CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due	Status
CVE-2016-0189 — Microsoft Internet Explorer Memory Corruption Vulnerability The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.	Microsoft	Internet Explorer	Mar 28, 2022	Apr 18, 2022	Ransomware
CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.	Microsoft	Edge	Mar 28, 2022	Apr 18, 2022
CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.	Microsoft	Edge	Mar 28, 2022	Apr 18, 2022
CVE-2017-0037 — Microsoft Edge and Internet Explorer Type Confusion Vulnerability Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.	Microsoft	Edge and Internet Explorer	Mar 28, 2022	Apr 18, 2022
CVE-2017-0059 — Microsoft Internet Explorer Information Disclosure Vulnerability Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.	Microsoft	Internet Explorer	Mar 28, 2022	Apr 18, 2022
CVE-2017-0213 — Microsoft Windows Privilege Escalation Vulnerability Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.	Microsoft	Windows	Mar 28, 2022	Apr 18, 2022	Ransomware
CVE-2018-8405 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.	Microsoft	DirectX Graphics Kernel (DXGKRNL)	Mar 28, 2022	Apr 18, 2022	Ransomware
CVE-2018-8406 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.	Microsoft	DirectX Graphics Kernel (DXGKRNL)	Mar 28, 2022	Apr 18, 2022	Ransomware
CVE-2018-8440 — Microsoft Windows Privilege Escalation Vulnerability An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).	Microsoft	Windows	Mar 28, 2022	Apr 18, 2022	Ransomware
CVE-2019-7483 — SonicWall SMA100 Directory Traversal Vulnerability In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.	SonicWall	SMA100	Mar 28, 2022	Apr 18, 2022

Ransomware Microsoft

CVE-2016-0189 — Microsoft Internet Explorer Memory Corruption Vulnerability

The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Internet Explorer · Mar 28, 2022

Microsoft

CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Edge · Mar 28, 2022

Microsoft

CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Edge · Mar 28, 2022

Microsoft

CVE-2017-0037 — Microsoft Edge and Internet Explorer Type Confusion Vulnerability

Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.

Edge and Internet Explorer · Mar 28, 2022

Microsoft

CVE-2017-0059 — Microsoft Internet Explorer Information Disclosure Vulnerability

Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.

Internet Explorer · Mar 28, 2022

Ransomware Microsoft

CVE-2017-0213 — Microsoft Windows Privilege Escalation Vulnerability

Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.

Windows · Mar 28, 2022

Ransomware Microsoft

CVE-2018-8405 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

DirectX Graphics Kernel (DXGKRNL) · Mar 28, 2022

Ransomware Microsoft

CVE-2018-8406 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

DirectX Graphics Kernel (DXGKRNL) · Mar 28, 2022

Ransomware Microsoft

CVE-2018-8440 — Microsoft Windows Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).

Windows · Mar 28, 2022

SonicWall

CVE-2019-7483 — SonicWall SMA100 Directory Traversal Vulnerability

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

SMA100 · Mar 28, 2022