Flaws added in November 2021

From Exploited flaws, HARD’s guide to the flaws being used in attacks

This article lists the flaws CISA added in November 2021. For the newest, see Exploited flaws.

November 2021

Flaws added each day; used in ransomware

Flaws added	291
In things at home	131
Used in ransomware	80
Companies	66
Most from	Microsoft 82Apple 23Google 22
Busiest day	3 Nov 2021 287
Next month	December 2021 20
Source	CISA KEV, version 2026.10.30

In November 2021, CISA added 291 flaws to its list of vulnerabilities being used in attacks, 131 of them in things people have at home; 80 have been used by ransomware gangs. Most came from Microsoft (82), Apple (23) and Google (22).^[1]

CISA started its list this month, with the flaws it already knew attackers were using, which is why November 2021 has more than any month since.

List of flaws

Every flaw CISA added in November 2021, newest first, in plain English, each with an article of its own.^[2] marks the ones used in ransomware.

Wednesday 17 November 2021 4 added

CVE	Flaw	Found
`CVE-2021-42321`† Used in ransomwareAt work	Microsoft Exchange. Someone who already has a way in can use Microsoft Exchange to run their own code.	At work
`CVE-2021-42292`At home	Microsoft Office. Someone who already has a way in can use Microsoft Office to run their own code.	At home
`CVE-2021-40449`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-22204`At work	Perl Exiftool. Attackers can run their own code on Perl Exiftool.	At work

Wednesday 3 November 2021 287 added

CVE	Flaw	Found
`CVE-2021-42258`† Used in ransomwareAt work	BQE BillQuick Web Suite. Attackers can run their own code on BQE BillQuick Web Suite from anywhere, without logging in.	At work
`CVE-2021-42013`† Used in ransomwareAt work	Apache HTTP Server. Attackers can run their own code on Apache HTTP Server.	At work
`CVE-2021-41773`† Used in ransomwareAt work	Apache HTTP Server. Attackers can run their own code on Apache HTTP Server.	At work
`CVE-2021-40539`† Used in ransomwareAt work	Zoho ManageEngine. Attackers can run their own code on Zoho ManageEngine.	At work
`CVE-2021-40444`† Used in ransomwareAt home	Microsoft MSHTML. Opening a booby-trapped file can let an attacker run their own code through Microsoft MSHTML.	At home
`CVE-2021-38649`At work	Microsoft Open Management Infrastructure (OMI). Someone who already has a foothold can use Microsoft Open Management Infrastructure (OMI) to take full control of the machine.	At work
`CVE-2021-38648`At work	Microsoft Open Management Infrastructure (OMI). Someone who already has a foothold can use Microsoft Open Management Infrastructure (OMI) to take full control of the machine.	At work
`CVE-2021-38647`† Used in ransomwareAt work	Microsoft Open Management Infrastructure (OMI). Attackers can run their own code on Microsoft Open Management Infrastructure (OMI).	At work
`CVE-2021-38645`At work	Microsoft Open Management Infrastructure (OMI). Someone who already has a foothold can use Microsoft Open Management Infrastructure (OMI) to take full control of the machine.	At work
`CVE-2021-38003`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-38000`At home	Chrome and other Chromium browsers. Attackers are using a flaw in Chrome and other Chromium browsers.	At home
`CVE-2021-37976`At home	Chrome and other Chromium browsers. Attackers can read information from Chrome and other Chromium browsers that should be private.	At home
`CVE-2021-37975`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-37973`At home	Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers.	At home
`CVE-2021-36955`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-36948`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-36942`† Used in ransomwareAt home	Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows.	At home
`CVE-2021-36742`At work	Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security. Someone who already has a foothold can use Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security to take full control of the machine.	At work
`CVE-2021-36741`At work	Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security. Attackers can upload a file to Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security and make it run.	At work
`CVE-2021-35464`† Used in ransomwareAt work	ForgeRock Access Management (AM). Attackers can run their own code on ForgeRock Access Management (AM).	At work
`CVE-2021-35395`At home	Realtek AP-Router SDK. Attackers can run their own code on Realtek AP-Router SDK.	At home
`CVE-2021-35211`† Used in ransomwareAt work	SolarWinds Serv-U. Attackers can run their own code on SolarWinds Serv-U.	At work
`CVE-2021-34527`† Used in ransomwareAt home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2021-34523`† Used in ransomwareAt work	Microsoft Exchange Server. Someone who already has a foothold can use Microsoft Exchange Server to take full control of the machine.	At work
`CVE-2021-34473`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2021-34448`At home	Microsoft Windows. Attackers can corrupt memory in Microsoft Windows, which they use to take it over.	At home
`CVE-2021-33771`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-33742`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2021-33739`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-31979`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-31956`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-31955`At home	Microsoft Windows. Attackers can read information from Microsoft Windows that should be private.	At home
`CVE-2021-31755`At home	Tenda AC11 Router. Attackers can run their own code on Tenda AC11 Router.	At home
`CVE-2021-31207`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can get past a security protection in Microsoft Exchange Server.	At work
`CVE-2021-31201`At work	Microsoft Enhanced Cryptographic Provider. Someone who already has a foothold can use Microsoft Enhanced Cryptographic Provider to take full control of the machine.	At work
`CVE-2021-31199`At work	Microsoft Enhanced Cryptographic Provider. Someone who already has a foothold can use Microsoft Enhanced Cryptographic Provider to take full control of the machine.	At work
`CVE-2021-30869`At home	Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS.	At home
`CVE-2021-30860`At home	Apple devices. Opening a booby-trapped file can let an attacker run their own code through Apple devices.	At home
`CVE-2021-30858`At home	Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS.	At home
`CVE-2021-30807`At home	Apple devices. Attackers can run their own code on Apple devices.	At home
`CVE-2021-30762`At home	Apple iOS. Attackers can run their own code on Apple iOS.	At home
`CVE-2021-30761`At home	Apple iOS. Attackers can run their own code on Apple iOS.	At home
`CVE-2021-30713`At home	Apple macOS. Attackers are using a flaw in Apple macOS that its maker hasn't described in detail.	At home
`CVE-2021-30666`At home	Apple iOS. Attackers can run their own code on Apple iOS.	At home
`CVE-2021-30665`At home	Apple devices. Attackers can run their own code on Apple devices.	At home
`CVE-2021-30663`At home	Apple devices. Attackers can run their own code on Apple devices.	At home
`CVE-2021-30661`At home	Apple devices. Attackers can run their own code on Apple devices.	At home
`CVE-2021-30657`At home	Apple macOS. Attackers are using a flaw in Apple macOS that its maker hasn't described in detail.	At home
`CVE-2021-30633`At home	Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers.	At home
`CVE-2021-30632`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-30563`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-30554`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-30551`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-30116`† Used in ransomwareAt work	Kaseya Virtual System/Server Administrator (VSA). Attackers can get into Kaseya Virtual System/Server Administrator (VSA) without a valid password.	At work
`CVE-2021-28664`At home	Arm Mali Graphics Processing Unit (GPU). Someone who already has a foothold can use Arm Mali Graphics Processing Unit (GPU) to take full control of the machine.	At home
`CVE-2021-28663`At home	Arm Mali Graphics Processing Unit (GPU). Someone who already has a foothold can use Arm Mali Graphics Processing Unit (GPU) to take full control of the machine.	At home
`CVE-2021-28550`At home	Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader from anywhere, without logging in.	At home
`CVE-2021-28310`At home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2021-27562`At home	Arm Trusted Firmware. Attackers can corrupt memory in Arm Trusted Firmware, which they use to take it over.	At home
`CVE-2021-27561`At work	Yealink Device Management. Attackers can run their own code on Yealink Device Management from anywhere, without logging in.	At work
`CVE-2021-27104`† Used in ransomwareAt work	Accellion FTA. Attackers can run commands on Accellion FTA.	At work
`CVE-2021-27103`† Used in ransomwareAt work	Accellion FTA. Attackers can make Accellion FTA send requests into the network behind it.	At work
`CVE-2021-27102`† Used in ransomwareAt work	Accellion FTA. Attackers can run commands on Accellion FTA.	At work
`CVE-2021-27101`† Used in ransomwareAt work	Accellion FTA. Attackers can read or change the database behind Accellion FTA.	At work
`CVE-2021-27085`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2021-27065`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2021-27059`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2021-26858`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2021-26857`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2021-26855`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2021-26411`† Used in ransomwareAt home	Microsoft Internet Explorer. Attackers can corrupt memory in Microsoft Internet Explorer, which they use to take it over.	At home
`CVE-2021-26084`† Used in ransomwareAt work	Atlassian Confluence Server and Data Center. Attackers can run their own code on Atlassian Confluence Server and Data Center from anywhere, without logging in.	At work
`CVE-2021-23874`At work	McAfee Total Protection (MTP). Someone who already has a way in can use McAfee Total Protection (MTP) to run their own code.	At work
`CVE-2021-22986`† Used in ransomwareAt work	F5 BIG-IP and BIG-IQ Centralized Management. Attackers can run their own code on F5 BIG-IP and BIG-IQ Centralized Management from anywhere, without logging in.	At work
`CVE-2021-22900`At work	Ivanti Pulse Connect Secure. Attackers can upload a file to Ivanti Pulse Connect Secure and make it run.	At work
`CVE-2021-22899`At work	Ivanti Pulse Connect Secure. Someone who already has a way in can use Ivanti Pulse Connect Secure to run their own code.	At work
`CVE-2021-22894`At work	Ivanti Pulse Connect Secure. Someone who already has a way in can use Ivanti Pulse Connect Secure to run their own code.	At work
`CVE-2021-22893`† Used in ransomwareAt work	Ivanti Pulse Connect Secure. Attackers can run their own code on Ivanti Pulse Connect Secure from anywhere, without logging in.	At work
`CVE-2021-22506`At work	Micro Focus Access Manager. Attackers can read information from Micro Focus Access Manager that should be private.	At work
`CVE-2021-22502`At work	Micro Focus Operation Bridge Reporter (OBR). Attackers can run their own code on Micro Focus Operation Bridge Reporter (OBR).	At work
`CVE-2021-22205`† Used in ransomwareAt work	GitLab Community and Enterprise Editions. Attackers can run their own code on GitLab Community and Enterprise Editions.	At work
`CVE-2021-22005`† Used in ransomwareAt work	VMware vCenter Server. Opening a booby-trapped file can let an attacker run their own code through VMware vCenter Server.	At work
`CVE-2021-21985`† Used in ransomwareAt work	VMware vCenter Server. Attackers can run their own code on VMware vCenter Server.	At work
`CVE-2021-21972`† Used in ransomwareAt work	VMware vCenter Server. Attackers can run their own code on VMware vCenter Server.	At work
`CVE-2021-21224`At home	Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers.	At home
`CVE-2021-21220`At home	Chrome and other Chromium browsers. Attackers are using a flaw in Chrome and other Chromium browsers.	At home
`CVE-2021-21206`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-21193`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-21166`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-21148`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2021-21017`At home	Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader from anywhere, without logging in.	At home
`CVE-2021-20090`At work	Arcadyan Buffalo Firmware. Attackers can get into Arcadyan Buffalo Firmware without a valid password.	At work
`CVE-2021-20023`† Used in ransomwareAt work	SonicWall Email Security. Someone who already has a foothold can use SonicWall Email Security to take full control of the machine.	At work
`CVE-2021-20022`† Used in ransomwareAt work	SonicWall Email Security. Attackers can upload a file to SonicWall Email Security and make it run.	At work
`CVE-2021-20021`† Used in ransomwareAt work	SonicWall Email Security. Someone who already has a foothold can use SonicWall Email Security to take full control of the machine.	At work
`CVE-2021-20016`† Used in ransomwareAt work	SonicWall SSLVPN SMA100. Attackers can read or change the database behind SonicWall SSLVPN SMA100 from anywhere, without logging in.	At work
`CVE-2021-1906`At home	Qualcomm Multiple Chipsets. Attackers are using a flaw in Qualcomm Multiple Chipsets.	At home
`CVE-2021-1905`At home	Qualcomm Multiple Chipsets. Attackers can corrupt memory in Qualcomm Multiple Chipsets, which they use to take it over.	At home
`CVE-2021-1879`At home	Apple iOS, iPadOS, and watchOS. Attackers can run code in the browser of someone using Apple iOS, iPadOS, and watchOS and act as them.	At home
`CVE-2021-1871`At home	Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS.	At home
`CVE-2021-1870`At home	Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS.	At home
`CVE-2021-1782`At home	Apple devices. Someone who already has a foothold can use Apple devices to take full control of the machine.	At home
`CVE-2021-1732`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2021-1675`† Used in ransomwareAt home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2021-1647`At home	Microsoft Defender. Attackers can run their own code on Microsoft Defender.	At home
`CVE-2021-1498`At work	Cisco HyperFlex HX. Attackers can run commands on Cisco HyperFlex HX from anywhere, without logging in.	At work
`CVE-2021-1497`At work	Cisco HyperFlex HX. Attackers can run commands on Cisco HyperFlex HX from anywhere, without logging in.	At work
`CVE-2020-9859`At home	Apple devices. Attackers can run their own code on Apple devices.	At home
`CVE-2020-9819`At home	Apple iOS, iPadOS, and watchOS. Attackers can corrupt memory in Apple iOS, iPadOS, and watchOS, which they use to take it over.	At home
`CVE-2020-9818`At home	Apple iOS, iPadOS, and watchOS. Attackers can corrupt memory in Apple iOS, iPadOS, and watchOS, which they use to take it over.	At home
`CVE-2020-8657`At work	EyesOfNetwork. Attackers can get into EyesOfNetwork without a valid password.	At work
`CVE-2020-8655`At work	EyesOfNetwork. Attackers can run commands on EyesOfNetwork.	At work
`CVE-2020-8644`At work	PlaySMS. Attackers can run their own code on PlaySMS.	At work
`CVE-2020-8599`At work	Trend Micro Apex One and OfficeScan. Attackers can get into Trend Micro Apex One and OfficeScan without a valid password.	At work
`CVE-2020-8515`At home	DrayTek Multiple Vigor Routers. Attackers can run their own code on DrayTek Multiple Vigor Routers from anywhere, without logging in.	At home
`CVE-2020-8468`At work	Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents. Attackers are using a flaw in Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents.	At work
`CVE-2020-8467`At work	Trend Micro Apex One and OfficeScan. Attackers can run their own code on Trend Micro Apex One and OfficeScan.	At work
`CVE-2020-8260`At work	Ivanti Pulse Connect Secure. Someone who already has a way in can use Ivanti Pulse Connect Secure to run their own code.	At work
`CVE-2020-8243`At work	Ivanti Pulse Connect Secure. Someone who already has a way in can use Ivanti Pulse Connect Secure to run their own code.	At work
`CVE-2020-8196`At work	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. Attackers can reach parts of Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance that should be locked to them.	At work
`CVE-2020-8195`At work	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. Attackers can read information from Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance that should be private.	At work
`CVE-2020-8193`At work	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. Attackers can reach parts of Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance that should be locked to them from anywhere, without logging in.	At work
`CVE-2020-7961`At work	Liferay Portal. Attackers can run their own code on Liferay Portal.	At work
`CVE-2020-6820`At home	Mozilla Firefox and Thunderbird. Attackers can corrupt memory in Mozilla Firefox and Thunderbird, which they use to take it over.	At home
`CVE-2020-6819`At home	Mozilla Firefox and Thunderbird. Attackers can corrupt memory in Mozilla Firefox and Thunderbird, which they use to take it over.	At home
`CVE-2020-6418`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2020-6287`At work	SAP NetWeaver. Attackers can get into SAP NetWeaver without a valid password.	At work
`CVE-2020-6207`At work	SAP Solution Manager. Attackers can get into SAP Solution Manager without a valid password.	At work
`CVE-2020-5902`† Used in ransomwareAt work	F5 BIG-IP. Attackers can run their own code on F5 BIG-IP.	At work
`CVE-2020-5849`At work	Unraid. Attackers can run their own code on Unraid.	At work
`CVE-2020-5847`At work	Unraid. Attackers can run their own code on Unraid.	At work
`CVE-2020-5735`At work	Amcrest Cameras and Network Video Recorder (NVR). Attackers can run their own code on Amcrest Cameras and Network Video Recorder (NVR) from anywhere, without logging in.	At work
`CVE-2020-4430`At work	IBM Data Risk Manager. Attackers can read files on IBM Data Risk Manager that should be out of reach.	At work
`CVE-2020-4428`At work	IBM Data Risk Manager. Someone who already has a way in can use IBM Data Risk Manager to run their own code.	At work
`CVE-2020-4427`At work	IBM Data Risk Manager. Attackers can get into IBM Data Risk Manager without a valid password.	At work
`CVE-2020-4006`At work	VMware products. Attackers can run commands on VMware products.	At work
`CVE-2020-3992`† Used in ransomwareAt work	VMware ESXi. Attackers can run their own code on VMware ESXi.	At work
`CVE-2020-3952`At work	VMware vCenter Server. Attackers can reach parts of VMware vCenter Server that should be locked to them.	At work
`CVE-2020-3950`At work	VMware products. Someone who already has a foothold can use VMware products to take full control of the machine.	At work
`CVE-2020-3580`† Used in ransomwareAt work	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). Attackers can run code in the browser of someone using Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) and act as them.	At work
`CVE-2020-3569`At work	Cisco IOS XR. Attackers can crash Cisco IOS XR or stop it working from anywhere, without logging in.	At work
`CVE-2020-3566`At work	Cisco IOS XR. Attackers can crash Cisco IOS XR or stop it working from anywhere, without logging in.	At work
`CVE-2020-3452`At work	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). Attackers can read files on Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) that should be out of reach from anywhere, without logging in.	At work
`CVE-2020-3161`At work	Cisco IP Phones. Attackers can run their own code on Cisco IP Phones from anywhere, without logging in.	At work
`CVE-2020-3118`At work	Cisco IOS XR. Attackers can run their own code on Cisco IOS XR from anywhere, without logging in.	At work
`CVE-2020-29583`At home	Zyxel products. Attackers can get into Zyxel products without a valid password.	At home
`CVE-2020-29557`At home	D-Link DIR-825 R1 Devices. Attackers can run their own code on D-Link DIR-825 R1 Devices from anywhere, without logging in.	At home
`CVE-2020-27950`At home	Apple devices. Attackers are using a flaw in Apple devices.	At home
`CVE-2020-27932`At home	Apple devices. Attackers can run their own code on Apple devices.	At home
`CVE-2020-27930`At home	Apple devices. Opening a booby-trapped file can let an attacker run their own code through Apple devices.	At home
`CVE-2020-26919`At home	NETGEAR JGS516PE Devices. Attackers can reach parts of NETGEAR JGS516PE Devices that should be locked to them.	At home
`CVE-2020-2555`At work	Oracle products. Attackers can run their own code on Oracle products from anywhere, without logging in.	At work
`CVE-2020-25506`At home	D-Link DNS-320 Device. Attackers can run their own code on D-Link DNS-320 Device.	At home
`CVE-2020-25213`At home	WordPress File Manager Plugin. Attackers can run their own code on WordPress File Manager Plugin from anywhere, without logging in.	At home
`CVE-2020-24557`At work	Trend Micro Apex One, OfficeScan, and Worry-Free Business Security. Someone who already has a foothold can use Trend Micro Apex One, OfficeScan, and Worry-Free Business Security to take full control of the machine.	At work
`CVE-2020-17530`At work	Apache Struts. Attackers can run their own code on Apache Struts.	At work
`CVE-2020-17496`At work	vBulletin. Attackers can run their own code on vBulletin.	At work
`CVE-2020-17144`At work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2020-17087`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2020-16846`At work	SaltStack Salt. Attackers are using a flaw in SaltStack Salt.	At work
`CVE-2020-16017`At home	Google Chrome. Attackers can get past a security protection in Google Chrome.	At home
`CVE-2020-16013`At home	Chrome and other Chromium browsers. Attackers are using a flaw in Chrome and other Chromium browsers.	At home
`CVE-2020-16010`At home	Google Chrome for Android UI. Attackers can get past a security protection in Google Chrome for Android UI.	At home
`CVE-2020-16009`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2020-15999`At home	Google Chrome FreeType. A booby-trapped web page can corrupt memory in Google Chrome FreeType, which attackers use to take it over.	At home
`CVE-2020-15505`At work	Ivanti MobileIron Multiple Products. Attackers can run their own code on Ivanti MobileIron Multiple Products.	At work
`CVE-2020-14883`At work	Oracle WebLogic Server. Attackers are using a flaw in Oracle WebLogic Server that its maker hasn't described in detail.	At work
`CVE-2020-14882`At work	Oracle WebLogic Server. Attackers can run their own code on Oracle WebLogic Server from anywhere, without logging in.	At work
`CVE-2020-14871`At work	Oracle Solaris and Zettabyte File System (ZFS). Attackers are using a flaw in Oracle Solaris and Zettabyte File System (ZFS) that its maker hasn't described in detail.	At work
`CVE-2020-14750`At work	Oracle WebLogic Server. Attackers can run their own code on Oracle WebLogic Server from anywhere, without logging in.	At work
`CVE-2020-1472`† Used in ransomwareAt work	Microsoft Netlogon. Attackers can use Microsoft Netlogon to take full control of the machine from anywhere, without logging in.	At work
`CVE-2020-1464`At home	Microsoft Windows. Attackers can get past a security protection in Microsoft Windows.	At home
`CVE-2020-1380`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2020-1350`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2020-12812`† Used in ransomwareAt work	Fortinet FortiOS. Attackers can get into Fortinet FortiOS without a valid password.	At work
`CVE-2020-12271`† Used in ransomwareAt work	Sophos SFOS. Attackers can run their own code on Sophos SFOS.	At work
`CVE-2020-11738`At home	WordPress Snap Creek Duplicator Plugin. Attackers can read files on WordPress Snap Creek Duplicator Plugin that should be out of reach.	At home
`CVE-2020-11652`At work	SaltStack Salt. Attackers can read files on SaltStack Salt that should be out of reach.	At work
`CVE-2020-11651`At work	SaltStack Salt. Attackers can run commands on SaltStack Salt from anywhere, without logging in.	At work
`CVE-2020-1147`At home	Microsoft .NET Framework, SharePoint, Visual Studio. Attackers can run their own code on Microsoft .NET Framework, SharePoint, Visual Studio.	At home
`CVE-2020-10987`At home	Tenda AC1900 Router AC15 Model. Attackers can run their own code on Tenda AC1900 Router AC15 Model.	At home
`CVE-2020-1054`At home	Microsoft Win32k. Attackers can run their own code on Microsoft Win32k.	At home
`CVE-2020-1040`At work	Microsoft Hyper-V RemoteFX. Someone who already has a way in can use Microsoft Hyper-V RemoteFX to run their own code.	At work
`CVE-2020-10221`At work	rConfig. Attackers can run commands on rConfig.	At work
`CVE-2020-1020`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2020-10199`At work	Sonatype Nexus Repository. Attackers can run their own code on Sonatype Nexus Repository.	At work
`CVE-2020-10189`At work	Zoho ManageEngine. Attackers can run their own code on Zoho ManageEngine from anywhere, without logging in.	At work
`CVE-2020-10181`At work	Sumavision Enhanced Multimedia Router (EMR). A malicious link or page can make Sumavision Enhanced Multimedia Router (EMR) carry out actions as a signed-in user.	At work
`CVE-2020-10148`At work	SolarWinds Orion. Attackers can get into SolarWinds Orion without a valid password.	At work
`CVE-2020-0986`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2020-0968`† Used in ransomwareAt home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2020-0938`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2020-0878`† Used in ransomwareAt home	Microsoft Edge and Internet Explorer. Attackers can run their own code on Microsoft Edge and Internet Explorer.	At home
`CVE-2020-0688`† Used in ransomwareAt work	Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server.	At work
`CVE-2020-0683`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2020-0674`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2020-0646`At home	Microsoft .NET Framework. Attackers can run their own code on Microsoft .NET Framework.	At home
`CVE-2020-0601`At home	Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows.	At home
`CVE-2020-0069`At home	MediaTek Multiple Chipsets. Someone who already has a foothold can use MediaTek Multiple Chipsets to take full control of the machine.	At home
`CVE-2020-0041`At home	Android Kernel. Someone who already has a foothold can use Android Kernel to take full control of the machine.	At home
`CVE-2019-9978`At home	WordPress Social Warfare Plugin. Attackers can run their own code on WordPress Social Warfare Plugin.	At home
`CVE-2019-9082`At work	ThinkPHP. Attackers can run their own code on ThinkPHP.	At work
`CVE-2019-8394`At work	Zoho ManageEngine. Attackers can upload a file to Zoho ManageEngine and make it run.	At work
`CVE-2019-7481`† Used in ransomwareAt work	SonicWall SMA100. Attackers can read or change the database behind SonicWall SMA100 from anywhere, without logging in.	At work
`CVE-2019-6223`At home	Apple iOS and macOS. Attackers are using a flaw in Apple iOS and macOS that its maker hasn't described in detail.	At home
`CVE-2019-5591`† Used in ransomwareAt work	Fortinet FortiOS. Attackers can read information from Fortinet FortiOS that should be private from anywhere, without logging in.	At work
`CVE-2019-5544`† Used in ransomwareAt work	VMware ESXi and Horizon DaaS. Attackers can run their own code on VMware ESXi and Horizon DaaS.	At work
`CVE-2019-4716`At work	IBM Planning Analytics. Attackers can run their own code on IBM Planning Analytics from anywhere, without logging in.	At work
`CVE-2019-3398`At work	Atlassian Confluence Server and Data Center. Attackers can run their own code on Atlassian Confluence Server and Data Center.	At work
`CVE-2019-3396`† Used in ransomwareAt work	Atlassian Confluence Server and Data Server. Attackers can run their own code on Atlassian Confluence Server and Data Server.	At work
`CVE-2019-2215`At home	Android Kernel. Someone who already has a foothold can use Android Kernel to take full control of the machine.	At home
`CVE-2019-20085`At work	TVT NVMS-1000. Attackers can read files on TVT NVMS-1000 that should be out of reach.	At work
`CVE-2019-19781`† Used in ransomwareAt work	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. Attackers can run their own code on Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance from anywhere, without logging in.	At work
`CVE-2019-19356`At work	Netis WF2419 Devices. Attackers can run their own code on Netis WF2419 Devices.	At work
`CVE-2019-18988`At work	TeamViewer Desktop. Attackers can reach parts of TeamViewer Desktop that should be locked to them.	At work
`CVE-2019-18935`† Used in ransomwareAt work	Progress Telerik UI for ASP.NET AJAX. Attackers can run their own code on Progress Telerik UI for ASP.NET AJAX.	At work
`CVE-2019-18187`At work	Trend Micro OfficeScan. Attackers can run their own code on Trend Micro OfficeScan.	At work
`CVE-2019-17558`At work	Apache Solr. Someone who already has a way in can use Apache Solr to run their own code.	At work
`CVE-2019-17026`At home	Mozilla Firefox and Thunderbird. Attackers can corrupt memory in Mozilla Firefox and Thunderbird, which they use to take it over.	At home
`CVE-2019-16759`At work	vBulletin. Attackers can run their own code on vBulletin.	At work
`CVE-2019-1653`At work	Cisco Small Business RV320 and RV325 Routers. Attackers can reach parts of Cisco Small Business RV320 and RV325 Routers that should be locked to them from anywhere, without logging in.	At work
`CVE-2019-16256`At work	SIMalliance Toolbox Browser. Attackers can run commands on SIMalliance Toolbox Browser.	At work
`CVE-2019-15949`At work	Nagios XI. Attackers can run their own code on Nagios XI.	At work
`CVE-2019-15752`At work	Docker Desktop Community Edition. Someone who already has a foothold can use Docker Desktop Community Edition to take full control of the machine.	At work
`CVE-2019-1429`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2019-1367`† Used in ransomwareAt home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2019-13608`† Used in ransomwareAt work	Citrix StoreFront Server. Attackers can read files on Citrix StoreFront Server that should be out of reach from anywhere, without logging in.	At work
`CVE-2019-1215`† Used in ransomwareAt home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2019-1214`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-11634`† Used in ransomwareAt work	Citrix Workspace Application and Receiver for Windows. Attackers can run their own code on Citrix Workspace Application and Receiver for Windows.	At work
`CVE-2019-11580`† Used in ransomwareAt work	Atlassian Crowd and Crowd Data Center. Attackers can run their own code on Atlassian Crowd and Crowd Data Center from anywhere, without logging in.	At work
`CVE-2019-11539`† Used in ransomwareAt work	Ivanti Pulse Connect Secure and Pulse Policy Secure. Someone who already has a way in can use Ivanti Pulse Connect Secure and Pulse Policy Secure to run their own code.	At work
`CVE-2019-11510`† Used in ransomwareAt work	Ivanti Pulse Connect Secure. Attackers can read files on Ivanti Pulse Connect Secure that should be out of reach from anywhere, without logging in.	At work
`CVE-2019-0863`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2019-0859`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2019-0808`At home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2019-0803`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2019-0797`At home	Microsoft Win32k. Attackers can run their own code on Microsoft Win32k.	At home
`CVE-2019-0708`† Used in ransomwareAt work	Microsoft Remote Desktop Services. Attackers can run their own code on Microsoft Remote Desktop Services from anywhere, without logging in.	At work
`CVE-2019-0604`† Used in ransomwareAt work	Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint.	At work
`CVE-2019-0541`At home	Microsoft MSHTML. Attackers can run their own code on Microsoft MSHTML.	At home
`CVE-2019-0211`At work	Apache HTTP Server. Attackers can run their own code on Apache HTTP Server.	At work
`CVE-2018-8653`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2018-7600`† Used in ransomwareAt work	Drupal Core. Attackers can run their own code on Drupal Core.	At work
`CVE-2018-6789`† Used in ransomwareAt work	Exim. Opening a booby-trapped file can let an attacker run their own code through Exim.	At work
`CVE-2018-4939`At work	Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion.	At work
`CVE-2018-4878`† Used in ransomwareAt home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2018-2380`† Used in ransomwareAt work	SAP Customer Relationship Management (CRM). Attackers can read files on SAP Customer Relationship Management (CRM) that should be out of reach.	At work
`CVE-2018-20062`At work	ThinkPHP noneCms. Attackers can run their own code on ThinkPHP noneCms.	At work
`CVE-2018-18325`At work	DotNetNuke (DNN). Attackers can read information from DotNetNuke (DNN) that should be private.	At work
`CVE-2018-15961`At work	Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion.	At work
`CVE-2018-15811`At work	DotNetNuke (DNN). Attackers can read information from DotNetNuke (DNN) that should be private.	At work
`CVE-2018-14558`At home	Tenda AC7, AC9, and AC10 Routers. Attackers can run commands on Tenda AC7, AC9, and AC10 Routers.	At home
`CVE-2018-13379`† Used in ransomwareAt work	Fortinet FortiOS. Attackers can reach parts of Fortinet FortiOS that should be locked to them from anywhere, without logging in.	At work
`CVE-2018-11776`At work	Apache Struts. Attackers can run their own code on Apache Struts.	At work
`CVE-2018-0802`† Used in ransomwareAt home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2018-0798`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2018-0296`At work	Cisco Adaptive Security Appliance (ASA). Attackers can read files on Cisco Adaptive Security Appliance (ASA) that should be out of reach from anywhere, without logging in.	At work
`CVE-2018-0171`At work	Cisco IOS and IOS XE. Attackers can run their own code on Cisco IOS and IOS XE from anywhere, without logging in.	At work
`CVE-2017-9822`† Used in ransomwareAt work	DotNetNuke (DNN). Attackers can run their own code on DotNetNuke (DNN).	At work
`CVE-2017-9805`At work	Apache Struts. Attackers can run their own code on Apache Struts.	At work
`CVE-2017-9248`At work	Progress ASP.NET AJAX and Sitefinity. Attackers can upload a file to Progress ASP.NET AJAX and Sitefinity and make it run.	At work
`CVE-2017-8759`At home	Microsoft .NET Framework. Opening a booby-trapped file can let an attacker run their own code through Microsoft .NET Framework.	At home
`CVE-2017-7269`At work	Microsoft Internet Information Services (IIS). Attackers can run their own code on Microsoft Internet Information Services (IIS).	At work
`CVE-2017-6327`At work	Symantec Messaging Gateway. Attackers can run their own code on Symantec Messaging Gateway.	At work
`CVE-2017-5638`† Used in ransomwareAt work	Apache Struts. Opening a booby-trapped file can let an attacker run their own code through Apache Struts.	At work
`CVE-2017-16651`At work	Roundcube Webmail. Attackers are using a flaw in Roundcube Webmail.	At work
`CVE-2017-11882`† Used in ransomwareAt home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2017-11774`At home	Microsoft Office. Attackers can run commands on Microsoft Office.	At home
`CVE-2017-0199`† Used in ransomwareAt home	Microsoft Office and WordPad. Opening a booby-trapped file can let an attacker run their own code through Microsoft Office and WordPad.	At home
`CVE-2017-0143`† Used in ransomwareAt home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2016-9563`At work	SAP NetWeaver. Attackers can read files on SAP NetWeaver that should be out of reach.	At work
`CVE-2016-7255`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2016-4437`At work	Apache Shiro. Attackers can run their own code on Apache Shiro.	At work
`CVE-2016-3976`At work	SAP NetWeaver. Attackers can read files on SAP NetWeaver that should be out of reach.	At work
`CVE-2016-3718`At work	ImageMagick. Attackers can make ImageMagick send requests into the network behind it.	At work
`CVE-2016-3715`At work	ImageMagick. Attackers are using a flaw in ImageMagick that its maker hasn't described in detail.	At work
`CVE-2016-3643`At work	SolarWinds Virtualization Manager. Someone who already has a foothold can use SolarWinds Virtualization Manager to take full control of the machine.	At work
`CVE-2016-3235`At home	Microsoft Office. Someone who already has a way in can use Microsoft Office to run their own code.	At home
`CVE-2016-0185`At home	Microsoft Windows. Opening a booby-trapped file can let an attacker run their own code through Microsoft Windows.	At home
`CVE-2016-0167`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2015-4852`At work	Oracle WebLogic Server. Attackers can run their own code on Oracle WebLogic Server.	At work
`CVE-2015-1641`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2014-1812`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2012-3152`At work	Oracle Fusion Middleware. Attackers can run their own code on Oracle Fusion Middleware.	At work
`CVE-2012-0158`† Used in ransomwareAt work	Microsoft MSCOMCTL.OCX. Attackers can run their own code on Microsoft MSCOMCTL.OCX.	At work
`CVE-2010-5326`At work	SAP NetWeaver. Attackers can run their own code on SAP NetWeaver.	At work

Companies

The flaws were in 66 companies’ products; the most were in Microsoft’s (82).

Company	Flaws	Ransomware
Microsoft	82	35
Apple	23	–
Google	22	–
Cisco	11	1
Apache	9	3
Ivanti	9	3
VMware	8	5
Oracle	7	–
Trend Micro	7	–
Citrix	6	3
SAP	6	1
Adobe	5	1
SonicWall	5	5
Accellion	4	4
Atlassian	4	3
51 others	83

Other months

Every month since CISA started the list; November 2021 is outlined.

Flaws added to CISA’s list each month
Year	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec	Total
2026	17	28	26	31	21	23	26	31	43	36			282
2025	14	27	32	15	24	20	20	15	16	31	11	20	245
2024	21	9	10	10	14	9	14	19	25	17	22	16	186
2023	5	14	18	17	19	24	16	8	19	18	18	11	187
2022	40	32	226	45	83	48	3	23	24	12	10	9	555
2021											291	20	311

2026282 flaws

Jan17 Feb28 Mar26 Apr31 May21 Jun23 Jul26 Aug31 Sep43 Oct36NovDec

2025245 flaws

Jan14 Feb27 Mar32 Apr15 May24 Jun20 Jul20 Aug15 Sep16 Oct31 Nov11 Dec20

2024186 flaws

Jan21 Feb9 Mar10 Apr10 May14 Jun9 Jul14 Aug19 Sep25 Oct17 Nov22 Dec16

2023187 flaws

Jan5 Feb14 Mar18 Apr17 May19 Jun24 Jul16 Aug8 Sep19 Oct18 Nov18 Dec11

2022555 flaws

Jan40 Feb32 Mar226 Apr45 May83 Jun48 Jul3 Aug23 Sep24 Oct12 Nov10 Dec9

2021311 flaws

JanFebMarAprMayJunJulAugSepOctNov291 Dec20

References

^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.