CISA Known Exploited Vulnerabilities

1,779 results · Feed

• Critical 10.0
  CVE-2023-20198 Exploited Public exploit Scanner template EPSS 100%

  Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…

  Cisco Cisco IOS XE Software iOS Network devices
  Oct 16, 2023

  KEV Oct 16, 2023
• Medium 6.5
  CVE-2023-36563 Exploited EPSS 20%

  Microsoft WordPad Information Disclosure Vulnerability

  Microsoft WordPad Information Disclosure Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.8
  CVE-2023-21608 Exploited Public exploit EPSS 59%

  Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

  Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…

  Adobe Acrobat Reader
  Jan 18, 2023

  KEV Oct 10, 2023
• Medium 5.3
  CVE-2023-41763 Exploited Scanner template EPSS 90%

  Skype for Business Elevation of Privilege Vulnerability

  Skype for Business Elevation of Privilege Vulnerability

  Microsoft Skype for Business Server 2015 CU13 Skype for Business Server 2019 CU7
  Oct 10, 2023

  KEV Oct 10, 2023
• Medium 6.6
  CVE-2023-20109 Exploited

  A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Sof…

  Cisco Cisco IOS XE Software IOS iOS Network devices
  Sep 27, 2023

  KEV Oct 10, 2023
• Critical 10.0
  CVE-2023-40044 Exploited · Ransomware Public exploit Scanner template EPSS 90%

  WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

  In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

  Progress Software WS_FTP Server
  Sep 27, 2023

  KEV Oct 5, 2023
• High 7.8
  CVE-2023-42824 Exploited Public exploit

  The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may…

  Apple iOS and iPadOS iOS
  Oct 4, 2023

  KEV Oct 5, 2023
• Critical 10.0
  CVE-2023-22515 Exploited · Ransomware Public exploit Scanner template EPSS 99%

  Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…

  Atlassian Confluence Data Center Confluence Server Web / CMS
  Oct 4, 2023

  KEV Oct 5, 2023
• High 7.0
  CVE-2023-28229 Exploited Public exploit

  Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

  Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Apr 11, 2023

  KEV Oct 4, 2023
• Critical 9.8
  CVE-2023-42793 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

  JetBrains TeamCity
  Sep 19, 2023

  KEV Oct 4, 2023
• Medium 5.5
  CVE-2023-4211 Exploited

  Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations

  A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

  Arm Valhall GPU Kernel Driver Arm 5th Gen GPU Architecture Kernel Driver Bifrost GPU Kernel Driver
  Oct 1, 2023

  KEV Oct 3, 2023
• High 8.8
  CVE-2023-5217 Exploited Public exploit EPSS 49%

  Electron affected by libvpx's heap buffer overflow in vp8 encoding

  Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm
  Sep 28, 2023

  KEV Oct 2, 2023
• Critical 9.8
  CVE-2018-14667 Exploited Public exploit EPSS 74%

  Richfaces vulnerable to arbitrary code execution

  The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4…

  [UNKNOWN] RichFaces org.richfaces:richfaces-core Maven
  Nov 6, 2018

  KEV Sep 28, 2023
• High 8.8
  CVE-2023-41993 Exploited Public exploit EPSS 24%

  The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead t…

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Wolfi
  Sep 21, 2023

  KEV Sep 25, 2023
• Medium 5.5
  CVE-2023-41991 Exploited Public exploit EPSS 13%

  A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A ma…

  Apple macOS iOS and iPadOS macOS iOS
  Sep 21, 2023

  KEV Sep 25, 2023
• High 7.8
  CVE-2023-41992 Exploited Public exploit EPSS 12%

  The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, mac…

  Apple macOS iOS and iPadOS macOS iOS
  Sep 21, 2023

  KEV Sep 25, 2023
• High 7.2
  CVE-2023-41179 Exploited

  A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free…

  Trend Micro Trend Micro Apex One Trend Micro Worry-Free Business Security Trend Micro Worry-Free Business Security Services
  Sep 19, 2023

  KEV Sep 21, 2023
• High 8.8
  CVE-2023-28434 Exploited Public exploit

  MinIO is vulnerable to privilege escalation on Linux/MacOS

  Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…

  minio minio minio minio-iamguarded-2025-compat Wolfi Go
  Mar 22, 2023

  KEV Sep 19, 2023
• Medium 5.0
  CVE-2022-22265 Exploited

  An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary …

  Samsung Mobile Samsung Mobile Devices
  Jan 7, 2022

  KEV Sep 18, 2023
• Critical 9.8
  CVE-2014-8361 Exploited Public exploit EPSS 100%

  The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClie…

  May 1, 2015

  KEV Sep 18, 2023
• High 8.8
  CVE-2017-6884 Exploited · Ransomware Public exploit EPSS 33%

  A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vu…

  Apr 6, 2017

  KEV Sep 18, 2023
• Critical 9.8
  CVE-2021-3129 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Unauthenticated remote code execution in Ignition

  Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Larave…

  facade/ignition Packagist
  Jan 12, 2021

  KEV Sep 18, 2023
• High 7.8
  CVE-2023-26369 Exploited

  [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

  Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…

  Adobe Acrobat Reader
  Sep 13, 2023

  KEV Sep 14, 2023
• High 8.8
  CVE-2023-35674 Exploited Public exploit

  In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…

  Google Android Android
  Sep 11, 2023

  KEV Sep 13, 2023
• High 8.8
  CVE-2023-4863 Exploited Public exploit EPSS 100%

  libwebp: OOB write in BuildHuffmanTable

  Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

  Google Chrome libwebp chromium Browsers Debian Ubuntu Azure Linux Alpine Wolfi npm PyPI Go crates.io NuGet
  Sep 12, 2023

  KEV Sep 13, 2023
• Medium 5.0
  CVE-2023-20269 Exploited · Ransomware EPSS 27%

  A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe…

  Cisco Cisco Firepower Threat Defense Software Cisco Adaptive Security Appliance (ASA) Software Network devices
  Sep 6, 2023

  KEV Sep 13, 2023
• Medium 6.5
  CVE-2023-36761 Exploited EPSS 20%

  Microsoft Word Information Disclosure Vulnerability

  Microsoft Word Information Disclosure Vulnerability

  Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
  Sep 12, 2023

  KEV Sep 12, 2023
• High 7.8
  CVE-2023-36802 Exploited Public exploit EPSS 28%

  Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

  Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Sep 12, 2023

  KEV Sep 12, 2023
• High 7.8
  CVE-2023-41064 Exploited Public exploit EPSS 53%

  A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.…

  Apple macOS iOS and iPadOS macOS iOS
  Sep 7, 2023

  KEV Sep 11, 2023
• High 7.8
  CVE-2023-41061 Exploited

  A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.…

  Apple iOS and iPadOS watchOS iOS
  Sep 7, 2023

  KEV Sep 11, 2023
• Critical 9.8
  CVE-2023-33246 Exploited Public exploit Scanner template EPSS 97%

  Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

  For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attack…

  Apache Software Foundation Apache RocketMQ org.apache.rocketmq:rocketmq-broker org.apache.rocketmq:rocketmq-namesrv Maven
  May 24, 2023

  KEV Sep 6, 2023
• High 7.8
  CVE-2023-38831 Exploited · Ransomware Public exploit EPSS 100%

  RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within …

  Aug 23, 2023

  KEV Aug 24, 2023
• High 8.6
  CVE-2023-32315 Exploited Public exploit Scanner template EPSS 100%

  Openfire administration console authentication bypass

  Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to us…

  igniterealtime Openfire org.igniterealtime.openfire:xmppserver openfire Alpine Maven
  May 26, 2023

  KEV Aug 24, 2023
• Critical 9.8
  CVE-2023-38035 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an…

  ivanti MobileIron Sentry Network devices
  Aug 21, 2023

  KEV Aug 22, 2023
• High 7.5
  CVE-2023-27532 Exploited · Ransomware Public exploit EPSS 81%

  Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…

  Mar 10, 2023

  KEV Aug 22, 2023
• Critical 9.8
  CVE-2023-26359 Exploited EPSS 17%

  Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

  Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss…

  Adobe ColdFusion
  Mar 23, 2023

  KEV Aug 21, 2023
• Critical 9.8
  CVE-2023-24489 Exploited Public exploit Scanner template EPSS 97%

  A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…

  Citrix Citrix ShareFile Storage Zones Controller Network devices
  Jul 10, 2023

  KEV Aug 16, 2023
• High 7.5
  CVE-2023-38180 Exploited EPSS 14%

  .NET and Visual Studio Denial of Service Vulnerability

  .NET and Visual Studio Denial of Service Vulnerability

  Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet
  Aug 8, 2023

  KEV Aug 9, 2023
• Critical 9.8
  CVE-2017-18368 Exploited Public exploit EPSS 95%

  The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injec…

  May 2, 2019

  KEV Aug 7, 2023