CISA Known Exploited Vulnerabilities
KEV additions — April 2022
33 CVEs entered the KEV catalog in April 2022.
Added April 25, 20227
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-1003029 | Jenkins Script Security Plugin Sandbox Bypass Vulnerability | 9.9 | 92.6 % | May 16, 2022 |
| CVE-2021-40450 | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 | 7.5 % | May 16, 2022 |
| CVE-2021-41357 | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 | 7.4 % | May 16, 2022 |
| CVE-2022-0847 | Linux Kernel Privilege Escalation Vulnerability | 7.8 | 83.4 % | May 16, 2022 |
| CVE-2022-21919 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7 | 0.3 % | May 16, 2022 |
| CVE-2022-26904 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7 | 25.1 % | May 16, 2022 |
| CVE-2022-29464ransomware | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | 9.8 | 94.4 % | May 16, 2022 |
Added April 19, 20223
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-6882ransomware | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 6.1 | 63.4 % | May 10, 2022 |
| CVE-2019-3568 | WhatsApp VOIP Stack Buffer Overflow Vulnerability | 9.8 | 46.0 % | May 10, 2022 |
| CVE-2022-22718 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 | 11.0 % | May 10, 2022 |
Added April 15, 20226
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2010-5330 | Ubiquiti AirOS Command Injection Vulnerability | 9.8 | 56.5 % | May 6, 2022 |
| CVE-2018-7841 | Schneider Electric U.motion Builder SQL Injection Vulnerability | 9.8 | 52.4 % | May 6, 2022 |
| CVE-2019-16057ransomware | D-Link DNS-320 Remote Code Execution Vulnerability | 9.8 | 93.8 % | May 6, 2022 |
| CVE-2019-3929 | Crestron Multiple Products Command Injection Vulnerability | 9.8 | 94.3 % | May 6, 2022 |
| CVE-2022-1364 | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 18.5 % | May 6, 2022 |
| CVE-2022-22960 | VMware Multiple Products Privilege Escalation Vulnerability | 7.8 | 70.4 % | May 6, 2022 |
Added April 14, 20221
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2022-22954ransomware | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 9.8 | 94.4 % | May 5, 2022 |
Added April 13, 20223
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-20753ransomware | Kaseya VSA Remote Code Execution Vulnerability | 9.8 | 37.7 % | May 4, 2022 |
| CVE-2018-7602ransomware | Drupal Core Remote Code Execution Vulnerability | 9.8 | 94.4 % | May 4, 2022 |
| CVE-2022-24521ransomware | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | 7.8 | 8.7 % | May 4, 2022 |
Added April 11, 20227
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2020-2509 | QNAP Network-Attached Storage (NAS) Command Injection Vulnerability | 9.8 | 85.0 % | May 2, 2022 |
| CVE-2021-22600 | Linux Kernel Privilege Escalation Vulnerability | 7 | 0.1 % | May 2, 2022 |
| CVE-2021-27852 | Checkbox Survey Deserialization of Untrusted Data Vulnerability | 9.8 | 25.5 % | May 2, 2022 |
| CVE-2021-39793 | Google Pixel Out-of-Bounds Write Vulnerability | 7.8 | 0.1 % | May 2, 2022 |
| CVE-2021-42278ransomware | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 7.5 | 94.1 % | May 2, 2022 |
| CVE-2021-42287ransomware | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 7.5 | 94.0 % | May 2, 2022 |
| CVE-2022-23176 | WatchGuard Firebox and XTM Privilege Escalation Vulnerability | 8.8 | 9.6 % | May 2, 2022 |
Added April 6, 20222
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-31166 | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | 9.8 | 93.1 % | April 27, 2022 |
| CVE-2021-3156 | Sudo Heap-Based Buffer Overflow Vulnerability | 7.8 | 92.5 % | April 27, 2022 |
Added April 4, 20224
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | 9.8 | 94.2 % | April 25, 2022 |
| CVE-2022-22674 | Apple macOS Out-of-Bounds Read Vulnerability | 5.5 | 0.2 % | April 25, 2022 |
| CVE-2022-22675 | Apple macOS Out-of-Bounds Write Vulnerability | 7.8 | 1.0 % | April 25, 2022 |
| CVE-2022-22965 | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 9.8 | 94.4 % | April 25, 2022 |