CISA Known Exploited Vulnerabilities

1,118 results · Clear filters · Feed

• High 7.0
  CVE-2021-1782 Exploited Public exploit

  A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…

  Apple macOS iOS and iPadOS macOS iOS
  Apr 2, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-1675 Exploited · Ransomware Public exploit EPSS 85%

  Windows Print Spooler Remote Code Execution Vulnerability

  Windows Print Spooler Remote Code Execution Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jun 8, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-1498 Exploited Public exploit Scanner template EPSS 100%

  Cisco HyperFlex HX Command Injection Vulnerabilities

  Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

  Cisco Cisco HyperFlex HX Data Platform Network devices
  May 6, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-1732 Exploited · Ransomware Public exploit EPSS 78%

  Windows Win32k Elevation of Privilege Vulnerability

  Windows Win32k Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Feb 25, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-1647 Exploited Public exploit EPSS 40%

  Microsoft Defender Remote Code Execution Vulnerability

  Microsoft Defender Remote Code Execution Vulnerability

  Microsoft Microsoft Security Essentials Windows Defender Microsoft System Center Endpoint Protection Windows
  Jan 12, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-38003 Exploited Public exploit EPSS 39%

  Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Nov 23, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-38648 Exploited Public exploit EPSS 11%

  Open Management Infrastructure Elevation of Privilege Vulnerability

  Open Management Infrastructure Elevation of Privilege Vulnerability

  Microsoft Azure Stack Hub Open Management Infrastructure Container Monitoring Solution
  Sep 15, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-38647 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

  Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

  Microsoft Azure Stack Hub Open Management Infrastructure Azure Sentinel
  Sep 15, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-36955 Exploited · Ransomware Public exploit

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Sep 15, 2021

  KEV Nov 3, 2021
• High 7.5
  CVE-2021-36942 Exploited · Ransomware Public exploit EPSS 66%

  Windows LSA Spoofing Vulnerability

  Windows LSA Spoofing Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2016 Windows
  Aug 12, 2021

  KEV Nov 3, 2021
• Medium 6.6
  CVE-2021-31207 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Exchange Server Security Feature Bypass Vulnerability

  Microsoft Exchange Server Security Feature Bypass Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
  May 11, 2021

  KEV Nov 3, 2021
• Medium 5.5
  CVE-2021-31955 Exploited Public exploit EPSS 81%

  Windows Kernel Information Disclosure Vulnerability

  Windows Kernel Information Disclosure Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jun 8, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-31956 Exploited Public exploit EPSS 22%

  Windows NTFS Elevation of Privilege Vulnerability

  Windows NTFS Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jun 8, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-27101 Exploited · Ransomware Public exploit

  Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…

  Feb 16, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-27065 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
  Mar 2, 2021

  KEV Nov 3, 2021
• Medium 5.5
  CVE-2021-30657 Exploited Public exploit EPSS 69%

  A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …

  Apple macOS macOS
  Sep 8, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-30860 Exploited Public exploit EPSS 76%

  An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catal…

  Apple macOS watchOS iOS macOS iOS
  Aug 24, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-30807 Exploited Public exploit EPSS 29%

  A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS…

  Apple macOS macOS
  Oct 19, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-30563 Exploited Public exploit

  Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corr…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Aug 3, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-30551 Exploited Public exploit EPSS 65%

  Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corr…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Jun 15, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-30858 Exploited Public exploit EPSS 13%

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, …

  Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-30632 Exploited Public exploit EPSS 63%

  Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Oct 8, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-40444 Exploited · Ransomware Public exploit EPSS 98%

  Microsoft MSHTML Remote Code Execution Vulnerability

  Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An a…

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Sep 15, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-40539 Exploited · Ransomware Public exploit Scanner template EPSS 99%

  Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…

  Sep 7, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-21148 Exploited Public exploit EPSS 20%

  Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit hea…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Feb 9, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-21220 Exploited Public exploit EPSS 70%

  Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Apr 26, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-21985 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

  Virtualization
  May 26, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-21972 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…

  Virtualization
  Feb 24, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-21017 Exploited Public exploit EPSS 86%

  Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

  Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achiev…

  Adobe Acrobat Reader
  Feb 11, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-21193 Exploited Public exploit

  Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Mar 16, 2021

  KEV Nov 3, 2021
• High 7.5
  CVE-2021-41773 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

  A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
  Oct 5, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-42258 Exploited · Ransomware Public exploit Scanner template EPSS 75%

  BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…

  Oct 22, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-42013 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

  It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
  Oct 7, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-37975 Exploited Public exploit EPSS 35%

  Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corru…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Oct 8, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-22502 Exploited Public exploit Scanner template EPSS 97%

  Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…

  Feb 8, 2021

  KEV Nov 3, 2021
• Critical 10.0
  CVE-2021-22205 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

  GitLab GitLab gitlab Web / CMS Ubuntu
  Apr 23, 2021

  KEV Nov 3, 2021
• Critical 10.0
  CVE-2021-22893 Exploited · Ransomware Public exploit EPSS 48%

  Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

  Apr 23, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-22986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…

  Mar 31, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-22005 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…

  Virtualization
  Sep 23, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-26084 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

  Atlassian Confluence Data Center Confluence Server Web / CMS
  Aug 30, 2021

  KEV Nov 3, 2021