2022: 555 exploited CVEs added
Every number below is computed from CISA's Known Exploited Vulnerabilities catalog and refreshed daily. That's +78% versus the same period of 2021 (311).
Adds per month
2022 against 2021. Hover a month for exact counts.
How urgent, how dangerous
Shares of the 555 entries added in 2022.
1 with ≤ 7 daysto the federal due date. Median window is 21 days.
132 ransomware-linkedCISA marks known use in ransomware campaigns.
261 old CVEsassigned 2017 or earlier, newly confirmed exploited.
Top vendors in 2022
Most KEV additions. R = ransomware-linked. Click a vendor for every entry.
Plus 86 more vendors. See all vendors.
Old bugs, new exploitation
CVEs from 2017 or earlier added in 2022. Patch backlogs matter.
| CVE | Vendor / product | Age |
|---|---|---|
| CVE-2002-0367 | Microsoft Windows | 20y |
| CVE-2004-0210 | Microsoft Windows | 18y |
| CVE-2005-2773 | Hewlett Packard (HP) OpenView Network Node Manager | 17y |
| CVE-2006-1547 | Apache Struts 1 | 16y |
| CVE-2006-2492 | Microsoft Word | 16y |
| CVE-2007-3010 | Alcatel OmniPCX Enterprise | 15y |
| CVE-2007-5659 | Adobe Acrobat and Reader | 15y |
| CVE-2008-0655 | Adobe Acrobat and Reader | 14y |
| CVE-2008-2992 | Adobe Acrobat and Reader RANSOMWARE | 14y |
| CVE-2008-3431 | Oracle VirtualBox | 14y |
| CVE-2009-0557 | Microsoft Office | 13y |
| CVE-2009-0563 | Microsoft Office | 13y |
| CVE-2009-0927 | Adobe Reader and Acrobat | 13y |
| CVE-2009-1123 | Microsoft Windows | 13y |
| CVE-2009-1151 | phpMyAdmin phpMyAdmin | 13y |
Showing the 15 oldest of 261.
Only see the ones that hit your stack.
Pick your vendors. Get a free weekly digest of new KEV entries for just those.
Method: counts use the catalog's dateAdded; "same period" is Jan 1 – 2021-12-31. Due window = dueDate − dateAdded. Data: CISA Known Exploited Vulnerabilities Catalog (CC0). KEV Watch is not affiliated with or endorsed by CISA. Also available as an RSS feed.