CISA Known Exploited Vulnerabilities

1,118 results · Clear filters · Feed

• High 7.8
  CVE-2017-0101 Exploited · Ransomware Public exploit EPSS 57%

  The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows …

  Microsoft Windows Windows
  Mar 17, 2017

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-0841 Exploited · Ransomware Public exploit EPSS 41%

  An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

  Microsoft Windows Windows Server Windows
  Apr 9, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-0543 Exploited · Ransomware Public exploit

  An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …

  Jan 8, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1253 Exploited · Ransomware Public exploit EPSS 12%

  An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Sep 11, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1064 Exploited · Ransomware Public exploit

  Windows Elevation of Privilege Vulnerability

  An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jun 12, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1069 Exploited · Ransomware Public exploit

  Task Scheduler Elevation of Privilege Vulnerability

  An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jun 12, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1132 Exploited Public exploit

  An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

  Microsoft Windows Windows Server Windows
  Jul 29, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1405 Exploited · Ransomware Public exploit EPSS 30%

  An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Nov 12, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1322 Exploited · Ransomware Public exploit EPSS 19%

  An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft …

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Oct 10, 2019

  KEV Mar 15, 2022
• High 7.8
  CVE-2019-1315 Exploited · Ransomware Public exploit

  An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Oct 10, 2019

  KEV Mar 15, 2022
• High 7.2
  CVE-2020-8218 Exploited Public exploit EPSS 32%

  A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perfor…

  Jul 30, 2020

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2013-0625 Exploited Public exploit EPSS 94%

  Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentica…

  Jan 9, 2013

  KEV Mar 7, 2022
• High 7.5
  CVE-2013-0629 Exploited Public exploit EPSS 66%

  Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted di…

  Jan 9, 2013

  KEV Mar 7, 2022
• High 8.8
  CVE-2022-26485 Exploited Public exploit EPSS 14%

  Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Dec 22, 2022

  KEV Mar 7, 2022
• High 8.8
  CVE-2016-6277 Exploited Public exploit Scanner template EPSS 100%

  NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.…

  Dec 14, 2016

  KEV Mar 7, 2022
• Medium 6.5
  CVE-2009-3960 Exploited · Ransomware Public exploit EPSS 90%

  Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Servic…

  Feb 15, 2010

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2017-6077 Exploited Public exploit EPSS 69%

  ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitr…

  Feb 22, 2017

  KEV Mar 7, 2022
• Medium 5.3
  CVE-2021-21973 Exploited Public exploit Scanner template EPSS 88%

  The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…

  Virtualization
  Feb 24, 2021

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2019-11581 Exploited Public exploit Scanner template EPSS 85%

  There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

  Atlassian Jira Server and Data Center Web / CMS
  Aug 9, 2019

  KEV Mar 7, 2022
• Critical 9.8
  CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

  Improper Privilege Management in Tomcat

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

  Apache Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Feb 24, 2020

  KEV Mar 3, 2022
• High 7.8
  CVE-2015-7645 Exploited · Ransomware Public exploit EPSS 65%

  Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.53…

  flashplugin-nonfree Ubuntu
  Oct 15, 2015

  KEV Mar 3, 2022
• High 7.8
  CVE-2015-1701 Exploited · Ransomware Public exploit EPSS 56%

  Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local…

  Apr 21, 2015

  KEV Mar 3, 2022
• High 7.8
  CVE-2015-3043 Exploited Public exploit EPSS 74%

  Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.45…

  flashplugin-nonfree Ubuntu
  Apr 14, 2015

  KEV Mar 3, 2022
• High 7.8
  CVE-2015-5119 Exploited Public exploit EPSS 99%

  Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…

  flashplugin-nonfree Ubuntu
  Jul 8, 2015

  KEV Mar 3, 2022
• High 8.8
  CVE-2011-0611 Exploited Public exploit EPSS 99%

  Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; …

  Apr 13, 2011

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2011-3544 Exploited Public exploit EPSS 97%

  Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and…

  Oct 19, 2011

  KEV Mar 3, 2022
• High 7.4
  CVE-2018-8581 Exploited · Ransomware Public exploit EPSS 28%

  An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation o…

  Microsoft Microsoft Exchange Server
  Nov 14, 2018

  KEV Mar 3, 2022
• High 7.5
  CVE-2018-8298 Exploited Public exploit EPSS 75%

  ChakraCore RCE Vulnerability

  A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, C…

  Microsoft ChakraCore Microsoft.ChakraCore NuGet
  Jul 11, 2018

  KEV Mar 3, 2022
• High 7.8
  CVE-2013-0640 Exploited Public exploit EPSS 87%

  Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execut…

  Feb 14, 2013

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2013-0632 Exploited Public exploit EPSS 93%

  administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and po…

  Jan 17, 2013

  KEV Mar 3, 2022
• High 8.8
  CVE-2013-1347 Exploited Public exploit EPSS 78%

  Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbi…

  May 5, 2013

  KEV Mar 3, 2022
• High 8.8
  CVE-2013-3346 Exploited Public exploit EPSS 79%

  Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbit…

  Aug 30, 2013

  KEV Mar 3, 2022
• High 8.8
  CVE-2013-3897 Exploited Public exploit EPSS 77%

  Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 all…

  Oct 9, 2013

  KEV Mar 3, 2022
• High 7.8
  CVE-2013-5065 Exploited Public exploit EPSS 35%

  NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges…

  Nov 27, 2013

  KEV Mar 3, 2022
• High 7.8
  CVE-2004-0210 Exploited Public exploit

  The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain p…

  Jul 14, 2004

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-0507 Exploited · Ransomware Public exploit EPSS 98%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 U…

  Jun 7, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-1723 Exploited · Ransomware Public exploit EPSS 94%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 u…

  Jun 16, 2012

  KEV Mar 3, 2022
• High 7.8
  CVE-2012-1535 Exploited Public exploit EPSS 70%

  Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on …

  Aug 15, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-4681 Exploited · Ransomware Public exploit EPSS 99%

  Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow…

  Aug 28, 2012

  KEV Mar 3, 2022
• High 8.8
  CVE-2008-3431 Exploited Public exploit

  The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communica…

  Aug 5, 2008

  KEV Mar 3, 2022