Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

468 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-35587 Exploited Public exploit Scanner template EPSS 96%

    Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…

    Oracle Access Manager
    KEV Nov 28, 2022
  • Critical 9.8
    CVE-2018-19323 Exploited · Ransomware Public exploit

    The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…

    KEV Oct 24, 2022
  • Critical 9.8
    CVE-2022-41352 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

    KEV Oct 20, 2022
  • Critical 9.8
    CVE-2022-40684 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

    Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices
    KEV Oct 11, 2022
  • Critical 9.8
    CVE-2022-35405 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…

    KEV Sep 22, 2022
  • Critical 9.8
    CVE-2018-7445 Exploited Public exploit EPSS 66%

    A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remo…

    KEV Sep 8, 2022
  • Critical 9.8
    CVE-2018-2628 Exploited Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). …

    Oracle WebLogic Server
    KEV Sep 8, 2022
  • Critical 9.8
    CVE-2022-24706 Exploited Public exploit Scanner template EPSS 93%

    Remote Code Execution Vulnerability in Packaging

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…

    Apache Software Foundation Apache CouchDB
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-24112 Exploited Public exploit Scanner template EPSS 96%

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…

    Apache Software Foundation Apache APISIX
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-22963 Exploited Public exploit Scanner template EPSS 100%

    Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …

    org.springframework.cloud:spring-cloud-function-context Maven
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-26352 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…

    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-22536 Exploited Public exploit Scanner template EPSS 98%

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…

    SAP SAP Web Dispatcher SAP NetWeaver and ABAP Platform SAP Content Server
    KEV Aug 18, 2022
  • Critical 9.8
    CVE-2017-15944 Exploited Public exploit Scanner template EPSS 98%

    Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote…

    KEV Aug 18, 2022
  • Critical 9.8
    CVE-2022-37042 Exploited · Ransomware Public exploit Scanner template EPSS 92%

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…

    KEV Aug 11, 2022
  • Critical 9.8
    CVE-2022-30333 Exploited · Ransomware Public exploit EPSS 99%

    RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …

    unrar-nonfree unrar-nonfree rar rar Debian Ubuntu
    KEV Aug 9, 2022
  • Critical 9.8
    CVE-2022-26138 Exploited Public exploit Scanner template EPSS 98%

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

    Atlassian Questions For Confluence Web / CMS
    KEV Jul 29, 2022
  • Critical 9.8
    CVE-2016-2386 Exploited Public exploit EPSS 72%

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arb…

    KEV Jun 9, 2022
  • Critical 9.9
    CVE-2021-38163 Exploited Public exploit EPSS 37%

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…

    SAP SAP NetWeaver (Visual Composer 7.0 RT)
    KEV Jun 9, 2022
  • Critical 9.8
    CVE-2019-7192 Exploited · Ransomware Public exploit Scanner template EPSS 88%

    This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…

    KEV Jun 8, 2022
  • Critical 9.8
    CVE-2019-7194 Exploited · Ransomware Public exploit Scanner template EPSS 83%

    This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

    KEV Jun 8, 2022
  • Critical 9.8
    CVE-2019-7195 Exploited · Ransomware Public exploit Scanner template EPSS 89%

    This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

    KEV Jun 8, 2022
  • Critical 9.8
    CVE-2022-26134 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Jun 2, 2022
  • Critical 9.8
    CVE-2013-0422 Exploited · Ransomware Public exploit EPSS 97%

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) usin…

    KEV May 25, 2022
  • Critical 9.8
    CVE-2010-0840 Exploited Public exploit EPSS 96%

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18…

    KEV May 25, 2022
  • Critical 9.8
    CVE-2017-8543 Exploited Public exploit EPSS 74%

    Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 200…

    Microsoft Microsoft Windows Windows
    KEV May 24, 2022
  • Critical 10.0
    CVE-2019-11708 Exploited Public exploit EPSS 56%

    Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
    KEV May 23, 2022
  • Critical 9.8
    CVE-2022-30525 Exploited Public exploit Scanner template EPSS 100%

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…

    Zyxel ATP series firmware VPN series Firmware USG FLEX 50(W) firmware Network devices
    KEV May 16, 2022
  • Critical 10.0
    CVE-2022-22947 Exploited Public exploit Scanner template EPSS 98%

    Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…

    org.springframework.cloud:spring-cloud-gateway Maven
    KEV May 16, 2022
  • Critical 9.8
    CVE-2022-1388 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
    KEV May 10, 2022
  • Critical 9.8
    CVE-2022-29464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fil…

    KEV Apr 25, 2022
  • Critical 9.9
    CVE-2019-1003029 Exploited Public exploit EPSS 74%

    Sandbox bypass in Script Security Plugin

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScr…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
    KEV Apr 25, 2022
  • Critical 9.8
    CVE-2018-7841 Exploited Public exploit Scanner template EPSS 72%

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted cod…

    U.motion U.motion Builder software version 1.3.4
    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2014-0780 Exploited Public exploit EPSS 75%

    InduSoft Web Studio Path Traversal

    Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

    InduSoft Web Studio
    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2019-3929 Exploited Public exploit Scanner template EPSS 99%

    The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, B…

    Crestron Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.
    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2007-3010 Exploited Public exploit Scanner template EPSS 97%

    masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows re…

    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2022-22954 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templ…

    KEV Apr 14, 2022
  • Critical 9.8
    CVE-2020-2509 Exploited Public exploit EPSS 34%

    Command Injection Vulnerability in QTS and QuTS hero

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: …

    QNAP Systems QTS QuTS hero
    KEV Apr 11, 2022
  • Critical 9.8
    CVE-2017-11317 Exploited Public exploit EPSS 84%

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…

    KEV Apr 11, 2022
  • Critical 9.8
    CVE-2021-31166 Exploited Public exploit EPSS 100%

    HTTP Protocol Stack Remote Code Execution Vulnerability

    HTTP Protocol Stack Remote Code Execution Vulnerability

    Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows
    KEV Apr 6, 2022
  • Critical 9.8
    CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

    Remote Code Execution in Spring Framework

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

    libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
    KEV Apr 4, 2022