CVEs from 2016 known to be exploited
Entries60
Ransomware-linked10
Avg. lag6.2 yrs
Year added to KEV
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2016-3081 | Apache Struts | 2026-10-08 | 93.3% | Unknown |
| CVE-2016-7836 | SKYSEA Client View | 2025-10-14 | 19.2% | Unknown |
| CVE-2016-10033 | PHP PHPMailer | 2025-07-07 | 99.7% | Unknown |
| CVE-2016-3714 | ImageMagick ImageMagick | 2024-09-09 | 97.4% | Unknown |
| CVE-2016-20017 | D-Link DSL-2750B Devices | 2024-01-08 | 64.2% | Unknown |
| CVE-2016-9079 | Mozilla Firefox, Firefox ESR, and Thunderbird | 2023-06-22 | 87.5% | Unknown |
| CVE-2016-0165 | Microsoft Win32k | 2023-06-22 | 13.7% | Unknown |
| CVE-2016-6415 | Cisco IOS, IOS XR, and IOS XE | 2023-05-19 | 87.6% | Unknown |
| CVE-2016-8735 | Apache Tomcat | 2023-05-12 | 90.3% | Unknown |
| CVE-2016-3427 | Oracle Java SE and JRockit | 2023-05-12 | 92.3% | Unknown |
| CVE-2016-2388 | SAP NetWeaver | 2022-06-09 | 52.2% | Unknown |
| CVE-2016-2386 | SAP NetWeaver | 2022-06-09 | 71.5% | Unknown |
| CVE-2016-5198 | Google Chromium V8 | 2022-06-08 | 34.1% | Unknown |
| CVE-2016-1646 | Google Chromium V8 | 2022-06-08 | 48.1% | Unknown |
| CVE-2016-7256 | Microsoft Windows | 2022-05-25 | 64.5% | Unknown |
| CVE-2016-3393 | Microsoft Windows | 2022-05-25 | 68.4% | Unknown |
| CVE-2016-1010 | Adobe Flash Player and AIR | 2022-05-25 | 19.3% | Unknown |
| CVE-2016-0984 | Adobe Flash Player and AIR | 2022-05-25 | 54.5% | Unknown |
| CVE-2016-0034 | Microsoft Silverlight | 2022-05-25 | 69.3% | Known |
| CVE-2016-6367 | Cisco Adaptive Security Appliance (ASA) | 2022-05-24 | 22.5% | Unknown |
| CVE-2016-6366 | Cisco Adaptive Security Appliance (ASA) | 2022-05-24 | 87.5% | Unknown |
| CVE-2016-4657 | Apple iOS | 2022-05-24 | 66.7% | Unknown |
| CVE-2016-4656 | Apple iOS | 2022-05-24 | 23.6% | Unknown |
| CVE-2016-4655 | Apple iOS | 2022-05-24 | 33.3% | Unknown |
| CVE-2016-3351 | Microsoft Internet Explorer and Edge | 2022-05-24 | 26.4% | Known |
| CVE-2016-3298 | Microsoft Internet Explorer | 2022-05-24 | 33.3% | Unknown |
| CVE-2016-0162 | Microsoft Internet Explorer | 2022-05-24 | 22.0% | Unknown |
| CVE-2016-4523 | Trihedral VTScada (formerly VTS) | 2022-04-15 | 31.1% | Unknown |
| CVE-2016-7201 | Microsoft Edge | 2022-03-28 | 80.0% | Unknown |
| CVE-2016-7200 | Microsoft Edge | 2022-03-28 | 82.7% | Unknown |
| CVE-2016-0189 | Microsoft Internet Explorer | 2022-03-28 | 94.0% | Known |
| CVE-2016-0151 | Microsoft Client-Server Run-time Subsystem (CSRSS) | 2022-03-28 | 62.9% | Known |
| CVE-2016-0040 | Microsoft Windows | 2022-03-28 | 24.4% | Unknown |
| CVE-2016-7892 | Adobe Flash Player | 2022-03-25 | 18.7% | Unknown |
| CVE-2016-4171 | Adobe Flash Player | 2022-03-25 | 20.0% | Unknown |
| CVE-2016-1555 | NETGEAR Wireless Access Point (WAP) Devices | 2022-03-25 | 98.2% | Unknown |
| CVE-2016-11021 | D-Link DCS-930L Devices | 2022-03-25 | 68.8% | Unknown |
| CVE-2016-10174 | NETGEAR WNR2000v5 Router | 2022-03-25 | 83.3% | Unknown |
| CVE-2016-0752 | Rails Ruby on Rails | 2022-03-25 | 95.5% | Unknown |
| CVE-2016-3309 | Microsoft Windows | 2022-03-15 | 20.4% | Known |
| CVE-2016-6277 | NETGEAR Multiple Routers | 2022-03-07 | 99.8% | Unknown |
| CVE-2016-8562 | Siemens SIMATIC CP | 2022-03-03 | 3.6% | Unknown |
| CVE-2016-7855 | Adobe Flash Player | 2022-03-03 | 25.1% | Unknown |
| CVE-2016-7262 | Microsoft Excel | 2022-03-03 | 57.7% | Unknown |
| CVE-2016-7193 | Microsoft Office | 2022-03-03 | 57.5% | Unknown |
| CVE-2016-5195 | Linux Kernel | 2022-03-03 | 83.5% | Unknown |
| CVE-2016-4117 | Adobe Flash Player | 2022-03-03 | 94.3% | Known |
| CVE-2016-1019 | Adobe Flash Player | 2022-03-03 | 22.3% | Known |
| CVE-2016-0099 | Microsoft Windows | 2022-03-03 | 37.0% | Known |
| CVE-2016-3088 | Apache ActiveMQ | 2022-02-10 | 98.5% | Unknown |
| CVE-2016-9563 | SAP NetWeaver | 2021-11-03 | 24.2% | Unknown |
| CVE-2016-7255 | Microsoft Win32k | 2021-11-03 | 80.9% | Known |
| CVE-2016-4437 | Apache Shiro | 2021-11-03 | 93.0% | Unknown |
| CVE-2016-3976 | SAP NetWeaver | 2021-11-03 | 47.2% | Unknown |
| CVE-2016-3718 | ImageMagick ImageMagick | 2021-11-03 | 76.7% | Unknown |
| CVE-2016-3715 | ImageMagick ImageMagick | 2021-11-03 | 75.3% | Unknown |
| CVE-2016-3643 | SolarWinds Virtualization Manager | 2021-11-03 | 3.6% | Unknown |
| CVE-2016-3235 | Microsoft Office | 2021-11-03 | 43.3% | Unknown |
| CVE-2016-0185 | Microsoft Windows | 2021-11-03 | 69.8% | Unknown |
| CVE-2016-0167 | Microsoft Win32k | 2021-11-03 | 5.6% | Known |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
60 CVE-2016 vulnerabilities are in KEV; on average they were listed 6.2 years after the CVE year.