Flaws added in June 2022
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in June 2022. For the newest, see Exploited flaws.
In June 2022, CISA added 48 flaws to its list of vulnerabilities being used in attacks, 41 of them in things people have at home; 8 have been used by ransomware gangs. Most came from Adobe (13), Google (9) and Microsoft (9).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the third most CISA added in any month of 2022.
List of flaws
Every flaw CISA added in June 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
8 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-29499† Used in ransomwareAt work |
Mitel MiVoice Connect. Attackers can run their own code on Mitel MiVoice Connect. | At work |
CVE-2021-4034† Used in ransomwareAt work |
Red Hat Polkit. Attackers can run their own code on Red Hat Polkit. | At work |
CVE-2021-30983At home |
Apple iOS and iPadOS. Attackers can run their own code on Apple iOS and iPadOS. | At home |
CVE-2021-30533At home |
Chrome and other Chromium browsers. Attackers are using a flaw in Chrome and other Chromium browsers. | At home |
CVE-2020-9907At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2020-3837At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2019-8605At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2018-4344At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-30190† Used in ransomwareAt home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-38163At work |
SAP NetWeaver. Attackers can upload a file to SAP NetWeaver and make it run. | At work |
CVE-2016-2388At work |
SAP NetWeaver. Attackers can read information from SAP NetWeaver that should be private. | At work |
CVE-2016-2386At work |
SAP NetWeaver. Attackers can read or change the database behind SAP NetWeaver. | At work |
35 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2019-7195† Used in ransomwareAt home |
QNAP Photo Station. Attackers can read files on QNAP Photo Station that should be out of reach. | At home |
CVE-2019-7194† Used in ransomwareAt home |
QNAP Photo Station. Attackers can read files on QNAP Photo Station that should be out of reach. | At home |
CVE-2019-7193† Used in ransomwareAt home |
QNAP QTS. Attackers can run their own code on QNAP QTS. | At home |
CVE-2019-7192† Used in ransomwareAt home |
QNAP Photo Station. Attackers can reach parts of QNAP Photo Station that should be locked to them. | At home |
CVE-2019-5825At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2019-15271At work |
Cisco RV Series Routers. Attackers can run their own code on Cisco RV Series Routers. | At work |
CVE-2018-6065At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2018-4990At home |
Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader. | At home |
CVE-2018-17480At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2018-17463At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2017-6862At home |
NETGEAR Multiple Devices. Attackers can run their own code on NETGEAR Multiple Devices. | At home |
CVE-2017-5070At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2017-5030At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2016-5198At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2016-1646At home |
Chrome and other Chromium browsers. Attackers can corrupt memory in Chrome and other Chromium browsers, which they use to take it over. | At home |
CVE-2013-1331At home |
Microsoft Office. Attackers can run their own code on Microsoft Office. | At home |
CVE-2012-5054At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2012-4969At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2012-1889At home |
Microsoft XML Core Services. Attackers can run their own code on Microsoft XML Core Services. | At home |
CVE-2012-0767At home |
Adobe Flash Player. Attackers can run code in the browser of someone using Adobe Flash Player and act as them. | At home |
CVE-2012-0754At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2012-0151At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2011-2462At home |
Adobe Reader and Acrobat. Attackers can run their own code on Adobe Reader and Acrobat. | At home |
CVE-2011-0609At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2010-2883At home |
Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader. | At home |
CVE-2010-2572At home |
Microsoft PowerPoint. Attackers can run their own code on Microsoft PowerPoint. | At home |
CVE-2010-1297At home |
Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. | At home |
CVE-2009-4324At home |
Adobe Acrobat and Reader. Opening a booby-trapped file can let an attacker run their own code through Adobe Acrobat and Reader. | At home |
CVE-2009-3953At home |
Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader. | At home |
CVE-2009-1862At home |
Adobe Acrobat and Reader, Flash Player. Attackers can run their own code on Adobe Acrobat and Reader, Flash Player. | At home |
CVE-2009-0563At home |
Microsoft Office. Attackers can run their own code on Microsoft Office. | At home |
CVE-2009-0557At home |
Microsoft Office. Attackers can run their own code on Microsoft Office. | At home |
CVE-2008-0655At home |
Adobe Acrobat and Reader. Attackers are using a flaw in Adobe Acrobat and Reader that its maker hasn't described in detail. | At home |
CVE-2007-5659At home |
Adobe Acrobat and Reader. Attackers can run their own code on Adobe Acrobat and Reader. | At home |
CVE-2006-2492At home |
Microsoft Word. Attackers can run their own code on Microsoft Word. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-26134† Used in ransomwareAt work |
Atlassian Confluence Server/Data Center. Attackers can run their own code on Atlassian Confluence Server/Data Center from anywhere, without logging in. | At work |
Companies
The flaws were in eleven companies’ products; the most were in Adobe’s (13).
| Company | Flaws | Ransomware |
|---|---|---|
| Adobe | 13 | – |
| 9 | – | |
| Microsoft | 9 | 1 |
| Apple | 5 | – |
| QNAP | 4 | 4 |
| SAP | 3 | – |
| Atlassian | 1 | 1 |
| Cisco | 1 | – |
| Mitel | 1 | 1 |
| NETGEAR | 1 | – |
| Red Hat | 1 | 1 |
Other months
Every month since CISA started the list; June 2022 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.