Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,779 results · Feed
-
Critical 9.8
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles pag…
KEV Sep 18, 2024 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Sep 18, 2024 -
Critical 9.8
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…
KEV Sep 18, 2024 -
Critical 9.8
Apache HugeGraph-Server: Command execution in gremlin
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the…
KEV Sep 18, 2024 -
High 8.8
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 …
KEV Sep 17, 2024 -
High 8.8
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and …
KEV Sep 17, 2024 -
High 8.8
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windo…
KEV Sep 17, 2024 -
High 8.8
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and M…
KEV Sep 17, 2024 -
Critical 9.8
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
KEV Sep 16, 2024 -
High 8.8
Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
KEV Sep 16, 2024 -
High 7.2
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a rem…
KEV Sep 13, 2024 -
High 7.8CVE-2024-38014 Exploited
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
KEV Sep 10, 2024 -
High 7.3CVE-2024-38226 Exploited
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
KEV Sep 10, 2024 -
Medium 5.4
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Sep 10, 2024 -
Critical 9.3
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially le…
KEV Sep 9, 2024 -
High 8.4
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6…
KEV Sep 9, 2024 -
High 7.8
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb…
KEV Sep 9, 2024 -
Critical 9.3CVE-2024-7262 Exploited
Arbitrary Code Execution in WPS Office
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-clic…
KEV Sep 3, 2024 -
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exp…
KEV Aug 28, 2024 -
High 8.1
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of …
KEV Aug 27, 2024 -
High 8.8
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a…
KEV Aug 26, 2024 -
Medium 6.6CVE-2024-39717 Exploited
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only ava…
KEV Aug 23, 2024 -
High 8.4
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functi…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
High 7.2
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Aug 21, 2024 -
Critical 9.8
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files …
KEV Aug 19, 2024 -
Critical 9.8
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, Sola…
KEV Aug 15, 2024 -
High 8.8CVE-2024-38189 Exploited
Microsoft Project Remote Code Execution Vulnerability
Microsoft Project Remote Code Execution Vulnerability
KEV Aug 13, 2024 -
High 7.8CVE-2024-38107 Exploited
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
High 7.5
Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
KEV Aug 13, 2024 -
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
Medium 6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Aug 13, 2024 -
High 7.0CVE-2024-38106 Exploited
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
Critical 9.1
Apache OFBiz: Path traversal leading to RCE
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
KEV Aug 7, 2024 -
High 7.8
net: fix __dst_negative_advice() race
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…
KEV Aug 7, 2024 -
High 7.5
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized…
KEV Aug 5, 2024 -
Medium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…
KEV Jul 30, 2024