The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
3 Nov 2021 Arm Trusted Firmware Memory corruption
In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Yealink Device Management Command injection
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-78
3 Nov 2021 Accellion FTA Command injection
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-78
3 Nov 2021 Accellion FTA Server-side request forgery
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- accellion fta 9_12_416
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-918
3 Nov 2021 Accellion FTA Command injection
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-78
3 Nov 2021 Accellion FTA SQL injection
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89, CWE-138
3 Nov 2021 Microsoft Internet Explorer Security flaw
Internet Explorer Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
3 Nov 2021 Microsoft Exchange Server Path traversal
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-39
3 Nov 2021 Microsoft Office Security flaw
Microsoft Office Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
3 Nov 2021 Microsoft Exchange Server Security flaw
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Exchange Server Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Microsoft Exchange Server Server-side request forgery
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-918
3 Nov 2021 Microsoft Internet Explorer Memory corruption
Internet Explorer Memory Corruption Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Atlassian Confluence Server and Data Center Remote code execution
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian confluence data center 7.12.5, atlassian confluence server 7.12.5, atlassian confluence data center 7.11.6, atlassian confluence server 7.11.6, atlassian confluence data center 7.4.11 and 3 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-917
3 Nov 2021 McAfee Total Protection (MTP) Access control flaw
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mcafee total protection 16.0.30
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-284
3 Nov 2021 F5 BIG-IP and BIG-IQ Centralized Management Server-side request forgery
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- f5 big-ip access policy manager 16.0.1.1, f5 big-ip access policy manager 15.1.2.1, f5 big-ip access policy manager 14.1.4, f5 big-ip access policy manager 13.1.3.6, f5 big-ip access policy manager 12.1.5.3 and 7 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-863
3 Nov 2021 Ivanti Pulse Connect Secure Remote code execution
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
3 Nov 2021 Ivanti Pulse Connect Secure Command injection
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-77
3 Nov 2021 Ivanti Pulse Connect Secure Remote code execution
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
3 Nov 2021 Ivanti Pulse Connect Secure Authentication bypass
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-287
On Hacker News
CVE-2021-22893 exploit honey"POC"3 Nov 2021 Micro Focus Access Manager Security flaw
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microfocus access manager 5.0
- CISA due date
- 17 Nov 2021
3 Nov 2021 Micro Focus Operation Bridge Reporter (OBR) Command injection
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-78
3 Nov 2021 GitLab Community and Enterprise Editions Remote code execution
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gitlab 13.10.3, gitlab 13.9.6, gitlab 13.8.8
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-95
On Hacker News
Gitlab CVE-2021-22205: RCE by unauthenticated curl -F3 Nov 2021 VMware vCenter Server Path traversal
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 5.0
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-23
3 Nov 2021 VMware vCenter Server Server-side request forgery
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 4.2.1, vmware cloud foundation 3.10.2.1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-470, CWE-918
3 Nov 2021 VMware vCenter Server Path traversal
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 4.2, vmware cloud foundation 3.10.1.2
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-23
On Hacker News
CVE-2021-21972 RCE POC3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 90.0.4430.85
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-843
3 Nov 2021 Google Chromium V8 Memory corruption
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.128
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-122
3 Nov 2021 Google Chromium Blink Memory corruption
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.128
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Blink Memory corruption
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.90
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Race condition
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.72
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-362
3 Nov 2021 Google Chromium V8 Memory corruption
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 88.0.4324.150
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122
3 Nov 2021 Adobe Acrobat and Reader Memory corruption
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122
3 Nov 2021 Arcadyan Buffalo Firmware Path traversal
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 SonicWall Email Security Path traversal
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6177, sonicwall email security appliance 8300 firmware 10.0.9.6177, sonicwall email security appliance 7050 firmware 10.0.9.6177, sonicwall email security appliance 7000 firmware 10.0.9.6177, sonicwall email security appliance 5050 firmware 10.0.9.6177 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 SonicWall Email Security Malicious file upload
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-434
3 Nov 2021 SonicWall Email Security Privilege escalation
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-306
3 Nov 2021 SonicWall SSLVPN SMA100 SQL injection
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 10.2.0.5-d-29sv
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89
3 Nov 2021 Qualcomm Multiple Chipsets Security flaw
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-390
3 Nov 2021 Qualcomm Multiple Chipsets Memory corruption
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Apple iOS, iPadOS, and watchOS Cross-site scripting
This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4.2, apple iphone os 14.4.2, apple iphone os 12.5.2, apple watchos 7.3.3
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-79
On Hacker News
Universal XSS in iOS 1 comment3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7, webkitgtk 2.30.6
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
3 Nov 2021 Apple Multiple Products Race condition
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple tvos 14.4, apple macos 11.2, apple mac os x 10.15.7 and 2 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-362, CWE-667
3 Nov 2021 Microsoft Win32k Memory corruption
Windows Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Microsoft Windows Access control flaw
Windows Print Spooler Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.1999, microsoft windows server 2016 10.0.14393.4467, microsoft windows server 2004 10.0.19041.1052, microsoft windows 10 2004 10.0.19041.1052, microsoft windows 10 1909 10.0.18363.1621 and 5 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-285
3 Nov 2021 Microsoft Defender Memory corruption
Microsoft Defender Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-1285
3 Nov 2021 Cisco HyperFlex HX Command injection
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco hyperflex hx data platform 4.5\(2a\), cisco hyperflex hx data platform 4.0\(2e\)
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-78
3 Nov 2021 Cisco HyperFlex HX Command injection
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco hyperflex hx data platform 4.5\(2a\), cisco hyperflex hx data platform 4.0\(2e\)
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-78
3 Nov 2021 Apple Multiple Products Memory corruption
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.5.1, apple iphone os 13.5.1, apple tvos 13.4.6, apple mac os x 10.15.5, apple watchos 6.2.6
- CISA due date
- 3 May 2022
- Weakness
- CWE-415
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.