CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2022-26318WatchGuard Firebox and XTM Appliances Arbitrary Code Execution n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-26258D-Link DIR-820L Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-26143MiCollab, MiVoice Business Express Access Control Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-26138Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability Atlassian Questions For Confluence Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-26134Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability Atlassian Confluence Data Center, Atlassian Confluence Server Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-2586Linux Kernel Use-After-Free Vulnerability The Linux Kernel Organization linux Versions & vendor guidance → |
Known exploitedCISA KEV | 5.3Medium |
| CVE-2022-24990TerraMaster OS Remote Command Execution Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-24816Improper Control of Generation of Code in jai-ext geosolutions-it jai-ext Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2022-24706Remote Code Execution Vulnerability in Packaging Apache Software Foundation Apache CouchDB Reported workaround → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 6.1Medium |
| CVE-2022-24521Windows Common Log File System Driver Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows 10 Version 1909, Microsoft Windows 10 Version 21H1, Microsoft Windows Server 2022, Microsoft Windows 10 Version 20H2, Microsoft Windows Server version 20H2, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows 7, Microsoft Windows 7 Service Pack 1, Microsoft Windows 8.1, Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP header Apache Software Foundation Apache APISIX Reported workaround → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code execution Adobe Magento Commerce Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-23748Dante Discovery Process Control Vulnerability n/a Audinate Dante Application Library for Windows Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-23227NUUO NVRmini2 Devices Missing Authentication Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-23176WatchGuard Firebox and XTM Privilege Escalation Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-23134Possible view of the setup pages by unauthenticated users if config file already exists Zabbix Frontend Reported fix guidance → |
Known exploitedCISA KEV | 3.7Low |
| CVE-2022-23131Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML Zabbix Frontend Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution Vulnerability n/a Spring Framework Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-22963VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability n/a Spring Cloud Function Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-22960VMware Multiple Products Privilege Escalation Vulnerability n/a VMware Workspace ONE Access, Identity Manager and vRealize Automation Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability n/a VMware Workspace ONE Access and Identity Manager Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-22948VMware vCenter Server Incorrect Default File Permissions Vulnerability n/a VMware vCenter Server and VMware Cloud Foundation Versions & vendor guidance → |
Known exploitedCISA KEV | 6.5Medium |
| CVE-2022-22947VMware Spring Cloud Gateway Code Injection Vulnerability n/a Spring Cloud Gateway Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2022-2294WebRTC Heap Buffer Overflow Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.