Flaws added in May 2022
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in May 2022. For the newest, see Exploited flaws.
In May 2022, CISA added 83 flaws to its list of vulnerabilities being used in attacks, 65 of them in things people have at home; 18 have been used by ransomware gangs. Most came from Microsoft (37), Apple (8) and Adobe (7).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the second most CISA added in any month of 2022.
List of flaws
Every flaw CISA added in May 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
34 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2019-3010At work |
Oracle Solaris. Someone who already has a foothold can use Oracle Solaris to take full control of the machine. | At work |
CVE-2016-7256At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2016-3393At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2016-1010At home |
Adobe Flash Player and AIR. Attackers can run their own code on Adobe Flash Player and AIR. | At home |
CVE-2016-0984At home |
Adobe Flash Player and AIR. Attackers can run their own code on Adobe Flash Player and AIR. | At home |
CVE-2016-0034† Used in ransomwareAt home |
Microsoft Silverlight. Attackers can run their own code on Microsoft Silverlight. | At home |
CVE-2015-8651At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2015-6175At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2015-4495At home |
Mozilla Firefox. Attackers can read files on Mozilla Firefox that should be out of reach. | At home |
CVE-2015-2425At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2015-2360At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
CVE-2015-1769At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2015-1671At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2015-0310At home |
Adobe Flash Player. Attackers are using a flaw in Adobe Flash Player that its maker hasn't described in detail. | At home |
CVE-2015-0071At home |
Microsoft Internet Explorer. Attackers are using a flaw in Microsoft Internet Explorer. | At home |
CVE-2015-0016At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2014-8439At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2014-4148At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2014-4123At home |
Microsoft Internet Explorer. Someone who already has a foothold can use Microsoft Internet Explorer to take full control of the machine. | At home |
CVE-2014-4077At work |
Microsoft Input Method Editor (IME) Japanese. Someone who already has a foothold can use Microsoft Input Method Editor (IME) Japanese to take full control of the machine. | At work |
CVE-2014-3153At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2014-2817At home |
Microsoft Internet Explorer. Someone who already has a foothold can use Microsoft Internet Explorer to take full control of the machine. | At home |
CVE-2014-0546At home |
Adobe Reader and Acrobat. Attackers can get past a security protection in Adobe Reader and Acrobat. | At home |
CVE-2013-7331At home |
Microsoft Internet Explorer. Attackers can read information from Microsoft Internet Explorer that should be private. | At home |
CVE-2013-3993† Used in ransomwareAt work |
IBM InfoSphere BigInsights. Attackers are using a flaw in IBM InfoSphere BigInsights that its maker hasn't described in detail. | At work |
CVE-2013-3896At home |
Microsoft Silverlight. Attackers can read information from Microsoft Silverlight that should be private. | At home |
CVE-2013-2423At home |
Oracle Java Runtime Environment (JRE). Attackers can corrupt memory in Oracle Java Runtime Environment (JRE), which they use to take it over. | At home |
CVE-2013-0431† Used in ransomwareAt home |
Oracle Java Runtime Environment (JRE). Attackers are using a flaw in Oracle Java Runtime Environment (JRE) that its maker hasn't described in detail. | At home |
CVE-2013-0422† Used in ransomwareAt home |
Oracle Java Runtime Environment (JRE). Attackers can run their own code on Oracle Java Runtime Environment (JRE). | At home |
CVE-2013-0074† Used in ransomwareAt home |
Microsoft Silverlight. Attackers can run their own code on Microsoft Silverlight. | At home |
CVE-2012-1710† Used in ransomwareAt work |
Oracle Fusion Middleware. Attackers are using a flaw in Oracle Fusion Middleware that its maker hasn't described in detail. | At work |
CVE-2010-1428† Used in ransomwareAt work |
Red Hat JBoss. Attackers can reach parts of Red Hat JBoss that should be locked to them from anywhere, without logging in. | At work |
CVE-2010-0840At home |
Oracle Java Runtime Environment (JRE). Attackers can run their own code on Oracle Java Runtime Environment (JRE). | At home |
CVE-2010-0738† Used in ransomwareAt work |
Red Hat JBoss. Attackers can get into Red Hat JBoss without a valid password. | At work |
20 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2018-8611At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2018-19953† Used in ransomwareAt home |
QNAP Network Attached Storage (NAS). Attackers can run code in the browser of someone using QNAP Network Attached Storage (NAS) and act as them. | At home |
CVE-2018-19949† Used in ransomwareAt home |
QNAP Network Attached Storage (NAS). Attackers can run commands on QNAP Network Attached Storage (NAS). | At home |
CVE-2018-19943† Used in ransomwareAt home |
QNAP Network Attached Storage (NAS). Attackers can run code in the browser of someone using QNAP Network Attached Storage (NAS) and act as them. | At home |
CVE-2017-8543At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2017-8291At work |
Artifex Ghostscript. Attackers can corrupt memory in Artifex Ghostscript, which they use to take it over. | At work |
CVE-2017-18362† Used in ransomwareAt work |
Kaseya Virtual System/Server Administrator (VSA). Attackers can read or change the database behind Kaseya Virtual System/Server Administrator (VSA) from anywhere, without logging in. | At work |
CVE-2017-0210At home |
Microsoft Internet Explorer. Someone who already has a foothold can use Microsoft Internet Explorer to take full control of the machine. | At home |
CVE-2017-0149At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2017-0147† Used in ransomwareAt work |
Microsoft SMBv1 server. Attackers can read information from Microsoft SMBv1 server that should be private. | At work |
CVE-2017-0022At home |
Microsoft XML Core Services. Attackers can read information from Microsoft XML Core Services that should be private. | At home |
CVE-2017-0005At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2016-6367At work |
Cisco Adaptive Security Appliance (ASA). Someone who already has a way in can use Cisco Adaptive Security Appliance (ASA) to run their own code. | At work |
CVE-2016-6366At work |
Cisco Adaptive Security Appliance (ASA). Someone who already has a way in can use Cisco Adaptive Security Appliance (ASA) to run their own code. | At work |
CVE-2016-4657At home |
Apple iOS. Attackers can run their own code on Apple iOS. | At home |
CVE-2016-4656At home |
Apple iOS. Attackers can run their own code on Apple iOS. | At home |
CVE-2016-4655At home |
Apple iOS. Attackers can read information from Apple iOS that should be private. | At home |
CVE-2016-3351† Used in ransomwareAt home |
Microsoft Internet Explorer and Edge. Attackers can read information from Microsoft Internet Explorer and Edge that should be private. | At home |
CVE-2016-3298At home |
Microsoft Internet Explorer. Attackers can read information from Microsoft Internet Explorer that should be private. | At home |
CVE-2016-0162At home |
Microsoft Internet Explorer. Attackers can read information from Microsoft Internet Explorer that should be private. | At home |
21 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-20821At work |
Cisco IOS XR. Attackers are using a flaw in Cisco IOS XR. | At work |
CVE-2021-30883At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2021-1048At home |
Android Kernel. Someone who already has a foothold can use Android Kernel to take full control of the machine. | At home |
CVE-2021-0920At home |
Android Kernel. Someone who already has a foothold can use Android Kernel to take full control of the machine. | At home |
CVE-2020-1027At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2020-0638† Used in ransomwareAt work |
Microsoft Update Notification Manager. Someone who already has a foothold can use Microsoft Update Notification Manager to take full control of the machine. | At work |
CVE-2019-8720At work |
WebKitGTK. Attackers can run their own code on WebKitGTK. | At work |
CVE-2019-7287At home |
Apple iOS. Attackers can run their own code on Apple iOS. | At home |
CVE-2019-7286At home |
Apple devices. Someone who already has a foothold can use Apple devices to take full control of the machine. | At home |
CVE-2019-5786At home |
Google Chrome Blink. A booby-trapped web page can corrupt memory in Google Chrome Blink, which attackers use to take it over. | At home |
CVE-2019-18426At home |
Meta Platforms WhatsApp. Attackers can run code in the browser of someone using Meta Platforms WhatsApp and act as them. | At home |
CVE-2019-1385† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2019-13720At home |
Google Chrome WebAudio. A booby-trapped web page can corrupt memory in Google Chrome WebAudio, which attackers use to take it over. | At home |
CVE-2019-11708At home |
Mozilla Firefox and Thunderbird. Attackers can run their own code on Mozilla Firefox and Thunderbird. | At home |
CVE-2019-11707At home |
Mozilla Firefox and Thunderbird. Attackers can corrupt memory in Mozilla Firefox and Thunderbird, which they use to take it over. | At home |
CVE-2019-1130† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2019-0880At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2019-0703At home |
Microsoft Windows. Attackers can read information from Microsoft Windows that should be private. | At home |
CVE-2019-0676At home |
Microsoft Internet Explorer. Attackers can read information from Microsoft Internet Explorer that should be private. | At home |
CVE-2018-8589At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
CVE-2018-5002At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-30525At home |
Zyxel Multiple Firewalls. Attackers can run commands on Zyxel Multiple Firewalls. | At home |
CVE-2022-22947At work |
VMware Spring Cloud Gateway. Attackers can run their own code on VMware Spring Cloud Gateway. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-1388† Used in ransomwareAt work |
F5 BIG-IP. Attackers can run their own code on F5 BIG-IP. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-1789At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2019-8506At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2014-4113At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
CVE-2014-0322At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2014-0160At work |
OpenSSL. Attackers can read information from OpenSSL that should be private. | At work |
Companies
The flaws were in 20 companies’ products; the most were in Microsoft’s (37).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 37 | 7 |
| Apple | 8 | – |
| Adobe | 7 | – |
| Oracle | 6 | 3 |
| Cisco | 3 | – |
| Mozilla | 3 | – |
| QNAP | 3 | 3 |
| Android | 2 | – |
| 2 | – | |
| Red Hat | 2 | 2 |
| Artifex | 1 | – |
| F5 | 1 | 1 |
| IBM | 1 | 1 |
| Kaseya | 1 | 1 |
| Linux | 1 | – |
| 5 others | 5 |
Other months
Every month since CISA started the list; May 2022 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.