The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
8 Oct 2026 ISC BIND Denial of service
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- juniper junos 13.2, juniper junos 12.1, isc bind 9.10.2, isc bind 9.9.7, hpe vcx 9.8.18
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-19
23 Jan 2025 JQuery Cross-site scripting
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- oracle blockchain platform 21.1.2, oracle application express 20.2, oracle jd edwards enterpriseone orchestrator 9.2.5.0, oracle jd edwards enterpriseone tools 9.2.5.0, drupal 8.8.6 and 5 older
- CISA due date
- 13 Feb 2025
- Weakness
- CWE-79
25 Sep 2023 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.0.1, apple iphone os 17.0.1, apple macos 14.0, webkitgtk+ 2.42.2
- CISA due date
- 16 Oct 2023
- Weakness
- CWE-754
12 May 2023 Oracle Java SE and JRockit Access control flaw
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache cassandra 3.11.8, apache cassandra 3.0.22, apache cassandra 2.2.18, apache cassandra 2.1.22
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
10 Mar 2023 XStream Remote code execution
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- xstream 1.4.18
- CISA due date
- 31 Mar 2023
- Weakness
- CWE-94, CWE-502
25 May 2022 Mozilla Firefox Information disclosure
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 39.0.3, mozilla firefox 38.1.1, mozilla firefox os 2.2
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-200
25 May 2022 Oracle Java Runtime Environment (JRE) Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-284
25 May 2022 Oracle Java Runtime Environment (JRE) Security flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-693
25 May 2022 Oracle Java Runtime Environment (JRE) Access control flaw
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
25 May 2022 Oracle Java Runtime Environment (JRE) Security flaw
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
28 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-693
28 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-284
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 9.0.1, apache tomcat 8.5.23, apache tomcat 8.0.47, apache tomcat 7.0.82
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
3 Mar 2022 Apache Tomcat Security flaw
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 9.0.31, apache tomcat 8.5.51, apache tomcat 7.0.100
- CISA due date
- 17 Mar 2022
3 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Oracle Java SE Access control flaw
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- redhat icedtea6 1.11.3, redhat icedtea6 1.10.8
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
On Hacker News
The rise of a new Java vulnerability - CVE-2012-17233 Mar 2022 Oracle Java SE Memory corruption
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-843
3 Mar 2022 Oracle Java SE JDK and JRE Access control flaw
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle jdk 1.6.0, oracle jre 1.6.0
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Nov 2021 Apache HTTP Server Path traversal
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle secure backup 18.1.0.1.0, oracle jd edwards enterpriseone tools 9.2.6.0
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Apache HTTP Server Path traversal
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Apache Solr Input validation flaw
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.4.0, apache solr 7.7.3
- CISA due date
- 3 May 2022
- Weakness
- CWE-74
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.