The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
28 Mar 2022 Microsoft Windows Memory corruption
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Adobe Reader and Acrobat Memory corruption
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.03, adobe acrobat reader 11.0.03, adobe acrobat 10.1.7, adobe acrobat reader 10.1.7, adobe acrobat 9.5.5 and 1 older
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-189
28 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
25 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-416
25 Mar 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Apr 2022
25 Mar 2022 Adobe ColdFusion Path traversal
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-22
25 Mar 2022 Adobe Reader and Acrobat Memory corruption
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat reader 9.1, adobe acrobat reader 8.1.3, adobe acrobat reader 7.1.1
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
7 Mar 2022 Adobe ColdFusion Information disclosure
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 7 Sep 2022
- Weakness
- CWE-200
7 Mar 2022 Adobe ColdFusion Security flaw
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 7 Sep 2022
- Weakness
- CWE-264
7 Mar 2022 Adobe ColdFusion Authentication bypass
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 7 Sep 2022
- Weakness
- CWE-255
7 Mar 2022 Adobe BlazeDS Security flaw
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 7 Sep 2022
3 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-843
3 Mar 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-416
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-119
3 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 17.0.0.169, adobe flash player 13.0.0.281, adobe flash player 11.2.202.457
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-787
3 Mar 2022 Adobe Reader and Acrobat Memory corruption
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.6, adobe acrobat 10.1.9
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-399
3 Mar 2022 Adobe Reader and Acrobat Memory corruption
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.03, adobe acrobat reader 11.0.03, adobe acrobat 10.1.7, adobe acrobat reader 10.1.7, adobe acrobat 9.5.5 and 1 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-119
3 Mar 2022 Adobe Reader Memory corruption
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.02, adobe acrobat reader 11.0.02, adobe acrobat 10.1.6, adobe acrobat reader 10.1.6, adobe acrobat 9.5.4 and 1 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-120
3 Mar 2022 Adobe Reader and Acrobat Memory corruption
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.02, adobe acrobat reader 11.0.02, adobe acrobat 10.1.6, adobe acrobat reader 10.1.6, adobe acrobat 9.5.4 and 1 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-787
3 Mar 2022 Adobe ColdFusion Information disclosure
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-200
3 Mar 2022 Adobe Flash Player Remote code execution
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.3.300.271, adobe flash player 11.2.202.238
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-20, CWE-94
3 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 10.2.154.27, google chrome 10.0.648.205, adobe acrobat reader 10.0.3, adobe acrobat 10.0.3, adobe acrobat reader 9.4.4 and 2 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-843
3 Mar 2022 Adobe Reader and Acrobat Remote code execution
Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.3.1, adobe acrobat reader 9.3.1, adobe acrobat 8.2.1, adobe acrobat reader 8.2.1
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-94
3 Mar 2022 Adobe Acrobat and Reader Memory corruption
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-119
15 Feb 2022 Adobe Commerce and Magento Open Source Input validation flaw
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe commerce 2.3.0, adobe magento 2.3.0
- CISA due date
- 1 Mar 2022
- Weakness
- CWE-20
15 Feb 2022 Adobe Flash Player Memory corruption
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-416
3 Nov 2021 Adobe Acrobat and Reader Memory corruption
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Adobe Acrobat and Reader Memory corruption
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122
3 Nov 2021 Microsoft Windows Memory corruption
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Microsoft Windows Memory corruption
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1020.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Adobe ColdFusion Remote code execution
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Adobe Flash Player Memory corruption
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 28.0.0.161
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Adobe ColdFusion Malicious file upload
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-434
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.