The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
15 Feb 2022 Adobe Flash Player Memory corruption
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-416
28 Jan 2022 GNU Bourne-Again Shell (Bash) Command injection
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- ibm storwize v7000 firmware 7.3.0.7, ibm storwize v7000 firmware 7.2.0.9, ibm storwize v7000 firmware 1.5.0.4, ibm storwize v7000 firmware 1.4.3.5, arista eos 4.14.4f and 7 older
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-78
28 Jan 2022 GNU Bourne-Again Shell (Bash) Command injection
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- ibm storwize v7000 firmware 7.3.0.7, ibm storwize v7000 firmware 7.2.0.9, ibm storwize v7000 firmware 1.5.0.4, ibm storwize v7000 firmware 1.4.3.5, arista eos 4.14.4f and 7 older
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-78
10 Jan 2022 Exim Mail Transfer Agent (MTA) Command injection
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-78
10 Dec 2021 Linux Kernel Privilege escalation
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 5.1.17, linux kernel 4.19.58, linux kernel 4.14.133, linux kernel 4.9.185, linux kernel 4.9 and 3 older
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-269
10 Dec 2021 Apache Solr Remote code execution
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.1.2, apache solr 7.7.3
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-94
10 Dec 2021 Red Hat JBoss Seam 2 Remote code execution
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-20
1 Dec 2021 Apache Server-side request forgery
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens sinema remote connect server 3.1, siemens sinec nms 1.0.3
- CISA due date
- 15 Dec 2021
- Weakness
- CWE-918
On Hacker News
Building a POC for CVE-2021-4043817 Nov 2021 Perl Exiftool Remote code execution
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exiftool project exiftool 12.24
- CISA due date
- 1 Dec 2021
- Weakness
- CWE-95
3 Nov 2021 Google Chromium V8 Memory corruption
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 95.0.4638.69
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-755
3 Nov 2021 Google Chromium Intents Open redirect
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 95.0.4638.69
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20
3 Nov 2021 Google Chromium Access control flaw
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.71
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-862
3 Nov 2021 Google Chromium V8 Memory corruption
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.71
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Portals Memory corruption
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 94.0.4606.61
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Apple iOS, iPadOS, and macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 90.0.4430.85
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-843
3 Nov 2021 Google Chromium Blink Memory corruption
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.90
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Google Chromium Race condition
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 89.0.4389.72
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122, CWE-362
3 Nov 2021 Google Chromium V8 Memory corruption
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 88.0.4324.150
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-122
3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Path traversal
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix application delivery controller firmware 13.0-58.30, citrix gateway firmware 13.0-58.30, citrix application delivery controller firmware 12.1-57.18, citrix netscaler gateway firmware 12.1-57.18, citrix application delivery controller firmware 12.0-63.21 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 80.0.3987.122
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
3 Nov 2021 SaltStack Salt Command injection
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- saltstack salt 2019.2.5, saltstack salt 2018.3.5, saltstack salt 2017.7.8, saltstack salt 2017.7.4, saltstack salt 2016.11.10 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Google Chrome FreeType Memory corruption
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 86.0.4240.111, freetype 2.10.4
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 SaltStack Salt Path traversal
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- saltstack salt 3000.2, saltstack salt 2019.2.4
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 SaltStack Salt Security flaw
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- saltstack salt 3000.2, saltstack salt 2019.2.4
- CISA due date
- 3 May 2022
3 Nov 2021 VMware ESXi and Horizon DaaS Memory corruption
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware horizon daas 9.0.0.0
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Android Kernel Memory corruption
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- huawei bla-l29c firmware 9.1.0.300\(c432e4r1p11t8\), huawei berkeley-tl10 firmware 9.1.0.333\(c01e333r1p1t8\), huawei ares-al10d firmware 9.1.0.165\(c00e165r2p5t8\), huawei berkeley-l09 firmware 9.1.0.351\(c432e5r1p13t8\), huawei bla-al00b firmware 10.0.0.170\(c786e170r2p4\) and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Mozilla Firefox and Thunderbird Memory corruption
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 72.0.1, mozilla firefox 68.4.1, mozilla thunderbird 68.4.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
On Hacker News
Mozilla Firefox Vulnerability3 Nov 2021 Apache HTTP Server Memory corruption
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Drupal Core Input validation flaw
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.1, drupal 8.4.6, drupal 8.3.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Exim Memory corruption
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exim 4.90.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-119
3 Nov 2021 Adobe Flash Player Memory corruption
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 28.0.0.161
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Roundcube Webmail Access control flaw
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-552
3 Nov 2021 ImageMagick Server-side request forgery
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- imagemagick 6.9.3-10
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 ImageMagick Access control flaw
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- imagemagick 6.9.3-10
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.