.150
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122
3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 80.0.3987.122
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
3 Nov 2021 SaltStack Salt Command injection
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- saltstack salt 2019.2.5, saltstack salt 2018.3.5, saltstack salt 2017.7.8, saltstack salt 2017.7.4, saltstack salt 2016.11.10 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Google Chrome FreeType Memory corruption
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 86.0.4240.111, freetype 2.10.4
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 SaltStack Salt Path traversal
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- saltstack salt 3000.2, saltstack salt 2019.2.4
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 SaltStack Salt Security flaw
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- saltstack salt 3000.2, saltstack salt 2019.2.4
- CISA due date
- 3 May 2022
3 Nov 2021 Android Kernel Memory corruption
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- huawei bla-l29c firmware 9.1.0.300\(c432e4r1p11t8\), huawei berkeley-tl10 firmware 9.1.0.333\(c01e333r1p1t8\), huawei ares-al10d firmware 9.1.0.165\(c00e165r2p5t8\), huawei berkeley-l09 firmware 9.1.0.351\(c432e5r1p13t8\), huawei bla-al00b firmware 10.0.0.170\(c786e170r2p4\) and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Mozilla Firefox and Thunderbird Memory corruption
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 72.0.1, mozilla firefox 68.4.1, mozilla thunderbird 68.4.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
On Hacker News
Mozilla Firefox Vulnerability3 Nov 2021 Apache HTTP Server Memory corruption
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Drupal Core Input validation flaw
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.1, drupal 8.4.6, drupal 8.3.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Exim Memory corruption
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exim 4.90.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-119
3 Nov 2021 Roundcube Webmail Access control flaw
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-552
3 Nov 2021 ImageMagick Server-side request forgery
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- imagemagick 6.9.3-10
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 ImageMagick Access control flaw
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- imagemagick 6.9.3-10
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.