NewsCompaniesFlawsGuides
Get the app

Flaws added in November 2022

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in November 2022. For the newest, see Exploited flaws.

In November 2022, CISA added 10 flaws to its list of vulnerabilities being used in attacks, 9 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (5), Samsung (3) and Google (1).[1]

Four of the ten let an attacker take over the product, running their own code or taking full control.

List of flaws

Every flaw CISA added in November 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

2 added

CVEFlawFound
CVE-2022-4135At home Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers. At home
CVE-2021-35587At work Oracle Fusion Middleware. Attackers are using a flaw in Oracle Fusion Middleware that its maker hasn't described in detail. At work

1 added

CVEFlawFound
CVE-2022-41049At home Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. At home

7 added

CVEFlawFound
CVE-2022-41128At home Microsoft Windows. Attackers can run their own code on Microsoft Windows. At home
CVE-2022-41125At home Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. At home
CVE-2022-41091† Used in ransomwareAt home Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. At home
CVE-2022-41073† Used in ransomwareAt home Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. At home
CVE-2021-25370At home Samsung Mobile Devices. Attackers can corrupt memory in Samsung Mobile Devices, which they use to take it over. At home
CVE-2021-25369At home Samsung Mobile Devices. Attackers can reach parts of Samsung Mobile Devices that should be locked to them. At home
CVE-2021-25337At home Samsung Mobile Devices. Attackers can reach parts of Samsung Mobile Devices that should be locked to them. At home

Companies

The flaws were in four companies’ products; the most were in Microsoft’s (5).

CompanyFlawsRansomware
Microsoft52
Samsung3–
Google1–
Oracle1–

Other months

Every month since CISA started the list; November 2022 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.