Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
564 results · Clear filters · Feed
-
High 7.5
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticat…
KEV Aug 5, 2025 -
High 8.8
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote a…
KEV Jul 22, 2025 -
High 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
KEV Jul 22, 2025 -
High 7.5
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x …
KEV Jul 7, 2025 -
High 7.5
Path Traversal in Action View
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
KEV Jul 7, 2025 -
High 8.1
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write …
KEV Jul 2, 2025 -
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
High 8.8
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabil…
KEV Jun 16, 2025 -
High 8.8
Internet Shortcut Files Remote Code Execution Vulnerability
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
KEV Jun 10, 2025 -
High 8.8
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exp…
KEV Jun 5, 2025 -
High 8.6
Incorrect Authorization in Graphics
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
KEV Jun 3, 2025 -
High 8.8
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_appl…
KEV Jun 2, 2025 -
High 7.2
Remote Code Execution
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
KEV May 19, 2025 -
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
KEV May 13, 2025 -
High 7.5
Scripting Engine Memory Corruption Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
KEV May 13, 2025 -
High 7.8
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.
KEV May 13, 2025 -
High 8.1
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…
KEV May 6, 2025 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
KEV Apr 8, 2025 -
High 8.3
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allo…
KEV Mar 27, 2025 -
High 8.6
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to …
KEV Mar 19, 2025 -
High 7.5
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application S…
KEV Mar 19, 2025 -
High 8.1
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0…
KEV Mar 18, 2025 -
High 8.6
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…
KEV Mar 18, 2025 -
High 7.8
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
KEV Mar 11, 2025 -
High 7.0
Microsoft Management Console Security Feature Bypass Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
KEV Mar 11, 2025 -
High 8.4
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 3, 2025 -
High 8.6
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
KEV Mar 3, 2025 -
High 8.8
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
KEV Mar 3, 2025 -
High 8.2
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…
KEV Feb 18, 2025 -
High 8.8
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the l…
KEV Feb 11, 2025 -
High 8.6
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable t…
KEV Feb 7, 2025 -
High 7.0
7-Zip Mark-of-the-Web Bypass Vulnerability
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must vi…
KEV Feb 6, 2025 -
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
High 7.2
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administr…
KEV Feb 4, 2025 -
High 7.5
.NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
KEV Feb 4, 2025 -
High 7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 7.8
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
KEV Dec 16, 2024 -
High 7.4
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this …
KEV Dec 16, 2024 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Dec 10, 2024 -
High 8.8
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 1…
KEV Nov 21, 2024