Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

468 results · Clear filters · Feed

  • Critical 9.6
    CVE-2021-28550 Exploited Public exploit EPSS 52%

    Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution

    Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …

    Adobe Acrobat Reader tor Alpine
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-1497 Exploited Public exploit Scanner template EPSS 100%

    Cisco HyperFlex HX Command Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

    Cisco Cisco HyperFlex HX Data Platform Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-1498 Exploited Public exploit Scanner template EPSS 100%

    Cisco HyperFlex HX Command Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

    Cisco Cisco HyperFlex HX Data Platform Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-38647 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    Microsoft Azure Stack Hub Open Management Infrastructure Azure Security Center
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-27101 Exploited · Ransomware Public exploit

    Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-40539 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21985 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21972 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-42258 Exploited · Ransomware Public exploit Scanner template EPSS 75%

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-42013 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-22502 Exploited Public exploit Scanner template EPSS 97%

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…

    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2021-22205 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

    GitLab GitLab gitlab Web / CMS Ubuntu
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2021-22893 Exploited · Ransomware Public exploit EPSS 48%

    Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-22986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-22005 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-26084 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-26855 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-20021 Exploited · Ransomware Public exploit Scanner template EPSS 89%

    A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

    SonicWall Email Security Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-0708 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an una…

    Microsoft Windows Windows Server Windows
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-0604 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup…

    Microsoft Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-18935 Exploited · Ransomware Public exploit EPSS 100%

    Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-16759 Exploited Public exploit Scanner template EPSS 100%

    vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…

    KEV Nov 3, 2021
  • Critical 9.9
    CVE-2019-11510 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthen…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-11580 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Atta…

    Atlassian Crowd
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2019-4716 Exploited Public exploit Scanner template EPSS 86%

    IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…

    IBM Planning Analytics
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-3396 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from ver…

    Atlassian Confluence Server Web / CMS
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-19781 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. T…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-5544 Exploited · Ransomware Public exploit Scanner template EPSS 98%

    OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…

    openslp-dfsg openslp Virtualization Ubuntu Azure Linux
    KEV Nov 3, 2021