Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,779 results · Feed
-
High 7.0
7-Zip Mark-of-the-Web Bypass Vulnerability
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must vi…
KEV Feb 6, 2025 -
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
Critical 9.8
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privil…
KEV Feb 4, 2025 -
High 7.2
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administr…
KEV Feb 4, 2025 -
High 7.5
.NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
KEV Feb 4, 2025 -
Critical 9.8
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
KEV Feb 4, 2025 -
Critical 10.0
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, …
KEV Jan 29, 2025 -
Critical 9.8
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Managem…
KEV Jan 24, 2025 -
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Critical 10.0
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutraliz…
KEV Jan 16, 2025 -
Critical 9.6
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thr…
KEV Jan 14, 2025 -
High 7.8CVE-2025-21334 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 7.8CVE-2025-21335 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
Critical 9.6
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683…
KEV Jan 13, 2025 -
Medium 6.6
Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
KEV Jan 13, 2025 -
Critical 9.0
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.…
KEV Jan 8, 2025 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Jan 7, 2025 -
Medium 4.4
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local f…
KEV Jan 7, 2025 -
Critical 9.1
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) coul…
KEV Jan 7, 2025 -
High 7.1
PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger th…
KEV Dec 30, 2024 -
High 8.1
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
KEV Dec 23, 2024 -
Critical 9.8
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
KEV Dec 19, 2024 -
Critical 9.8
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir pa…
KEV Dec 18, 2024 -
Critical 9.8
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused t…
KEV Dec 18, 2024 -
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
KEV Dec 18, 2024 -
High 7.2
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the…
KEV Dec 18, 2024 -
Critical 9.8
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can imp…
KEV Dec 17, 2024 -
High 7.8
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
KEV Dec 16, 2024 -
High 7.4
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this …
KEV Dec 16, 2024 -
Critical 9.8
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file u…
KEV Dec 13, 2024 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Dec 10, 2024 -
Critical 10.0
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers …
KEV Dec 4, 2024 -
High 7.5CVE-2023-45727 Exploited
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail …
KEV Dec 3, 2024 -
Critical 9.8
ProjectSend Unauthenticated Configuration Modification
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's conf…
KEV Dec 3, 2024 -
High 7.5CVE-2024-11667 Exploited · Ransomware
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through…
KEV Dec 3, 2024 -
Critical 9.8
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the…
KEV Nov 25, 2024 -
High 8.8
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 1…
KEV Nov 21, 2024 -
Medium 6.3
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.…
KEV Nov 21, 2024 -
High 7.5CVE-2024-21287 Exploited
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Pr…
KEV Nov 21, 2024