CISA Known Exploited Vulnerabilities

627 results · Clear filters · Feed

• Critical 9.1
  CVE-2015-4068 Exploited EPSS 64%

  Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive infor…

  May 29, 2015

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2018-0125 Exploited EPSS 55%

  A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers…

  Feb 8, 2018

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2018-0147 Exploited EPSS 18%

  A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 c…

  Mar 8, 2018

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2018-11138 Exploited · Ransomware Public exploit Scanner template EPSS 92%

  The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible b…

  May 31, 2018

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2018-1273 Exploited · Ransomware Public exploit Scanner template EPSS 97%

  Spring Data Commons remote code injection vulnerability

  Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can sup…

  Spring by Pivotal Spring Framework org.springframework.data:spring-data-commons Maven
  Apr 11, 2018

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2018-14839 Exploited EPSS 89%

  LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The atta…

  May 14, 2019

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2013-4810 Exploited Public exploit EPSS 79%

  HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle…

  Sep 13, 2013

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2013-2251 Exploited Public exploit Scanner template EPSS 100%

  Code injection in Apache Struts

  Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

  org.apache.struts:struts2-core Maven
  Jul 18, 2013

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2012-1823 Exploited Public exploit Scanner template EPSS 100%

  sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does no…

  May 11, 2012

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2022-26318 Exploited Public exploit EPSS 78%

  On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulne…

  Mar 4, 2022

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2022-26143 Exploited Scanner template EPSS 87%

  The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allow…

  Mar 9, 2022

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2014-6287 Exploited Public exploit Scanner template EPSS 99%

  The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c …

  Oct 7, 2014

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2005-2773 Exploited Public exploit EPSS 74%

  HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metac…

  Sep 2, 2005

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2016-1555 Exploited Public exploit Scanner template EPSS 98%

  (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgea…

  Apr 21, 2017

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2016-10174 Exploited Public exploit EPSS 83%

  The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.c…

  Jan 30, 2017

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2010-4344 Exploited Public exploit EPSS 72%

  Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to ex…

  exim4 Debian
  Dec 14, 2010

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2009-1151 Exploited Public exploit Scanner template EPSS 97%

  Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows rem…

  phpmyadmin Debian
  Mar 26, 2009

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2017-6316 Exploited Public exploit EPSS 73%

  Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as …

  Jul 20, 2017

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2017-3881 Exploited Public exploit Scanner template EPSS 99%

  A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software c…

  iOS
  Mar 17, 2017

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2021-42237 Exploited · Ransomware Public exploit Scanner template EPSS 97%

  Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…

  Nov 5, 2021

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2021-22941 Exploited · Ransomware Public exploit EPSS 54%

  Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…

  Sep 23, 2021

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2019-16920 Exploited Public exploit Scanner template EPSS 100%

  Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The …

  Sep 27, 2019

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2019-12989 Exploited Public exploit Scanner template EPSS 95%

  Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

  Jul 16, 2019

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2019-15107 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…

  Aug 16, 2019

  KEV Mar 25, 2022
• Critical 9.9
  CVE-2019-1003030 Exploited Public exploit Scanner template EPSS 97%

  Sandbox bypass in Jenkins Pipeline: Groovy Plugin

  A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the …

  Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Mar 8, 2019

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2019-10068 Exploited Public exploit Scanner template EPSS 95%

  An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x version…

  Mar 26, 2019

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2020-5135 Exploited · Ransomware EPSS 27%

  A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially ex…

  SonicWall SonicOS Network devices
  Oct 12, 2020

  KEV Mar 15, 2022
• Critical 9.8
  CVE-2013-0625 Exploited Public exploit EPSS 94%

  Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentica…

  Jan 9, 2013

  KEV Mar 7, 2022
• Critical 9.6
  CVE-2022-26486 Exploited

  An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Dec 22, 2022

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2017-6077 Exploited Public exploit EPSS 69%

  ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitr…

  Feb 22, 2017

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2019-11581 Exploited Public exploit Scanner template EPSS 85%

  There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

  Atlassian Jira Server and Data Center Web / CMS
  Aug 9, 2019

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

  Improper Privilege Management in Tomcat

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

  Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Feb 24, 2020

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2015-2590 Exploited EPSS 25%

  Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

  openjdk-7 openjdk-6 Ubuntu
  Jul 16, 2015

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2011-1889 Exploited EPSS 49%

  The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remo…

  Jun 16, 2011

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2011-3544 Exploited Public exploit EPSS 97%

  Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and…

  Oct 19, 2011

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2018-0151 Exploited EPSS 14%

  A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow a…

  iOS
  Mar 28, 2018

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2013-0632 Exploited Public exploit EPSS 93%

  administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and po…

  Jan 17, 2013

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-0507 Exploited · Ransomware Public exploit EPSS 98%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 U…

  Jun 7, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-1723 Exploited · Ransomware Public exploit EPSS 94%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 u…

  Jun 16, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-4681 Exploited · Ransomware Public exploit EPSS 99%

  Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow…

  Aug 28, 2012

  KEV Mar 3, 2022