CVE-2021-21985
Unknown● ACTIVELY EXPLOITEDRansomware use reported
VMware vCenter Server Improper Input Validation Vulnerability
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2021-22005
Unknown● ACTIVELY EXPLOITEDRansomware use reported
VMware vCenter Server File Upload Vulnerability
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2019-11510
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2021-34473
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2019-0708
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Endpoints
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2018-13379
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2021-35464
Unknown● ACTIVELY EXPLOITEDRansomware use reported
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2020-5902
Unknown● ACTIVELY EXPLOITEDRansomware use reported
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Other
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2019-19781
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2021-1498
Unknown● ACTIVELY EXPLOITED
Cisco HyperFlex HX Data Platform Command Injection Vulnerability
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2021-26084
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidance
Apply updates per vendor instructions.
CVE-2017-5638
Unknown● ACTIVELY EXPLOITEDRansomware use reported
Apache Struts Remote Code Execution Vulnerability
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Other
CISA mitigation guidance
Apply updates per vendor instructions.
CISA KEV catalog last checked: 2026-10-21 17:05:46 UTC. Reports reflect upstream publications and may lag; confirm affected versions and patch instructions with the original vendor. Asset categories are automatically inferred, not verified inventories.