CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2022-43939Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions Hitachi Vantara Pentaho Business Analytics Server Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2022-43769Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) Hitachi Vantara Pentaho Business Analytics Server Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-42948Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-42856Apple iOS Type Confusion Vulnerability Apple tvOS Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-42827Apple iOS and iPadOS Out-of-Bounds Write Vulnerability Apple iOS and iPadOS Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-4262Google Chromium V8 Type Confusion Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability Fortinet FortiProxy, Fortinet FortiOS Reported fix guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2022-41352Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-4135Google Chromium GPU Heap Buffer Overflow Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 9.6Critical |
| CVE-2022-41328Fortinet FortiOS Path Traversal Vulnerability Fortinet FortiOS Reported fix guidance → |
Known exploitedCISA KEV | 6.5Medium |
| CVE-2022-41223Mitel MiVoice Connect Code Injection Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 6.8Medium |
| CVE-2022-41128Windows Scripting Languages Remote Code Execution Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 20H2, Microsoft Windows 10 Version 21H1, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 7, Microsoft Windows 7 Service Pack 1, Microsoft Windows 8.1, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022 Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-41125Windows CNG Key Isolation Service Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 20H2, Microsoft Windows 10 Version 21H1, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 8.1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-41091Windows Mark of the Web Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 20H2, Microsoft Windows 10 Version 21H1, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022 Versions & vendor guidance → |
Known exploitedCISA KEV | 5.4Medium |
| CVE-2022-41082Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Versions & vendor guidance → |
Known exploitedCISA KEV | 8High |
| CVE-2022-41080Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Microsoft Exchange Server 2019 Cumulative Update 12 Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-41073Windows Print Spooler Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 20H2, Microsoft Windows 10 Version 21H1, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 7, Microsoft Windows 7 Service Pack 1, Microsoft Windows 8.1, Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-41049Windows Mark of the Web Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 20H2, Microsoft Windows 10 Version 21H1, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022 Versions & vendor guidance → |
Known exploitedCISA KEV | 5.4Medium |
| CVE-2022-41040Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-41033Windows COM+ Event System Service Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows 10 Version 21H1, Microsoft Windows Server 2022, Microsoft Windows 10 Version 20H2, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows 7, Microsoft Windows 7 Service Pack 1, Microsoft Windows 8.1, Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2022-40799D-Link DNR-322L Download of Code Without Integrity Check Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2022-40765Mitel MiVoice Connect Command Injection Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 6.8Medium |
| CVE-2022-40684Fortinet Multiple Products Authentication Bypass Vulnerability Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2022-40139Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability Trend Micro Trend Micro Apex One Versions & vendor guidance → |
Known exploitedCISA KEV | 7.2High |
| CVE-2022-39197Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 6.1Medium |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.