Flaws added in March 2022

From Exploited flaws, HARD’s guide to the flaws being used in attacks

This article lists the flaws CISA added in March 2022. For the newest, see Exploited flaws.

March 2022

Flaws added each day; used in ransomware

Flaws added	226
In things at home	108
Used in ransomware	51
Companies	49
Most from	Microsoft 70Cisco 44Adobe 26
Busiest day	3 Mar 2022 95
Next month	April 2022 45
Month before	February 2022 32
Source	CISA KEV, version 2026.10.30

In March 2022, CISA added 226 flaws to its list of vulnerabilities being used in attacks, 108 of them in things people have at home; 51 have been used by ransomware gangs. Most came from Microsoft (70), Cisco (44) and Adobe (26).^[1]

Most let an attacker take over the product, running their own code or taking full control. It was the most CISA added in any month of 2022.

List of flaws

Every flaw CISA added in March 2022, newest first, in plain English, each with an article of its own.^[2] marks the ones used in ransomware.

Thursday 31 March 2022 7 added

CVE	Flaw	Found
`CVE-2022-26871`At work	Trend Micro Apex Central. Attackers can run their own code on Trend Micro Apex Central from anywhere, without logging in.	At work
`CVE-2022-1040`At work	Sophos Firewall. Attackers can run their own code on Sophos Firewall.	At work
`CVE-2021-34484`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-28799`† Used in ransomwareAt home	QNAP Network Attached Storage (NAS). Attackers are using a flaw in QNAP Network Attached Storage (NAS).	At home
`CVE-2021-21551`At work	Dell dbutil Driver. Someone who already has a foothold can use Dell dbutil Driver to take full control of the machine.	At work
`CVE-2018-10562`† Used in ransomwareAt work	Dasan Gigabit Passive Optical Network (GPON) Routers. Attackers can run their own code on Dasan Gigabit Passive Optical Network (GPON) Routers.	At work
`CVE-2018-10561`At work	Dasan Gigabit Passive Optical Network (GPON) Routers. Attackers can run their own code on Dasan Gigabit Passive Optical Network (GPON) Routers.	At work

Monday 28 March 2022 32 added

CVE	Flaw	Found
`CVE-2022-1096`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2022-0543`At work	Redis Debian-specific Redis Servers. Attackers can run their own code on Redis Debian-specific Redis Servers.	At work
`CVE-2021-38646`† Used in ransomwareAt home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2021-34486`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-26085`† Used in ransomwareAt work	Atlassian Confluence Server. Attackers can read files on Atlassian Confluence Server that should be out of reach from anywhere, without logging in.	At work
`CVE-2021-20028`† Used in ransomwareAt work	SonicWall Secure Remote Access (SRA). Attackers can read or change the database behind SonicWall Secure Remote Access (SRA).	At work
`CVE-2019-7483`At work	SonicWall SMA100. Attackers can read files on SonicWall SMA100 that should be out of reach from anywhere, without logging in.	At work
`CVE-2018-8440`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2018-8406`† Used in ransomwareAt work	Microsoft DirectX Graphics Kernel (DXGKRNL). Someone who already has a foothold can use Microsoft DirectX Graphics Kernel (DXGKRNL) to take full control of the machine.	At work
`CVE-2018-8405`† Used in ransomwareAt work	Microsoft DirectX Graphics Kernel (DXGKRNL). Someone who already has a foothold can use Microsoft DirectX Graphics Kernel (DXGKRNL) to take full control of the machine.	At work
`CVE-2017-0213`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2017-0059`At home	Microsoft Internet Explorer. Attackers can read information from Microsoft Internet Explorer that should be private.	At home
`CVE-2017-0037`At home	Microsoft Edge and Internet Explorer. Attackers can run their own code on Microsoft Edge and Internet Explorer.	At home
`CVE-2016-7201`At home	Microsoft Edge. Attackers can run their own code on Microsoft Edge.	At home
`CVE-2016-7200`At home	Microsoft Edge. Attackers can run their own code on Microsoft Edge.	At home
`CVE-2016-0189`† Used in ransomwareAt home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2016-0151`† Used in ransomwareAt work	Microsoft Client-Server Run-time Subsystem (CSRSS). Attackers can get past a security protection in Microsoft Client-Server Run-time Subsystem (CSRSS).	At work
`CVE-2016-0040`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2015-2426`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2015-2419`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2015-1770`At home	Microsoft Office. Opening a booby-trapped file can let an attacker run their own code through Microsoft Office.	At home
`CVE-2013-3660`At home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2013-2729`At home	Adobe Reader and Acrobat. Attackers can run their own code on Adobe Reader and Acrobat.	At home
`CVE-2013-2551`† Used in ransomwareAt home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2013-2465`† Used in ransomwareAt home	Oracle Java SE. Attackers are using a flaw in Oracle Java SE that its maker hasn't described in detail.	At home
`CVE-2013-1690`At home	Mozilla Firefox and Thunderbird. Attackers can run their own code on Mozilla Firefox and Thunderbird.	At home
`CVE-2012-5076`At home	Oracle Java SE. Attackers are using a flaw in Oracle Java SE that its maker hasn't described in detail.	At home
`CVE-2012-2539`At home	Microsoft Word. Attackers can run their own code on Microsoft Word.	At home
`CVE-2012-2034`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2012-0518`At work	Oracle Fusion Middleware. Attackers are using a flaw in Oracle Fusion Middleware that its maker hasn't described in detail.	At work
`CVE-2011-2005`At work	Microsoft Ancillary Function Driver (afd.sys). Someone who already has a foothold can use Microsoft Ancillary Function Driver (afd.sys) to take full control of the machine.	At work
`CVE-2010-4398`At home	Microsoft Windows. Someone who already has a way in can corrupt memory in Microsoft Windows to take more control.	At home

Friday 25 March 2022 66 added

CVE	Flaw	Found
`CVE-2022-26318`At work	WatchGuard Firebox and XTM Appliances. Attackers can run their own code on WatchGuard Firebox and XTM Appliances from anywhere, without logging in.	At work
`CVE-2022-26143`At work	Mitel MiCollab, MiVoice Business Express. Attackers can reach parts of Mitel MiCollab, MiVoice Business Express that should be locked to them.	At work
`CVE-2022-21999`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2021-42237`† Used in ransomwareAt work	Sitecore XP. Attackers can run their own code on Sitecore XP from anywhere, without logging in.	At work
`CVE-2021-22941`† Used in ransomwareAt work	Citrix ShareFile. Attackers can reach parts of Citrix ShareFile that should be locked to them from anywhere, without logging in.	At work
`CVE-2020-9377`At home	D-Link DIR-610 Devices. Attackers can run their own code on D-Link DIR-610 Devices.	At home
`CVE-2020-9054`At home	Zyxel Multiple Network-Attached Storage (NAS) Devices. Attackers can run their own code on Zyxel Multiple Network-Attached Storage (NAS) Devices from anywhere, without logging in.	At home
`CVE-2020-7247`At work	OpenBSD OpenSMTPD. Attackers can run their own code on OpenBSD OpenSMTPD.	At work
`CVE-2020-5410`At work	VMware Tanzu Spring Cloud Configuration (Config) Server. Attackers can read files on VMware Tanzu Spring Cloud Configuration (Config) Server that should be out of reach.	At work
`CVE-2020-25223`At work	Sophos SG UTM. Attackers can run their own code on Sophos SG UTM.	At work
`CVE-2020-2506`At home	QNAP Systems Helpdesk. Attackers can reach parts of QNAP Systems Helpdesk that should be locked to them.	At home
`CVE-2020-2021`† Used in ransomwareAt work	Palo Alto Networks PAN-OS. Attackers can get into Palo Alto Networks PAN-OS without a valid password.	At work
`CVE-2020-1956`At work	Apache Kylin. Attackers can run their own code on Apache Kylin.	At work
`CVE-2020-1631`At work	Juniper Junos OS. Attackers can run their own code on Juniper Junos OS from anywhere, without logging in.	At work
`CVE-2019-6340`At work	Drupal Core. Attackers can run their own code on Drupal Core.	At work
`CVE-2019-2616`At work	Oracle BI Publisher (Formerly XML Publisher). Attackers can get into Oracle BI Publisher (Formerly XML Publisher) without a valid password.	At work
`CVE-2019-16920`At home	D-Link Multiple Routers. Attackers can run their own code on D-Link Multiple Routers from anywhere, without logging in.	At home
`CVE-2019-15107`† Used in ransomwareAt work	Webmin. Attackers can run commands on Webmin.	At work
`CVE-2019-12991`At work	Citrix SD-WAN and NetScaler. Attackers can run commands on Citrix SD-WAN and NetScaler.	At work
`CVE-2019-12989`At work	Citrix SD-WAN and NetScaler. Attackers can read or change the database behind Citrix SD-WAN and NetScaler.	At work
`CVE-2019-11043`† Used in ransomwareAt work	PHP FastCGI Process Manager (FPM). Attackers can run their own code on PHP FastCGI Process Manager (FPM).	At work
`CVE-2019-10068`At work	Kentico Xperience. Attackers can run their own code on Kentico Xperience from anywhere, without logging in.	At work
`CVE-2019-1003030`At work	Jenkins Matrix Project Plugin. Attackers can run their own code on Jenkins Matrix Project Plugin.	At work
`CVE-2019-0903`At home	Microsoft Graphics Device Interface (GDI). Attackers can run their own code on Microsoft Graphics Device Interface (GDI).	At home
`CVE-2018-8414`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2018-8373`At home	Microsoft Internet Explorer Scripting Engine. Attackers can run their own code on Microsoft Internet Explorer Scripting Engine.	At home
`CVE-2018-6961`At work	VMware SD-WAN Edge. Attackers can run their own code on VMware SD-WAN Edge.	At work
`CVE-2018-14839`At work	LG N1A1 NAS. Attackers can run their own code on LG N1A1 NAS.	At work
`CVE-2018-1273`† Used in ransomwareAt work	VMware Tanzu Spring Data Commons. Attackers can run their own code on VMware Tanzu Spring Data Commons from anywhere, without logging in.	At work
`CVE-2018-11138`† Used in ransomwareAt work	Quest KACE System Management Appliance. Attackers can run their own code on Quest KACE System Management Appliance.	At work
`CVE-2018-0147`At work	Cisco Secure Access Control System (ACS). Attackers can run commands on Cisco Secure Access Control System (ACS) from anywhere, without logging in.	At work
`CVE-2018-0125`At work	Cisco VPN Routers. Attackers can run their own code on Cisco VPN Routers from anywhere, without logging in.	At work
`CVE-2017-6334`At home	NETGEAR DGN2200 Devices. Someone who already has a way in can use NETGEAR DGN2200 Devices to run their own code.	At home
`CVE-2017-6316`At work	Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server. Attackers can run their own code on Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server from anywhere, without logging in.	At work
`CVE-2017-3881`At work	Cisco IOS and IOS XE. Attackers can run their own code on Cisco IOS and IOS XE from anywhere, without logging in.	At work
`CVE-2017-12617`At work	Apache Tomcat. Attackers can run their own code on Apache Tomcat.	At work
`CVE-2017-12615`† Used in ransomwareAt work	Apache Tomcat. Attackers can run their own code on Apache Tomcat.	At work
`CVE-2017-0146`† Used in ransomwareAt home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2016-7892`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2016-4171`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2016-1555`At home	NETGEAR Wireless Access Point (WAP) Devices. Attackers can run their own code on NETGEAR Wireless Access Point (WAP) Devices from anywhere, without logging in.	At home
`CVE-2016-11021`At home	D-Link DCS-930L Devices. Attackers can run their own code on D-Link DCS-930L Devices.	At home
`CVE-2016-10174`At home	NETGEAR WNR2000v5 Router. Attackers can run their own code on NETGEAR WNR2000v5 Router from anywhere, without logging in.	At home
`CVE-2016-0752`At work	Rails Ruby on Rails. Attackers can read files on Rails Ruby on Rails that should be out of reach.	At work
`CVE-2015-4068`At work	Arcserve Unified Data Protection (UDP). Attackers can read files on Arcserve Unified Data Protection (UDP) that should be out of reach.	At work
`CVE-2015-3035`At home	TP-Link Multiple Archer Devices. Attackers can read files on TP-Link Multiple Archer Devices that should be out of reach.	At home
`CVE-2015-1427`At work	Elasticsearch. Attackers can run their own code on Elasticsearch.	At work
`CVE-2015-1187`At home	D-Link and TRENDnet Multiple Devices. Attackers can run their own code on D-Link and TRENDnet Multiple Devices.	At home
`CVE-2015-0666`At work	Cisco Prime Data Center Network Manager (DCNM). Attackers can read files on Cisco Prime Data Center Network Manager (DCNM) that should be out of reach.	At work
`CVE-2014-6332`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2014-6324`At work	Microsoft Kerberos Key Distribution Center (KDC). Someone who already has a foothold can use Microsoft Kerberos Key Distribution Center (KDC) to take full control of the machine.	At work
`CVE-2014-6287`At work	Rejetto HTTP File Server (HFS). Attackers can run their own code on Rejetto HTTP File Server (HFS).	At work
`CVE-2014-3120`At work	Elasticsearch. Attackers can run their own code on Elasticsearch.	At work
`CVE-2014-0130`At work	Rails Ruby on Rails. Attackers can read files on Rails Ruby on Rails that should be out of reach.	At work
`CVE-2013-5223`At home	D-Link DSL-2760U. Attackers can run code in the browser of someone using D-Link DSL-2760U and act as them.	At home
`CVE-2013-4810`At work	Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management. Attackers can run their own code on Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management.	At work
`CVE-2013-2251`At work	Apache Struts. Attackers are using a flaw in Apache Struts.	At work
`CVE-2012-1823`At work	PHP. Attackers can run their own code on PHP.	At work
`CVE-2010-4345`At work	Exim. Someone who already has a way in can use Exim to run their own code.	At work
`CVE-2010-4344`At work	Exim. Attackers can run their own code on Exim.	At work
`CVE-2010-3035`At work	Cisco IOS XR. Attackers can crash Cisco IOS XR or stop it working.	At work
`CVE-2010-2861`† Used in ransomwareAt work	Adobe ColdFusion. Attackers can read files on Adobe ColdFusion that should be out of reach.	At work
`CVE-2009-2055`At work	Cisco IOS XR. Attackers can crash Cisco IOS XR or stop it working.	At work
`CVE-2009-1151`At work	phpMyAdmin. Attackers can run their own code on phpMyAdmin.	At work
`CVE-2009-0927`At home	Adobe Reader and Acrobat. Attackers can run their own code on Adobe Reader and Acrobat.	At home
`CVE-2005-2773`At work	Hewlett Packard (HP) OpenView Network Node Manager. Attackers can run their own code on Hewlett Packard (HP) OpenView Network Node Manager.	At work

Tuesday 15 March 2022 15 added

CVE	Flaw	Found
`CVE-2020-5135`† Used in ransomwareAt work	SonicWall SonicOS. Attackers can run their own code on SonicWall SonicOS.	At work
`CVE-2019-1405`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-1322`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-1315`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-1253`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-1132`At home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2019-1129`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-1069`† Used in ransomwareAt work	Microsoft Task Scheduler. Attackers can run their own code on Microsoft Task Scheduler.	At work
`CVE-2019-1064`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-0841`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2019-0543`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2018-8120`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2017-0101`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2016-3309`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a way in can use Microsoft Windows to run their own code.	At home
`CVE-2015-2546`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home

Monday 7 March 2022 11 added

CVE	Flaw	Found
`CVE-2022-26486`At home	Mozilla Firefox. Attackers can run their own code on Mozilla Firefox.	At home
`CVE-2022-26485`At home	Mozilla Firefox. Attackers can run their own code on Mozilla Firefox.	At home
`CVE-2021-21973`At work	VMware vCenter Server and Cloud Foundation. Attackers can make VMware vCenter Server and Cloud Foundation send requests into the network behind it.	At work
`CVE-2020-8218`At work	Pulse Secure Pulse Connect Secure. Attackers can run their own code on Pulse Secure Pulse Connect Secure.	At work
`CVE-2019-11581`At work	Atlassian Jira Server and Data Center. Attackers can run their own code on Atlassian Jira Server and Data Center.	At work
`CVE-2017-6077`At home	NETGEAR Wireless Router DGN2200. Someone who already has a way in can use NETGEAR Wireless Router DGN2200 to run their own code.	At home
`CVE-2016-6277`At home	NETGEAR Multiple Routers. Attackers can run their own code on NETGEAR Multiple Routers from anywhere, without logging in.	At home
`CVE-2013-0631`At work	Adobe ColdFusion. Attackers can read information from Adobe ColdFusion that should be private.	At work
`CVE-2013-0629`At work	Adobe ColdFusion. Attackers can read files on Adobe ColdFusion that should be out of reach.	At work
`CVE-2013-0625`At work	Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion.	At work
`CVE-2009-3960`† Used in ransomwareAt work	Adobe BlazeDS. Attackers can read information from Adobe BlazeDS that should be private.	At work

Thursday 3 March 2022 95 added

CVE	Flaw	Found
`CVE-2022-20708`At work	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Attackers can run their own code on Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.	At work
`CVE-2022-20703`At work	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Attackers can run their own code on Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.	At work
`CVE-2022-20701`At work	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Attackers can run their own code on Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.	At work
`CVE-2022-20700`At work	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Attackers can run their own code on Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.	At work
`CVE-2022-20699`At work	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Attackers can run their own code on Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.	At work
`CVE-2021-41379`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2020-1938`At work	Apache Tomcat. Attackers can run their own code on Apache Tomcat.	At work
`CVE-2020-11899`At work	Treck TCP/IP stack IPv6. Attackers can corrupt memory in Treck TCP/IP stack IPv6, which they use to take it over.	At work
`CVE-2019-16928`At work	Exim Internet Mailer. Attackers can run their own code on Exim Internet Mailer.	At work
`CVE-2019-1652`At work	Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. Attackers can run commands on Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers.	At work
`CVE-2019-1297`At home	Microsoft Excel. Attackers can run their own code on Microsoft Excel.	At home
`CVE-2018-8581`† Used in ransomwareAt work	Microsoft Exchange Server. Someone who already has a foothold can use Microsoft Exchange Server to take full control of the machine.	At work
`CVE-2018-8298`At work	ChakraCore scripting engine. Attackers can run their own code on ChakraCore scripting engine.	At work
`CVE-2018-0180`At work	Cisco IOS Software. Attackers can crash Cisco IOS Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0179`At work	Cisco IOS Software. Attackers can crash Cisco IOS Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0175`At work	Cisco IOS, XR, and XE Software. Attackers can run their own code on Cisco IOS, XR, and XE Software from anywhere, without logging in.	At work
`CVE-2018-0174`At work	Cisco IOS XE Software. Attackers can crash Cisco IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0173`At work	Cisco IOS and IOS XE Software. Attackers can crash Cisco IOS and IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0172`At work	Cisco IOS and IOS XE Software. Attackers can corrupt memory in Cisco IOS and IOS XE Software from anywhere, without logging in, which they use to take it over.	At work
`CVE-2018-0167`At work	Cisco IOS, XR, and XE Software. Attackers can run their own code on Cisco IOS, XR, and XE Software from anywhere, without logging in.	At work
`CVE-2018-0161`At work	Cisco IOS Software. Attackers can crash Cisco IOS Software or stop it working.	At work
`CVE-2018-0159`At work	Cisco IOS Software and Cisco IOS XE Software. Attackers can crash Cisco IOS Software and Cisco IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0158`At work	Cisco IOS Software and Cisco IOS XE Software. Attackers can read information from Cisco IOS Software and Cisco IOS XE Software that should be private from anywhere, without logging in.	At work
`CVE-2018-0156`At work	Cisco IOS Software and Cisco IOS XE Software. Attackers can crash Cisco IOS Software and Cisco IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0155`At work	Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches. Attackers can crash Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches or stop it working from anywhere, without logging in.	At work
`CVE-2018-0154`At work	Cisco IOS Software. Attackers can crash Cisco IOS Software or stop it working from anywhere, without logging in.	At work
`CVE-2018-0151`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software from anywhere, without logging in.	At work
`CVE-2017-8540`At home	Microsoft Malware Protection Engine. Opening a booby-trapped file can let an attacker run their own code through Microsoft Malware Protection Engine.	At home
`CVE-2017-6744`At work	Cisco IOS software. Attackers can run their own code on Cisco IOS software.	At work
`CVE-2017-6743`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software.	At work
`CVE-2017-6740`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software.	At work
`CVE-2017-6739`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software.	At work
`CVE-2017-6738`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software.	At work
`CVE-2017-6737`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software.	At work
`CVE-2017-6736`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software.	At work
`CVE-2017-6663`At work	Cisco IOS and IOS XE Software. Attackers can crash Cisco IOS and IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2017-6627`At work	Cisco IOS and IOS XE Software. Attackers can crash Cisco IOS and IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12319`At work	Cisco IOS XE Software. Attackers can crash Cisco IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12240`At work	Cisco IOS and IOS XE Software. Attackers can run their own code on Cisco IOS and IOS XE Software from anywhere, without logging in.	At work
`CVE-2017-12238`At work	Cisco Catalyst 6800 Series Switches. Attackers can crash Cisco Catalyst 6800 Series Switches or stop it working from anywhere, without logging in.	At work
`CVE-2017-12237`At work	Cisco IOS and IOS XE Software. Attackers can crash Cisco IOS and IOS XE Software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12235`At work	Cisco IOS software. Attackers can crash Cisco IOS software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12234`At work	Cisco IOS software. Attackers can crash Cisco IOS software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12233`At work	Cisco IOS software. Attackers can crash Cisco IOS software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12232`At work	Cisco IOS software. Attackers can crash Cisco IOS software or stop it working from anywhere, without logging in.	At work
`CVE-2017-12231`At work	Cisco IOS software. Attackers can crash Cisco IOS software or stop it working from anywhere, without logging in.	At work
`CVE-2017-11826`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2017-11292`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2017-0261`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2017-0001`At home	Microsoft Graphics Device Interface (GDI). Someone who already has a foothold can use Microsoft Graphics Device Interface (GDI) to take full control of the machine.	At home
`CVE-2016-8562`At work	Siemens SIMATIC CP. Attackers can reach parts of Siemens SIMATIC CP that should be locked to them.	At work
`CVE-2016-7855`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2016-7262`At home	Microsoft Excel. Attackers can run commands on Microsoft Excel.	At home
`CVE-2016-7193`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2016-5195`At work	Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine.	At work
`CVE-2016-4117`† Used in ransomwareAt home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2016-1019`† Used in ransomwareAt home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2016-0099`† Used in ransomwareAt home	Microsoft Windows. Someone who already has a way in can use Microsoft Windows to run their own code.	At home
`CVE-2015-7645`† Used in ransomwareAt home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2015-5119`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2015-4902`At home	Oracle Java SE. Attackers are using a flaw in Oracle Java SE that its maker hasn't described in detail.	At home
`CVE-2015-3043`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2015-2590`At home	Oracle Java SE. Attackers can run their own code on Oracle Java SE.	At home
`CVE-2015-2545`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2015-2424`At home	Microsoft PowerPoint. Opening a booby-trapped file can let an attacker run their own code through Microsoft PowerPoint.	At home
`CVE-2015-2387`At work	Microsoft ATM Font Driver. Someone who already has a foothold can use Microsoft ATM Font Driver to take full control of the machine.	At work
`CVE-2015-1701`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a way in can use Microsoft Win32k to run their own code.	At home
`CVE-2015-1642`At home	Microsoft Office. Opening a booby-trapped file can let an attacker run their own code through Microsoft Office.	At home
`CVE-2014-4114`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2014-0496`At home	Adobe Reader and Acrobat. Attackers can run their own code on Adobe Reader and Acrobat.	At home
`CVE-2013-5065`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home
`CVE-2013-3897`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2013-3346`At home	Adobe Reader and Acrobat. Attackers can run their own code on Adobe Reader and Acrobat.	At home
`CVE-2013-1675`At home	Mozilla Firefox. Attackers can read information from Mozilla Firefox that should be private.	At home
`CVE-2013-1347`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2013-0641`At home	Adobe Reader. Opening a booby-trapped file can let an attacker run their own code through Adobe Reader.	At home
`CVE-2013-0640`At home	Adobe Reader and Acrobat. Opening a booby-trapped file can let an attacker run their own code through Adobe Reader and Acrobat.	At home
`CVE-2013-0632`At work	Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion.	At work
`CVE-2012-4681`† Used in ransomwareAt home	Oracle Java SE. Attackers can run their own code on Oracle Java SE.	At home
`CVE-2012-1856`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2012-1723`† Used in ransomwareAt home	Oracle Java SE. Attackers can run their own code on Oracle Java SE.	At home
`CVE-2012-1535`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2012-0507`† Used in ransomwareAt home	Oracle Java SE. Attackers can run their own code on Oracle Java SE.	At home
`CVE-2011-3544`At home	Oracle Java SE JDK and JRE. Attackers can run their own code on Oracle Java SE JDK and JRE.	At home
`CVE-2011-1889`At work	Microsoft Forefront Threat Management Gateway (TMG). Attackers can run their own code on Microsoft Forefront Threat Management Gateway (TMG).	At work
`CVE-2011-0611`At home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2010-3333`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2010-0232`At home	Microsoft Windows. Attackers can crash Microsoft Windows or stop it working.	At home
`CVE-2010-0188`† Used in ransomwareAt home	Adobe Reader and Acrobat. Attackers can run their own code on Adobe Reader and Acrobat.	At home
`CVE-2009-3129`At home	Microsoft Excel. Attackers can run their own code on Microsoft Excel.	At home
`CVE-2009-1123`At home	Microsoft Windows. Attackers are using a flaw in Microsoft Windows that its maker hasn't described in detail.	At home
`CVE-2008-3431`At work	Oracle VirtualBox. Someone who already has a way in can use Oracle VirtualBox to run their own code.	At work
`CVE-2008-2992`† Used in ransomwareAt home	Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader.	At home
`CVE-2004-0210`At home	Microsoft Windows. Someone who already has a way in can use Microsoft Windows to run their own code.	At home
`CVE-2002-0367`At home	Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine.	At home

Companies

The flaws were in 49 companies’ products; the most were in Microsoft’s (70).

Company	Flaws	Ransomware
Microsoft	70	27
Cisco	44	–
Adobe	26	7
Oracle	11	4
Apache	5	1
NETGEAR	5	–
Citrix	4	1
D-Link	4	–
Mozilla	4	–
Exim	3	–
SonicWall	3	2
Atlassian	2	1
Dasan	2	1
Elastic	2	–
Hewlett Packard (HP)	2	–
34 others	39

Other months

Every month since CISA started the list; March 2022 is outlined.

Flaws added to CISA’s list each month
Year	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec	Total
2026	17	28	26	31	21	23	26	31	43	36			282
2025	14	27	32	15	24	20	20	15	16	31	11	20	245
2024	21	9	10	10	14	9	14	19	25	17	22	16	186
2023	5	14	18	17	19	24	16	8	19	18	18	11	187
2022	40	32	226	45	83	48	3	23	24	12	10	9	555
2021											291	20	311

2026282 flaws

Jan17 Feb28 Mar26 Apr31 May21 Jun23 Jul26 Aug31 Sep43 Oct36NovDec

2025245 flaws

Jan14 Feb27 Mar32 Apr15 May24 Jun20 Jul20 Aug15 Sep16 Oct31 Nov11 Dec20

2024186 flaws

Jan21 Feb9 Mar10 Apr10 May14 Jun9 Jul14 Aug19 Sep25 Oct17 Nov22 Dec16

2023187 flaws

Jan5 Feb14 Mar18 Apr17 May19 Jun24 Jul16 Aug8 Sep19 Oct18 Nov18 Dec11

2022555 flaws

Jan40 Feb32 Mar226 Apr45 May83 Jun48 Jul3 Aug23 Sep24 Oct12 Nov10 Dec9

2021311 flaws

JanFebMarAprMayJunJulAugSepOctNov291 Dec20

References

^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.