Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

564 results · Clear filters · Feed

  • High 7.2
    CVE-2020-8260 Exploited Public exploit EPSS 96%

    A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perfor…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2020-8655 Exploited Public exploit EPSS 60%

    An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerabilit…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-10199 Exploited Public exploit Scanner template EPSS 99%

    Nexus Repository Manager 3 - Remote Code Execution

    Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

    org.sonatype.nexus:nexus-extdirect Maven
    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-10221 Exploited Public exploit Scanner template EPSS 77%

    lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-5735 Exploited Public exploit EPSS 36%

    Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2020-5849 Exploited Public exploit EPSS 93%

    Unraid 6.8.0 allows authentication bypass.

    KEV Nov 3, 2021
  • High 7.2
    CVE-2020-14883 Exploited Public exploit Scanner template EPSS 98%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • High 7.8
    CVE-2015-1641 Exploited Public exploit EPSS 97%

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Com…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2018-0798 Exploited Public exploit EPSS 95%

    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…

    Microsoft Equation Editor
    KEV Nov 3, 2021
  • High 7.8
    CVE-2018-0802 Exploited · Ransomware Public exploit EPSS 93%

    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…

    Microsoft Equation Editor
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-0171 Exploited Public exploit Scanner template EPSS 99%

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…

    iOS
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-0296 Exploited Public exploit Scanner template EPSS 100%

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, rem…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-18325 Exploited Public exploit Scanner template EPSS 74%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 8.1
    CVE-2018-11776 Exploited Public exploit Scanner template EPSS 100%

    Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-15811 Exploited Public exploit Scanner template EPSS 76%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 8.8
    CVE-2012-0158 Exploited · Ransomware Public exploit EPSS 100%

    The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Control…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2014-1812 Exploited · Ransomware Public exploit EPSS 65%

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-0185 Exploited Public exploit EPSS 70%

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrar…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-7255 Exploited · Ransomware Public exploit EPSS 81%

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-3235 Exploited Public exploit EPSS 43%

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mish…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2016-3976 Exploited Public exploit EPSS 47%

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary fi…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-3643 Exploited Public exploit

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfigurati…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-0143 Exploited · Ransomware Public exploit EPSS 93%

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

    Microsoft Windows SMB Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-0199 Exploited · Ransomware Public exploit EPSS 99%

    Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windo…

    Microsoft Office/WordPad
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-16651 Exploited Public exploit EPSS 46%

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…

    roundcube roundcube roundcubemail Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-11882 Exploited · Ransomware Public exploit EPSS 100%

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and M…

    Microsoft Microsoft Office
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-11774 Exploited Public exploit EPSS 60%

    Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary comman…

    Microsoft Microsoft Outlook
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-6327 Exploited Public exploit EPSS 36%

    The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a sit…

    Symantec Messaging Gateway
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-8759 Exploited Public exploit EPSS 89%

    Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely v…

    Microsoft Microsoft .NET Framework
    KEV Nov 3, 2021
  • High 8.1
    CVE-2017-9805 Exploited Public exploit Scanner template EPSS 99%

    REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-9822 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    DNN (aka DotNetNuke) has Remote Code Execution via a cookie

    DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

    DotNetNuke DotNetNuke CMS Fixed in 9.1.1 DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-34527 Exploited · Ransomware Public exploit EPSS 100%

    Windows Print Spooler Remote Code Execution Vulnerability

    A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could th…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • High 8.4
    CVE-2021-33739 Exploited Public exploit

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Microsoft Windows 10 Version 20H2 Windows 10 Version 1909 Windows Server version 20H2 Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2021-28310 Exploited Public exploit

    Win32k Elevation of Privilege Vulnerability

    Win32k Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-28664 Exploited Public exploit

    The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unpriv…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-28663 Exploited Public exploit EPSS 12%

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

    KEV Nov 3, 2021
  • High 7.0
    CVE-2021-1782 Exploited Public exploit

    A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…

    Apple macOS iOS and iPadOS macOS iOS
    KEV Nov 3, 2021
  • High 7.8
    CVE-2021-1675 Exploited · Ransomware Public exploit EPSS 85%

    Windows Print Spooler Remote Code Execution Vulnerability

    Windows Print Spooler Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2021-1732 Exploited · Ransomware Public exploit EPSS 78%

    Windows Win32k Elevation of Privilege Vulnerability

    Windows Win32k Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021