The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2022-27925 | HIGH | 7.2 | Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. | Apr 21, 2022 |
| CVE-2022-27924 | HIGH | 7.5 | Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. | Apr 21, 2022 |
| CVE-2021-44529 | CRITICAL | 9.8 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). | Dec 8, 2021 |
| CVE-2021-43890 | HIGH | 7.1 | Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. | Dec 15, 2021 |
| CVE-2019-6693 | MEDIUM | 6.5 | Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. | Nov 21, 2019 |
| CVE-2019-15107 | CRITICAL | 9.8 | An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability. | Aug 16, 2019 |
| CVE-2017-6884 | HIGH | 8.8 | Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI. | Apr 6, 2017 |
| CVE-2015-2291 | HIGH | 7.8 | Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS). | Aug 9, 2017 |
| CVE-2012-4681 | CRITICAL | 9.8 | The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. | Aug 28, 2012 |
| CVE-2012-1723 | CRITICAL | 9.8 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot. | Jun 16, 2012 |
| CVE-2012-1710 | CRITICAL | 9.8 | Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer. | May 3, 2012 |
| CVE-2026-12569 | CRITICAL | 9.8 | PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. | Jun 18, 2026 |
| CVE-2021-40438 | CRITICAL | 9.0 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | Sep 16, 2021 |
| CVE-2021-22205 | CRITICAL | 10.0 | GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. | Apr 23, 2021 |
| CVE-2017-12615 | HIGH | 8.1 | When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. | Sep 19, 2017 |
| CVE-2009-3960 | MEDIUM | 6.5 | Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure. | Feb 15, 2010 |
| CVE-2023-4966 | CRITICAL | 9.4 | Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | Oct 10, 2023 |
| CVE-2023-47246 | CRITICAL | 9.8 | SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution. | Nov 10, 2023 |
| CVE-2023-27997 | CRITICAL | 9.8 | Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. | Jun 13, 2023 |
| CVE-2022-47966 | CRITICAL | 9.8 | Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. | Jan 18, 2023 |
| CVE-2026-20805 | MEDIUM | 5.5 | Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. | Jan 13, 2026 |
| CVE-2026-60137 | MEDIUM | 5.9 | WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. | Jul 17, 2026 |
| CVE-2026-63077 | CRITICAL | 9.8 | JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. | Jul 27, 2026 |
| CVE-2026-16812 | CRITICAL | 10.0 | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. | Jul 27, 2026 |
| CVE-2025-68686 | MEDIUM | 5.9 | Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. | Feb 10, 2026 |