Known Exploited Vulnerabilities Catalog

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

How to use the KEV Catalog

The KEV catalog is also available in these formats:

CSV
JSON
JSON Schema (updated 06-25-2024)
Print View
License

Showing 121 - 140 of 334
Filters:
Microsoft | Windows

CVE-2014-4148

Microsoft Windows Remote Code Execution Vulnerability: A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.

Related CWE: CWE-94

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2014-4148
Microsoft | Windows

CVE-2015-1671

Microsoft Windows Remote Code Execution Vulnerability: A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.

Related CWE: CWE-19

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2015-1671
Microsoft | Silverlight

CVE-2013-0074

Microsoft Silverlight Double Dereference Vulnerability: Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.

Known To Be Used in Ransomware Campaigns? Known

Action: The impacted product is end-of-life and should be disconnected if still in use.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2013-0074
Microsoft | Silverlight

CVE-2013-3896

Microsoft Silverlight Information Disclosure Vulnerability: Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.

Related CWE: CWE-20

Known To Be Used in Ransomware Campaigns? Unknown

Action: The impacted product is end-of-life and should be disconnected if still in use.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2013-3896
Microsoft | Internet Explorer

CVE-2013-7331

Microsoft Internet Explorer Information Disclosure Vulnerability: An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2013-7331
Microsoft | Input Method Editor (IME) Japanese

CVE-2014-4077

Microsoft IME Japanese Privilege Escalation Vulnerability: Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.

Related CWE: CWE-264

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2014-4077
Microsoft | Internet Explorer

CVE-2014-2817

Microsoft Internet Explorer Privilege Escalation Vulnerability: Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.

Related CWE: CWE-264

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2014-2817
Microsoft | Internet Explorer

CVE-2014-4123

Microsoft Internet Explorer Privilege Escalation Vulnerability: Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.

Related CWE: CWE-264

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-25
  • Due Date: 2022-06-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2014-4123
Microsoft | Internet Explorer

CVE-2017-0210

Microsoft Internet Explorer Privilege Escalation Vulnerability: A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-0210
Microsoft | Windows

CVE-2018-8611

Microsoft Windows Kernel Privilege Escalation Vulnerability: A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.

Related CWE: CWE-404

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-8611
Microsoft | SMBv1 server

CVE-2017-0147

Microsoft Windows SMBv1 Information Disclosure Vulnerability: The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Known

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-0147
Microsoft | XML Core Services

CVE-2017-0022

Microsoft XML Core Services Information Disclosure Vulnerability: Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-0022
Microsoft | Windows

CVE-2017-0005

Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability: The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.

Related CWE: CWE-119

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-0005
Microsoft | Internet Explorer

CVE-2017-0149

Microsoft Internet Explorer Memory Corruption Vulnerability: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.

Related CWE: CWE-119

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-0149
Microsoft | Windows

CVE-2017-8543

Microsoft Windows Search Remote Code Execution Vulnerability: Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.

Related CWE: CWE-281

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-8543
Microsoft | Internet Explorer

CVE-2016-3298

Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability: An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-3298
Microsoft | Internet Explorer and Edge

CVE-2016-3351

Microsoft Internet Explorer and Edge Information Disclosure Vulnerability: An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Known

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-3351
Microsoft | Internet Explorer

CVE-2016-0162

Microsoft Internet Explorer Information Disclosure Vulnerability: An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-24
  • Due Date: 2022-06-14
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-0162
Microsoft | Update Notification Manager

CVE-2020-0638

Microsoft Update Notification Manager Privilege Escalation Vulnerability: Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.

Known To Be Used in Ransomware Campaigns? Known

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-23
  • Due Date: 2022-06-13
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-0638
Microsoft | Windows

CVE-2019-0703

Microsoft Windows SMB Information Disclosure Vulnerability: An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-05-23
  • Due Date: 2022-06-13
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2019-0703

Subscribe to the KEV Catalog Updates

Stay up to date on the latest known exploited vulnerabilities.

Subscribe Now