Known Exploited Vulnerabilities Catalog

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

How to use the KEV Catalog

The KEV catalog is also available in these formats:

CSV
JSON
JSON Schema (updated 06-25-2024)
Print View
License

Showing 1 - 10 of 10
Filters:
Yiiframework | Yii

CVE-2024-58136

Yiiframework Yii Improper Protection of Alternate Path Vulnerability: Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.

Related CWE: CWE-424

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  • Date Added: 2025-05-02
  • Due Date: 2025-05-23
Additional Notes
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52 ; https://nvd.nist.gov/vuln/detail/CVE-2024-58136
Ruckus Wireless | Multiple Products

CVE-2023-25717

Multiple Ruckus Wireless Products CSRF and RCE Vulnerability: Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.

Related CWE: CWE-94

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions or disconnect product if it is end-of-life.
  • Date Added: 2023-05-12
  • Due Date: 2023-06-02
Additional Notes
https://support.ruckuswireless.com/security_bulletins/315; https://nvd.nist.gov/vuln/detail/CVE-2023-25717
NETGEAR | Multiple Devices

CVE-2017-5521

NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability: Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.

Related CWE: CWE-200

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
  • Date Added: 2022-09-08
  • Due Date: 2022-09-29
Additional Notes
https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2017-5521
NETGEAR | Multiple Devices

CVE-2017-6862

NETGEAR Multiple Devices Buffer Overflow Vulnerability: Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.

Related CWE: CWE-119

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-06-08
  • Due Date: 2022-06-22
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-6862
NETGEAR | DGN2200 Devices

CVE-2017-6334

NETGEAR DGN2200 Devices OS Command Injection Vulnerability: dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands

Related CWE: CWE-78

Known To Be Used in Ransomware Campaigns? Unknown

Action: The impacted product is end-of-life and should be disconnected if still in use.
  • Date Added: 2022-03-25
  • Due Date: 2022-04-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-6334
NETGEAR | Wireless Access Point (WAP) Devices

CVE-2016-1555

NETGEAR Multiple WAP Devices Command Injection Vulnerability: Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.

Related CWE: CWE-77

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-03-25
  • Due Date: 2022-04-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-1555
NETGEAR | WNR2000v5 Router

CVE-2016-10174

NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability: The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.

Related CWE: CWE-119

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-03-25
  • Due Date: 2022-04-15
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-10174
NETGEAR | Wireless Router DGN2200

CVE-2017-6077

NETGEAR DGN2200 Remote Code Execution Vulnerability: NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.

Related CWE: CWE-78

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-03-07
  • Due Date: 2022-09-07
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-6077
NETGEAR | Multiple Routers

CVE-2016-6277

NETGEAR Multiple Routers Remote Code Execution Vulnerability: NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.

Related CWE: CWE-352

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2022-03-07
  • Due Date: 2022-09-07
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-6277
NETGEAR | JGS516PE Devices

CVE-2020-26919

Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability: Netgear JGS516PE devices contain a missing function level access control vulnerability.

Known To Be Used in Ransomware Campaigns? Unknown

Action: Apply updates per vendor instructions.
  • Date Added: 2021-11-03
  • Due Date: 2022-05-03
Additional Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-26919

Subscribe to the KEV Catalog Updates

Stay up to date on the latest known exploited vulnerabilities.

Subscribe Now