Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

928 results · Clear filters · Feed

  • High 7.2
    CVE-2019-1652 Exploited Public exploit EPSS 96%

    Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability

    A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vu…

    Cisco Cisco Small Business RV Series Router Firmware Network devices
    KEV Mar 3, 2022
  • High 7.8
    CVE-2014-6352 Exploited Public exploit EPSS 77%

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server …

    KEV Feb 25, 2022
  • High 8.8
    CVE-2017-0222 Exploited EPSS 30%

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…

    Microsoft Internet Explorer
    KEV Feb 25, 2022
  • High 7.8
    CVE-2017-8570 Exploited Public exploit EPSS 90%

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mi…

    Microsoft Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016.
    KEV Feb 25, 2022
  • High 7.5
    CVE-2018-8174 Exploited · Ransomware Public exploit EPSS 88%

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Window…

    Microsoft Windows Server 2016 Windows Server 2012 R2 Windows Server 2012 Windows
    KEV Feb 15, 2022
  • High 7.8
    CVE-2018-15982 Exploited · Ransomware Public exploit EPSS 90%

    Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successfu…

    flashplugin-nonfree Ubuntu
    KEV Feb 15, 2022
  • High 7.8
    CVE-2018-20250 Exploited · Ransomware Public exploit EPSS 96%

    In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field …

    Check Point Software Technologies WinRAR Network devices
    KEV Feb 15, 2022
  • High 7.8
    CVE-2013-3906 Exploited Public exploit EPSS 85%

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compat…

    KEV Feb 15, 2022
  • High 8.8
    CVE-2022-0609 Exploited EPSS 23%

    Use after free in Animation

    Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine NuGet
    KEV Feb 15, 2022
  • High 7.8
    CVE-2014-1761 Exploited Public exploit EPSS 78%

    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Off…

    KEV Feb 15, 2022
  • High 7.5
    CVE-2019-0752 Exploited · Ransomware Public exploit EPSS 82%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 10
    KEV Feb 15, 2022
  • High 8.8
    CVE-2022-22620 Exploited Public exploit EPSS 16%

    A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS…

    Apple macOS Safari (v and ) qtwebkit-source macOS Browsers Debian Ubuntu Alpine
    KEV Feb 11, 2022
  • High 7.8
    CVE-2015-1130 Exploited Public exploit

    The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and …

    KEV Feb 10, 2022
  • High 8.8
    CVE-2015-2051 Exploited Public exploit EPSS 97%

    The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute a…

    KEV Feb 10, 2022
  • High 7.8
    CVE-2014-4404 Exploited Public exploit EPSS 49%

    Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbit…

    KEV Feb 10, 2022
  • High 8.8
    CVE-2017-0144 Exploited · Ransomware Public exploit EPSS 99%

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

    Microsoft Windows SMB Windows
    KEV Feb 10, 2022
  • High 7.8
    CVE-2017-0262 Exploited EPSS 81%

    Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

    Microsoft Microsoft Office
    KEV Feb 10, 2022
  • High 7.8
    CVE-2017-0263 Exploited Public exploit EPSS 10%

    The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…

    Microsoft Microsoft Windows Windows
    KEV Feb 10, 2022
  • High 8.8
    CVE-2017-0145 Exploited · Ransomware Public exploit EPSS 90%

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

    Microsoft Windows SMB Windows
    KEV Feb 10, 2022
  • High 8.8
    CVE-2017-8464 Exploited Public exploit EPSS 90%

    Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20…

    Microsoft Windows Shell Windows
    KEV Feb 10, 2022
  • High 7.5
    CVE-2017-10271 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Support…

    Oracle WebLogic Server
    KEV Feb 10, 2022
  • High 7.8
    CVE-2021-36934 Exploited Public exploit EPSS 67%

    Windows Elevation of Privilege Vulnerability

    An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbit…

    Microsoft Windows 10 Version 1809 Windows 10 Version 20H2 Windows 10 Version 1909 Windows
    KEV Feb 10, 2022
  • High 7.0
    CVE-2022-21882 Exploited · Ransomware Public exploit EPSS 59%

    Win32k Elevation of Privilege Vulnerability

    Win32k Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Feb 4, 2022
  • High 7.8
    CVE-2020-0787 Exploited · Ransomware Public exploit EPSS 43%

    An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improper…

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Jan 28, 2022
  • High 7.8
    CVE-2018-8453 Exploited · Ransomware Public exploit EPSS 70%

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows
    KEV Jan 21, 2022
  • High 7.5
    CVE-2006-1547 Exploited EPSS 55%

    Improper Input Validation in Apache Struts

    ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler metho…

    struts:struts Maven
    KEV Jan 21, 2022
  • High 8.8
    CVE-2020-11978 Exploited Public exploit Scanner template EPSS 99%

    Remote code execution (RCE) in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
    KEV Jan 18, 2022
  • High 8.8
    CVE-2020-13671 Exploited Public exploit EPSS 31%

    Drupal core Unrestricted Upload of File with Dangerous Type

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
    KEV Jan 18, 2022
  • High 7.5
    CVE-2020-14864 Exploited Public exploit Scanner template EPSS 97%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: In…

    Oracle Business Intelligence Enterprise Edition
    KEV Jan 18, 2022
  • High 7.3
    CVE-2021-33766 Exploited Public exploit Scanner template EPSS 98%

    Microsoft Exchange Server Information Disclosure Vulnerability

    Microsoft Exchange Server Information Disclosure Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Jan 18, 2022
  • High 8.2
    CVE-2021-32648 Exploited Public exploit Scanner template EPSS 91%

    Account Takeover in Octobercms

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…

    October CMS october october/system Packagist
    KEV Jan 18, 2022
  • High 7.1
    CVE-2021-21315 Exploited Public exploit Scanner template EPSS 91%

    Command Injection Vulnerability

    The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerabili…

    sebhildebrandt systeminformation systeminformation npm
    KEV Jan 18, 2022
  • High 8.8
    CVE-2021-25298 Exploited Public exploit Scanner template EPSS 74%

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…

    KEV Jan 18, 2022
  • High 8.8
    CVE-2021-25296 Exploited Public exploit Scanner template EPSS 72%

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…

    KEV Jan 18, 2022
  • High 8.8
    CVE-2021-25297 Exploited Public exploit Scanner template EPSS 57%

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…

    KEV Jan 18, 2022
  • High 8.8
    CVE-2020-6572 Exploited EPSS 11%

    Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via …

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV Jan 10, 2022
  • High 8.1
    CVE-2019-1579 Exploited · Ransomware Public exploit EPSS 44%

    Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…

    KEV Jan 10, 2022
  • High 7.8
    CVE-2019-1458 Exploited · Ransomware Public exploit EPSS 74%

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Windows Server Windows
    KEV Jan 10, 2022
  • High 7.5
    CVE-2019-2725 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Support…

    Oracle Tape Library ACSLS
    KEV Jan 10, 2022
  • High 8.8
    CVE-2021-4102 Exploited

    Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corr…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV Dec 15, 2021