Flaws added in April 2022
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in April 2022. For the newest, see Exploited flaws.
In April 2022, CISA added 45 flaws to its list of vulnerabilities being used in attacks, 21 of them in things people have at home; 10 have been used by ransomware gangs. Most came from Microsoft (11), Adobe (6) and VMware (3).[1]
Almost all let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in April 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
7 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-29464† Used in ransomwareAt work |
WSO2 products. Attackers can run their own code on WSO2 products. | At work |
CVE-2022-26904At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2022-21919At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2022-0847At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2021-41357At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
CVE-2021-40450At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
CVE-2019-1003029At work |
Jenkins Script Security Plugin. Attackers can run their own code on Jenkins Script Security Plugin. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-22718At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2019-3568At home |
Meta Platforms WhatsApp. Attackers can run their own code on Meta Platforms WhatsApp. | At home |
CVE-2018-6882† Used in ransomwareAt work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can run code in the browser of someone using Synacor Zimbra Collaboration Suite (ZCS) and act as them. | At work |
9 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-22960At work |
VMware products. Someone who already has a foothold can use VMware products to take full control of the machine. | At work |
CVE-2022-1364At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2019-3929At work |
Crestron products. Attackers can run commands on Crestron products from anywhere, without logging in. | At work |
CVE-2019-16057† Used in ransomwareAt home |
D-Link DNS-320 Storage Device. Attackers can run their own code on D-Link DNS-320 Storage Device. | At home |
CVE-2018-7841At work |
Schneider Electric U.motion Builder. Attackers can run their own code on Schneider Electric U.motion Builder. | At work |
CVE-2016-4523At work |
Trihedral VTScada (formerly VTS). Attackers can corrupt memory in Trihedral VTScada (formerly VTS), which they use to take it over. | At work |
CVE-2014-0780At work |
InduSoft Web Studio. Attackers can run their own code on InduSoft Web Studio. | At work |
CVE-2010-5330At work |
Ubiquiti AirOS. Attackers can run commands on Ubiquiti AirOS. | At work |
CVE-2007-3010At work |
Alcatel OmniPCX Enterprise. Attackers can run their own code on Alcatel OmniPCX Enterprise. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-22954† Used in ransomwareAt work |
VMware Workspace ONE Access and Identity Manager. Attackers can run their own code on VMware Workspace ONE Access and Identity Manager. | At work |
10 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-24521† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2018-7602† Used in ransomwareAt work |
Drupal Core. Attackers can run their own code on Drupal Core. | At work |
CVE-2018-20753† Used in ransomwareAt work |
Kaseya Virtual System/Server Administrator (VSA). Attackers can run their own code on Kaseya Virtual System/Server Administrator (VSA). | At work |
CVE-2015-5123At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2015-5122At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2015-3113At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2015-2502At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2015-0313At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2015-0311At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2014-9163At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
8 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-23176At work |
WatchGuard Firebox and XTM. Someone who already has a foothold can use WatchGuard Firebox and XTM to take full control of the machine. | At work |
CVE-2021-42287† Used in ransomwareAt work |
Microsoft Active Directory. Someone who already has a foothold can use Microsoft Active Directory to take full control of the machine. | At work |
CVE-2021-42278† Used in ransomwareAt work |
Microsoft Active Directory. Someone who already has a foothold can use Microsoft Active Directory to take full control of the machine. | At work |
CVE-2021-39793At home |
Google Pixel. Someone who already has a foothold can use Google Pixel to take full control of the machine. | At home |
CVE-2021-27852At work |
Checkbox Survey. Attackers can run their own code on Checkbox Survey from anywhere, without logging in. | At work |
CVE-2021-22600At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2020-2509At home |
QNAP Network-Attached Storage (NAS). Attackers can run their own code on QNAP Network-Attached Storage (NAS). | At home |
CVE-2017-11317At work |
Telerik User Interface (UI) for ASP.NET AJAX. Attackers can run their own code on Telerik User Interface (UI) for ASP.NET AJAX. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-3156At work |
Sudo. Someone who already has a foothold can use Sudo to take full control of the machine. | At work |
CVE-2021-31166At work |
Microsoft HTTP Protocol Stack. Attackers can run their own code on Microsoft HTTP Protocol Stack. | At work |
CVE-2017-0148† Used in ransomwareAt work |
Microsoft SMBv1 server. Attackers can run their own code on Microsoft SMBv1 server. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-22965At work |
VMware Spring Framework. Attackers can run their own code on VMware Spring Framework. | At work |
CVE-2022-22675At home |
Apple macOS. Attackers can run their own code on Apple macOS. | At home |
CVE-2022-22674At home |
Apple macOS. Someone who already has a way in can corrupt memory in Apple macOS to take more control. | At home |
CVE-2021-45382At home |
D-Link Multiple Routers. Attackers can run their own code on D-Link Multiple Routers. | At home |
Companies
The flaws were in 24 companies’ products; the most were in Microsoft’s (11).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 11 | 4 |
| Adobe | 6 | – |
| VMware | 3 | 1 |
| Apple | 2 | – |
| D-Link | 2 | 1 |
| 2 | – | |
| Linux | 2 | – |
| Alcatel | 1 | – |
| Checkbox | 1 | – |
| Crestron | 1 | – |
| Drupal | 1 | 1 |
| InduSoft | 1 | – |
| Jenkins | 1 | – |
| Kaseya | 1 | 1 |
| Meta Platforms | 1 | – |
| 9 others | 9 |
Other months
Every month since CISA started the list; April 2022 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.