Zero-day report: November 2021
CISA added 291 exploited vulnerabilities to its catalog in November 2021. 4 were zero-days, listed within a week of going public. 80 are known to be used by ransomware. The most-hit vendor was Microsoft, with 82.
By technology
Most-hit vendors
Every flaw added in November 2021
- Perl · ExiftoolExifTool Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows Win32k Privilege Escalation Vulnerability
- Microsoft · OfficeMicrosoft Excel Security Feature Bypass
- Microsoft · ExchangeMicrosoft Exchange Server Remote Code Execution Vulnerability
- SAP · NetWeaverSAP NetWeaver Remote Code Execution Vulnerability
- Microsoft · MSCOMCTL.OCXMicrosoft MSCOMCTL.OCX Remote Code Execution Vulnerability
- Oracle · Fusion MiddlewareOracle Fusion Middleware Unspecified Vulnerability
- Microsoft · WindowsMicrosoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability
- Microsoft · OfficeMicrosoft Office Memory Corruption Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server Deserialization of Untrusted Data Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Media Center Remote Code Execution Vulnerability
- Microsoft · OfficeMicrosoft Office OLE DLL Side Loading Vulnerability
- SolarWinds · Virtualization ManagerSolarWinds Virtualization Manager Privilege Escalation Vulnerability
- ImageMagick · ImageMagickImageMagick Arbitrary File Deletion Vulnerability
- ImageMagick · ImageMagickImageMagick Server-Side Request Forgery (SSRF) Vulnerability
- SAP · NetWeaverSAP NetWeaver Directory Traversal Vulnerability
- Apache · ShiroApache Shiro Code Execution Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- SAP · NetWeaverSAP NetWeaver XML External Entity (XXE) Vulnerability
- Microsoft · WindowsMicrosoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
- Microsoft · Office and WordPadMicrosoft Office and WordPad Remote Code Execution Vulnerability
- Microsoft · OfficeMicrosoft Office Outlook Security Feature Bypass Vulnerability
- Microsoft · OfficeMicrosoft Office Memory Corruption Vulnerability
- Roundcube · Roundcube WebmailRoundcube Webmail File Disclosure Vulnerability
- Apache · StrutsApache Struts Remote Code Execution Vulnerability
- Symantec · Symantec Messaging GatewaySymantec Messaging Gateway Remote Code Execution Vulnerability
- Microsoft · Internet Information Services (IIS)Microsoft Windows Server Buffer Overflow Vulnerability
- Microsoft · .NET FrameworkMicrosoft .NET Framework Remote Code Execution Vulnerability
- Progress · ASP.NET AJAX and SitefinityProgress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
- Apache · StrutsApache Struts Deserialization of Untrusted Data Vulnerability
- DotNetNuke (DNN) · DotNetNuke (DNN)DotNetNuke (DNN) Remote Code Execution Vulnerability
- Cisco · IOS and IOS XECisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
- Cisco · Adaptive Security Appliance (ASA)Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
- Microsoft · OfficeMicrosoft Office Memory Corruption Vulnerability
- Microsoft · OfficeMicrosoft Office Memory Corruption Vulnerability
- Apache · StrutsApache Struts Remote Code Execution Vulnerability
- Fortinet · FortiOSFortinet FortiOS SSL VPN Path Traversal Vulnerability
- Tenda · AC7, AC9, and AC10 RoutersTenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
- DotNetNuke (DNN) · DotNetNuke (DNN)DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Unrestricted File Upload Vulnerability
- DotNetNuke (DNN) · DotNetNuke (DNN)DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
- ThinkPHP · noneCmsThinkPHP "noneCms" Remote Code Execution Vulnerability
- SAP · Customer Relationship Management (CRM)SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Use-After-Free Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Deserialization of Untrusted Data Vulnerability
- Exim · EximExim Buffer Overflow Vulnerability
- Drupal · Drupal CoreDrupal Core Remote Code Execution Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
- Apache · HTTP ServerApache HTTP Server Privilege Escalation Vulnerability
- Microsoft · MSHTMLMicrosoft MSHTML Remote Code Execution Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Remote Code Execution Vulnerability
- Microsoft · Remote Desktop ServicesMicrosoft Remote Desktop Services Remote Code Execution Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Error Reporting (WER) Privilege Escalation Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Arbitrary File Read Vulnerability
- Ivanti · Pulse Connect Secure and Pulse Policy SecureIvanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
- Atlassian · Crowd and Crowd Data CenterAtlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
- Citrix · Workspace Application and Receiver for WindowsCitrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Privilege Escalation Vulnerability
- Citrix · StoreFront ServerCitrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
- Docker · Desktop Community EditionDocker Desktop Community Edition Privilege Escalation Vulnerability
- Nagios · Nagios XINagios XI Remote Code Execution Vulnerability
- SIMalliance · Toolbox BrowserSIMalliance Toolbox Browser Command Injection Vulnerability
- Cisco · Small Business RV320 and RV325 RoutersCisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
- vBulletin · vBulletinvBulletin PHP Module Remote Code Execution Vulnerability
- Mozilla · Firefox and ThunderbirdMozilla Firefox And Thunderbird Type Confusion Vulnerability
- Apache · SolrApache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
- Trend Micro · OfficeScanTrend Micro OfficeScan Directory Traversal Vulnerability
- Progress · Telerik UI for ASP.NET AJAXProgress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
- TeamViewer · DesktopTeamViewer Desktop Bypass Remote Login Vulnerability
- Netis · WF2419 DevicesNetis WF2419 Devices Remote Code Execution Vulnerability
- Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceCitrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
- TVT · NVMS-1000TVT NVMS-1000 Directory Traversal Vulnerability
- Android · Android KernelAndroid Kernel Use-After-Free Vulnerability
- Atlassian · Confluence Server and Data ServerAtlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
- Atlassian · Confluence Server and Data CenterAtlassian Confluence Server and Data Center Path Traversal Vulnerability
- IBM · Planning AnalyticsIBM Planning Analytics Remote Code Execution Vulnerability
- VMware · VMware ESXi and Horizon DaaSVMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
- Fortinet · FortiOSFortinet FortiOS Default Configuration Vulnerability
- Apple · iOS and macOSApple iOS and macOS Group Facetime Vulnerability
- SonicWall · SMA100SonicWall SMA100 SQL Injection Vulnerability
- Zoho · ManageEngineZoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
- ThinkPHP · ThinkPHPThinkPHP Remote Code Execution Vulnerability
- WordPress · Social Warfare PluginWordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
- Android · Android KernelAndroid Kernel Out-of-Bounds Write Vulnerability
- MediaTek · Multiple ChipsetsMediatek Multiple Chipsets Insufficient Input Validation Vulnerability
- Microsoft · WindowsMicrosoft Windows CryptoAPI Spoofing Vulnerability
- Microsoft · .NET FrameworkMicrosoft .NET Framework Remote Code Execution Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
- Microsoft · WindowsMicrosoft Windows Installer Privilege Escalation Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Validation Key Remote Code Execution Vulnerability
- Microsoft · Edge and Internet ExplorerMicrosoft Edge and Internet Explorer Memory Corruption Vulnerability
- Microsoft · WindowsMicrosoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Privilege Escalation Vulnerability
- SolarWinds · OrionSolarWinds Orion Authentication Bypass Vulnerability
- Sumavision · Enhanced Multimedia Router (EMR)Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability
- Zoho · ManageEngineZoho ManageEngine Desktop Central File Upload Vulnerability
- Sonatype · Nexus RepositorySonatype Nexus Repository Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
- rConfig · rConfigrConfig OS Command Injection Vulnerability
- Microsoft · Hyper-V RemoteFXMicrosoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Tenda · AC1900 Router AC15 ModelTenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
- Microsoft · .NET Framework, SharePoint, Visual StudioMicrosoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
- SaltStack · SaltSaltStack Salt Authentication Bypass Vulnerability
- SaltStack · SaltSaltStack Salt Path Traversal Vulnerability
- WordPress · Snap Creek Duplicator PluginWordPress Snap Creek Duplicator Plugin File Download Vulnerability
- Sophos · SFOSSophos SFOS SQL Injection Vulnerability
- Fortinet · FortiOSFortinet FortiOS SSL VPN Improper Authentication Vulnerability
- Microsoft · WindowsMicrosoft Windows DNS Server Remote Code Execution Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
- Microsoft · WindowsMicrosoft Windows Spoofing Vulnerability
- Microsoft · NetlogonMicrosoft Netlogon Privilege Escalation Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server Remote Code Execution Vulnerability
- Oracle · Solaris and Zettabyte File System (ZFS)Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server Remote Code Execution Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server Unspecified Vulnerability
- Ivanti · MobileIron Multiple ProductsIvanti MobileIron Multiple Products Remote Code Execution Vulnerability
- Google · Chrome FreeTypeGoogle Chrome FreeType Heap Buffer Overflow Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Google · Chrome for Android UIGoogle Chrome for Android UI Heap Buffer Overflow Vulnerability
- Google · Chromium V8Google Chromium V8 Incorrect Implementation Vulnerabililty
- Google · ChromeGoogle Chrome Use-After-Free Vulnerability
- SaltStack · SaltSaltStack Salt Shell Injection Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Privilege Escalation Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Remote Code Execution Vulnerability
- vBulletin · vBulletinvBulletin PHP Module Remote Code Execution Vulnerability
- Apache · StrutsApache Struts Remote Code Execution Vulnerability
- Trend Micro · Apex One, OfficeScan, and Worry-Free Business SecurityTrend Micro Multiple Products Improper Access Control Vulnerability
- WordPress · File Manager PluginWordPress File Manager Plugin Remote Code Execution Vulnerability
- D-Link · DNS-320 DeviceD-Link DNS-320 Device Command Injection Vulnerability
- Oracle · Multiple ProductsOracle Multiple Products Remote Code Execution Vulnerability
- NETGEAR · JGS516PE DevicesNetgear JGS516PE Devices Missing Function Level Access Control Vulnerability
- Apple · Multiple ProductsApple Multiple Products Memory Corruption Vulnerability
- Apple · Multiple ProductsApple Multiple Products Type Confusion Vulnerability
- Apple · Multiple ProductsApple Multiple Products Memory Initialization Vulnerability
- D-Link · DIR-825 R1 DevicesD-Link DIR-825 R1 Devices Buffer Overflow Vulnerability
- Zyxel · Multiple ProductsZyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
- Cisco · IOS XRCisco IOS XR Software Discovery Protocol Format String Vulnerability
- Cisco · Cisco IP PhonesCisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability
- Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Cisco ASA and FTD Read-Only Path Traversal Vulnerability
- Cisco · IOS XRCisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
- Cisco · IOS XRCisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
- Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
- VMware · Multiple ProductsVMware Multiple Products Privilege Escalation Vulnerability
- VMware · vCenter ServerVMware vCenter Server Information Disclosure Vulnerability
- VMware · ESXiVMware ESXi OpenSLP Use-After-Free Vulnerability
- VMware · Multiple ProductsMultiple VMware Products Command Injection Vulnerability
- IBM · Data Risk ManagerIBM Data Risk Manager Security Bypass Vulnerability
- IBM · Data Risk ManagerIBM Data Risk Manager Remote Code Execution Vulnerability
- IBM · Data Risk ManagerIBM Data Risk Manager Directory Traversal Vulnerability
- Amcrest · Cameras and Network Video Recorder (NVR)Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
- Unraid · UnraidUnraid Remote Code Execution Vulnerability
- Unraid · UnraidUnraid Authentication Bypass Vulnerability
- F5 · BIG-IPF5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
- SAP · Solution ManagerSAP Solution Manager Missing Authentication for Critical Function Vulnerability
- SAP · NetWeaverSAP NetWeaver Missing Authentication for Critical Function Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Mozilla · Firefox and ThunderbirdMozilla Firefox And Thunderbird Use-After-Free Vulnerability
- Mozilla · Firefox and ThunderbirdMozilla Firefox And Thunderbird Use-After-Free Vulnerability
- Liferay · Liferay PortalLiferay Portal Deserialization of Untrusted Data Vulnerability
- Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceCitrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
- Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceCitrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
- Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceCitrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Code Execution Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Code Execution Vulnerability
- Trend Micro · Apex One and OfficeScanTrend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
- Trend Micro · Apex One, OfficeScan and Worry-Free Business Security AgentsTrend Micro Multiple Products Content Validation Escape Vulnerability
- DrayTek · Multiple Vigor RoutersMultiple DrayTek Vigor Routers Web Management Page Vulnerability
- Trend Micro · Apex One and OfficeScanTrend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
- PlaySMS · PlaySMSPlaySMS Server-Side Template Injection Vulnerability
- EyesOfNetwork · EyesOfNetworkEyesOfNetwork Improper Privilege Management Vulnerability
- EyesOfNetwork · EyesOfNetworkEyesOfNetwork Use of Hard-Coded Credentials Vulnerability
- Apple · iOS, iPadOS, and watchOSApple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
- Apple · iOS, iPadOS, and watchOSApple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
- Apple · Multiple ProductsApple Multiple Products Code Execution Vulnerability
- Cisco · HyperFlex HXCisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
- Cisco · HyperFlex HXCisco HyperFlex HX Data Platform Command Injection Vulnerability
- Microsoft · DefenderMicrosoft Defender Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows Print Spooler Remote Code Execution Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Apple · Multiple ProductsApple Multiple Products Race Condition Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
- Apple · iOS, iPadOS, and watchOSApple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Use-After-Free Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
- SonicWall · SSLVPN SMA100SonicWall SSLVPN SMA100 SQL Injection Vulnerability
- SonicWall · SonicWall Email SecuritySonicWall Email Security Improper Privilege Management Vulnerability
- SonicWall · SonicWall Email SecuritySonicWall Email Security Unrestricted Upload of File Vulnerability
- SonicWall · SonicWall Email SecuritySonicWall Email Security Path Traversal Vulnerability
- Arcadyan · Buffalo FirmwareArcadyan Buffalo Firmware Path Traversal Vulnerability
- Adobe · Acrobat and ReaderAdobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability
- Google · Chromium V8Google Chromium V8 Heap Buffer Overflow Vulnerability
- Google · ChromiumGoogle Chromium Race Condition Vulnerability
- Google · Chromium BlinkGoogle Chromium Blink Use-After-Free Vulnerability
- Google · Chromium BlinkGoogle Chromium Blink Use-After-Free Vulnerability
- Google · Chromium V8Google Chromium V8 Improper Input Validation Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- VMware · vCenter ServerVMware vCenter Server Remote Code Execution Vulnerability
- VMware · vCenter ServerVMware vCenter Server Improper Input Validation Vulnerability
- VMware · vCenter ServerVMware vCenter Server File Upload Vulnerability
- GitLab · Community and Enterprise EditionsGitLab Community and Enterprise Editions Remote Code Execution Vulnerability
- Micro Focus · Operation Bridge Reporter (OBR)Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
- Micro Focus · Micro Focus Access ManagerMicro Focus Access Manager Information Leakage Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Use-After-Free Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Command Injection Vulnerability
- Ivanti · Pulse Connect SecureIvanti Pulse Connect Secure Unrestricted File Upload Vulnerability
- F5 · BIG-IP and BIG-IQ Centralized ManagementF5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
- McAfee · McAfee Total Protection (MTP)McAfee Total Protection (MTP) Improper Privilege Management Vulnerability
- Atlassian · Confluence Server and Data CenterAtlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Memory Corruption Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Remote Code Execution Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Remote Code Execution Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Remote Code Execution Vulnerability
- Microsoft · OfficeMicrosoft Office Remote Code Execution Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Remote Code Execution Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Remote Code Execution Vulnerability
- Accellion · FTAAccellion FTA SQL Injection Vulnerability
- Accellion · FTAAccellion FTA OS Command Injection Vulnerability
- Accellion · FTAAccellion FTA Server-Side Request Forgery (SSRF) Vulnerability
- Accellion · FTAAccellion FTA OS Command Injection Vulnerability
- Yealink · Device ManagementYealink Device Management Server-Side Request Forgery (SSRF) Vulnerability
- Arm · Trusted FirmwareArm Trusted Firmware Out-of-Bounds Write Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Adobe · Acrobat and ReaderAdobe Acrobat and Reader Use-After-Free Vulnerability
- Arm · Mali Graphics Processing Unit (GPU)Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
- Arm · Mali Graphics Processing Unit (GPU)Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
- Kaseya · Virtual System/Server Administrator (VSA)Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Google · Chromium WebGLGoogle Chromium WebGL Use-After-Free Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Google · Chromium V8Google Chromium V8 Out-of-Bounds Write Vulnerability
- Google · Chromium Indexed DB APIGoogle Chromium Indexed DB API Use-After-Free Vulnerability
- Apple · macOSApple macOS Unspecified Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Storage Use-After-Free Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Integer Overflow Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Memory Corruption Vulnerability
- Apple · iOSApple iOS WebKit Buffer Overflow Vulnerability
- Apple · macOSApple macOS Unspecified Vulnerability
- Apple · iOSApple iOS WebKit Memory Corruption Vulnerability
- Apple · iOSApple iOS WebKit Use-After-Free Vulnerability
- Apple · Multiple ProductsApple Multiple Products Memory Corruption Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, macOS Use-After-Free Vulnerability
- Apple · Multiple ProductsApple Multiple Products Integer Overflow Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, and macOS Type Confusion Vulnerability
- Microsoft · Enhanced Cryptographic ProviderMicrosoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability
- Microsoft · Enhanced Cryptographic ProviderMicrosoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Security Feature Bypass Vulnerability
- Tenda · AC11 RouterTenda AC11 Router Stack Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Information Disclosure Vulnerability
- Microsoft · WindowsMicrosoft Windows NTFS Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows MSHTML Platform Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Scripting Engine Memory Corruption Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Remote Code Execution Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Print Spooler Remote Code Execution Vulnerability
- SolarWinds · Serv-USolarWinds Serv-U Remote Code Execution Vulnerability
- Realtek · AP-Router SDKRealtek AP-Router SDK Buffer Overflow Vulnerability
- ForgeRock · Access Management (AM)ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
- Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business SecurityTrend Micro Multiple Products Improper Input Validation Vulnerability
- Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business SecurityTrend Micro Multiple Products Improper Input Validation Vulnerability
- Microsoft · WindowsMicrosoft Windows Local Security Authority (LSA) Spoofing Vulnerability
- Microsoft · WindowsMicrosoft Windows Update Medic Service Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
- Google · Chromium PortalsGoogle Chromium Portals Use-After-Free Vulnerability
- Google · Chromium V8Google Chromium V8 Use-After-Free Vulnerability
- Google · ChromiumGoogle Chromium Information Disclosure Vulnerability
- Google · Chromium IntentsGoogle Chromium Intents Improper Input Validation Vulnerability
- Google · Chromium V8Google Chromium V8 Memory Corruption Vulnerability
- Microsoft · Open Management Infrastructure (OMI)Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
- Microsoft · Open Management Infrastructure (OMI)Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
- Microsoft · Open Management Infrastructure (OMI)Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
- Microsoft · Open Management Infrastructure (OMI)Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
- Microsoft · MSHTMLMicrosoft MSHTML Remote Code Execution Vulnerability
- Zoho · ManageEngineZoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
- Apache · HTTP ServerApache HTTP Server Path Traversal Vulnerability
- Apache · HTTP ServerApache HTTP Server Path Traversal Vulnerability
- BQE · BillQuick Web SuiteBQE BillQuick Web Suite SQL Injection Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.