CISA Known Exploited Vulnerabilities

928 results · Clear filters · Feed

• High 8.0
  CVE-2018-19943 Exploited · Ransomware EPSS 23%

  If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…

  QNAP Systems QTS
  Oct 28, 2020

  KEV May 24, 2022
• High 8.8
  CVE-2016-4657 Exploited Public exploit EPSS 67%

  WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory…

  qtwebkit-source qtwebkit-opensource-src webkitgtk webkit2gtk Ubuntu
  Aug 25, 2016

  KEV May 24, 2022
• High 7.8
  CVE-2016-4656 Exploited Public exploit EPSS 24%

  The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a deni…

  Aug 25, 2016

  KEV May 24, 2022
• High 7.8
  CVE-2016-6367 Exploited Public exploit EPSS 23%

  Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows lo…

  Aug 18, 2016

  KEV May 24, 2022
• High 8.8
  CVE-2016-6366 Exploited Public exploit EPSS 88%

  Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Servic…

  Aug 18, 2016

  KEV May 24, 2022
• High 8.8
  CVE-2017-0210 Exploited EPSS 22%

  An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, …

  Microsoft Internet Explorer
  Apr 12, 2017

  KEV May 24, 2022
• High 7.5
  CVE-2017-0147 Exploited · Ransomware Public exploit EPSS 100%

  The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

  Microsoft Windows SMB Windows
  Mar 17, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2017-0005 Exploited Public exploit EPSS 11%

  The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; …

  Microsoft Windows GDI+ Windows
  Mar 17, 2017

  KEV May 24, 2022
• High 8.8
  CVE-2017-0149 Exploited EPSS 28%

  Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service …

  Microsoft Internet Explorer
  Mar 17, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2017-8291 Exploited Public exploit EPSS 97%

  Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion…

  ghostscript ghostscript ghostscript Debian Ubuntu Alpine
  Apr 27, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2020-0638 Exploited · Ransomware

  An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Jan 14, 2020

  KEV May 23, 2022
• High 7.8
  CVE-2020-1027 Exploited

  An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windo…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Apr 15, 2020

  KEV May 23, 2022
• High 7.8
  CVE-2018-8589 Exploited

  An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k…

  Microsoft Windows 7 Windows Server 2008 R2 Windows Server 2008 Windows
  Nov 14, 2018

  KEV May 23, 2022
• High 7.8
  CVE-2018-5002 Exploited EPSS 24%

  Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploit…

  flashplugin-nonfree Ubuntu
  Jul 9, 2018

  KEV May 23, 2022
• High 7.8
  CVE-2021-1048 Exploited

  In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lea…

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Dec 15, 2021

  KEV May 23, 2022
• High 7.8
  CVE-2021-30883 Exploited EPSS 15%

  A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.…

  Apple macOS iOS and iPadOS macOS iOS
  Aug 24, 2021

  KEV May 23, 2022
• High 7.8
  CVE-2019-0880 Exploited

  A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 …

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Jul 15, 2019

  KEV May 23, 2022
• High 8.2
  CVE-2019-18426 Exploited Public exploit EPSS 68%

  A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…

  Facebook WhatsApp Desktop
  Jan 21, 2020

  KEV May 23, 2022
• High 7.8
  CVE-2019-7287 Exploited

  A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicati…

  Apple iOS iOS
  Dec 18, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-7286 Exploited Public exploit EPSS 16%

  A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…

  Apple macOS iOS macOS iOS
  Dec 18, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-11707 Exploited Public exploit EPSS 38%

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-1385 Exploited · Ransomware

  An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privileg…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Nov 12, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-1130 Exploited · Ransomware

  An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Jul 29, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-13720 Exploited Public exploit EPSS 49%

  Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Nov 25, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-8720 Exploited

  A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
  Mar 6, 2023

  KEV May 23, 2022
• High 7.5
  CVE-2014-0160 Exploited Public exploit EPSS 100%

  The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension pack…

  openssl Debian
  Apr 7, 2014

  KEV May 4, 2022
• High 8.8
  CVE-2014-0322 Exploited Public exploit EPSS 85%

  Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …

  Feb 14, 2014

  KEV May 4, 2022
• High 7.8
  CVE-2014-4113 Exploited Public exploit EPSS 87%

  win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 …

  Oct 15, 2014

  KEV May 4, 2022
• High 8.8
  CVE-2021-1789 Exploited EPSS 14%

  A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
  Apr 2, 2021

  KEV May 4, 2022
• High 8.8
  CVE-2019-8506 Exploited Public exploit EPSS 16%

  A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…

  Apple watchOS tvOS Safari Windows iOS Browsers Debian Ubuntu Alpine
  Dec 18, 2019

  KEV May 4, 2022
• High 7.8
  CVE-2022-0847 Exploited Public exploit EPSS 93%

  A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 7, 2022

  KEV Apr 25, 2022
• High 7.0
  CVE-2022-21919 Exploited

  Windows User Profile Service Elevation of Privilege Vulnerability

  Windows User Profile Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jan 11, 2022

  KEV Apr 25, 2022
• High 7.0
  CVE-2022-26904 Exploited Public exploit EPSS 17%

  Windows User Profile Service Elevation of Privilege Vulnerability

  Windows User Profile Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Apr 15, 2022

  KEV Apr 25, 2022
• High 7.8
  CVE-2021-40450 Exploited

  Win32k Elevation of Privilege Vulnerability

  Win32k Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Oct 13, 2021

  KEV Apr 25, 2022
• High 7.8
  CVE-2021-41357 Exploited

  Win32k Elevation of Privilege Vulnerability

  Win32k Elevation of Privilege Vulnerability

  Microsoft Windows Server 2022 Windows 11 version 21H2 Windows 10 Version 20H2 Windows
  Oct 13, 2021

  KEV Apr 25, 2022
• High 7.8
  CVE-2022-22718 Exploited Public exploit EPSS 18%

  Windows Print Spooler Elevation of Privilege Vulnerability

  Windows Print Spooler Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Feb 9, 2022

  KEV Apr 19, 2022
• High 8.8
  CVE-2022-1364 Exploited Public exploit EPSS 14%

  Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Jul 26, 2022

  KEV Apr 15, 2022
• High 7.8
  CVE-2022-22960 Exploited Public exploit EPSS 36%

  VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due …

  Apr 13, 2022

  KEV Apr 15, 2022
• High 7.5
  CVE-2016-4523 Exploited EPSS 31%

  The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause …

  Jun 9, 2016

  KEV Apr 15, 2022
• High 7.8
  CVE-2015-0311 Exploited Public exploit EPSS 86%

  Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windo…

  flashplugin-nonfree Ubuntu
  Jan 23, 2015

  KEV Apr 13, 2022