Flaws added in December 2022
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in December 2022. For the newest, see Exploited flaws.
In December 2022, CISA added 9 flaws to its list of vulnerabilities being used in attacks, 3 of them in things people have at home; 4 have been used by ransomware gangs. Most came from TIBCO (2), Veeam (2) and Apple (1).[1]
Six of the nine let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in December 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2018-5430At work |
TIBCO JasperReports. Attackers can read information from TIBCO JasperReports that should be private. | At work |
CVE-2018-18809At work |
TIBCO JasperReports. Attackers can read files on TIBCO JasperReports that should be out of reach. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-42856At home |
Apple iOS. Attackers can run their own code on Apple iOS. | At home |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-44698† Used in ransomwareAt home |
Microsoft Defender. Attackers can get past a security protection in Microsoft Defender. | At home |
CVE-2022-42475† Used in ransomwareAt work |
Fortinet FortiOS. Attackers can run their own code on Fortinet FortiOS from anywhere, without logging in. | At work |
CVE-2022-27518At work |
Citrix Application Delivery Controller (ADC) and Gateway. Attackers can run their own code on Citrix Application Delivery Controller (ADC) and Gateway from anywhere, without logging in. | At work |
CVE-2022-26501† Used in ransomwareAt work |
Veeam Backup & Replication. Attackers can run their own code on Veeam Backup & Replication from anywhere, without logging in. | At work |
CVE-2022-26500† Used in ransomwareAt work |
Veeam Backup & Replication. Attackers can run their own code on Veeam Backup & Replication from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-4262At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
Companies
The flaws were in seven companies’ products; the most were in TIBCO’s (2).
Other months
Every month since CISA started the list; December 2022 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.