CISA Known Exploited Vulnerabilities

1,779 results · Feed

• High 8.8
  CVE-2022-26500 Exploited · Ransomware

  Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated…

  Mar 17, 2022

  KEV Dec 13, 2022
• High 8.8
  CVE-2022-4262 Exploited Public exploit EPSS 24%

  Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Dec 2, 2022

  KEV Dec 5, 2022
• Critical 9.6
  CVE-2022-4135 Exploited EPSS 32%

  Heap buffer overflow in GPU

  Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu npm
  Nov 25, 2022

  KEV Nov 28, 2022
• Critical 9.8
  CVE-2021-35587 Exploited Public exploit Scanner template EPSS 96%

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…

  Oracle Access Manager
  Jan 19, 2022

  KEV Nov 28, 2022
• Medium 5.4
  CVE-2022-41049 Exploited

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 9, 2022

  KEV Nov 14, 2022
• High 7.8
  CVE-2022-41073 Exploited · Ransomware

  Windows Print Spooler Elevation of Privilege Vulnerability

  Windows Print Spooler Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 9, 2022

  KEV Nov 8, 2022
• High 7.8
  CVE-2022-41125 Exploited

  Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

  Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 9, 2022

  KEV Nov 8, 2022
• High 8.8
  CVE-2022-41128 Exploited EPSS 25%

  Windows Scripting Languages Remote Code Execution Vulnerability

  Windows Scripting Languages Remote Code Execution Vulnerability

  Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2022 Windows
  Nov 9, 2022

  KEV Nov 8, 2022
• Medium 5.4
  CVE-2022-41091 Exploited · Ransomware

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 9, 2022

  KEV Nov 8, 2022
• Medium 4.4
  CVE-2021-25337 Exploited Public exploit

  Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

  Samsung Mobile Samsung Mobile Devices
  Mar 4, 2021

  KEV Nov 8, 2022
• Medium 6.2
  CVE-2021-25369 Exploited

  An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…

  Samsung Mobile Samsung Mobile Devices
  Mar 26, 2021

  KEV Nov 8, 2022
• Medium 6.1
  CVE-2021-25370 Exploited

  An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory co…

  Samsung Mobile Samsung Mobile Devices
  Mar 26, 2021

  KEV Nov 8, 2022
• High 8.8
  CVE-2022-3723 Exploited

  Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corr…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Nov 1, 2022

  KEV Oct 28, 2022
• High 7.8
  CVE-2022-42827 Exploited

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS …

  Apple iOS and iPadOS iOS
  Nov 1, 2022

  KEV Oct 25, 2022
• High 7.8
  CVE-2020-3433 Exploited · Ransomware Public exploit EPSS 10%

  Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

  A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to ha…

  Cisco Cisco AnyConnect Secure Mobility Client Network devices
  Aug 17, 2020

  KEV Oct 24, 2022
• Medium 6.5
  CVE-2020-3153 Exploited · Ransomware Public exploit EPSS 29%

  Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

  A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the…

  Cisco Cisco AnyConnect Secure Mobility Client Network devices
  Feb 19, 2020

  KEV Oct 24, 2022
• Critical 9.8
  CVE-2018-19323 Exploited · Ransomware Public exploit

  The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…

  Dec 21, 2018

  KEV Oct 24, 2022
• High 7.8
  CVE-2018-19321 Exploited · Ransomware Public exploit

  The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …

  Dec 21, 2018

  KEV Oct 24, 2022
• High 7.8
  CVE-2018-19322 Exploited · Ransomware

  The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …

  Dec 21, 2018

  KEV Oct 24, 2022
• High 7.8
  CVE-2018-19320 Exploited · Ransomware Public exploit

  The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…

  Dec 21, 2018

  KEV Oct 24, 2022
• Critical 9.8
  CVE-2022-41352 Exploited · Ransomware Public exploit Scanner template EPSS 95%

  An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

  Sep 26, 2022

  KEV Oct 20, 2022
• High 8.8
  CVE-2021-3493 Exploited Public exploit EPSS 49%

  The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …

  Ubuntu Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2021

  KEV Oct 20, 2022
• Critical 9.8
  CVE-2022-40684 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

  Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices
  Oct 18, 2022

  KEV Oct 11, 2022
• High 7.8
  CVE-2022-41033 Exploited

  Windows COM+ Event System Service Elevation of Privilege Vulnerability

  Windows COM+ Event System Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Oct 11, 2022

  KEV Oct 11, 2022
• High 8.8
  CVE-2022-36804 Exploited Public exploit Scanner template EPSS 99%

  Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

  Atlassian Bitbucket Server Bitbucket Data Center
  Aug 25, 2022

  KEV Sep 30, 2022
• High 8.8
  CVE-2022-41040 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Exchange Server Elevation of Privilege Vulnerability

  Microsoft Exchange Server Elevation of Privilege Vulnerability

  Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12
  Oct 3, 2022

  KEV Sep 30, 2022
• High 8.0
  CVE-2022-41082 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12
  Oct 3, 2022

  KEV Sep 30, 2022
• Critical 9.8
  CVE-2022-3236 Exploited Scanner template EPSS 99%

  A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…

  Sophos Sophos Firewall Network devices
  Sep 23, 2022

  KEV Sep 23, 2022
• Critical 9.8
  CVE-2022-35405 Exploited Public exploit Scanner template EPSS 100%

  Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…

  Jul 19, 2022

  KEV Sep 22, 2022
• High 8.8
  CVE-2013-6282 Exploited Public exploit EPSS 40%

  The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not…

  linux Debian
  Nov 19, 2013

  KEV Sep 15, 2022
• High 7.8
  CVE-2013-2596 Exploited Public exploit

  Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certai…

  linux-raspi2 linux-azure linux-gcp linux Debian Ubuntu
  Apr 13, 2013

  KEV Sep 15, 2022
• High 8.4
  CVE-2013-2597 Exploited Public exploit

  Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.…

  Aug 31, 2014

  KEV Sep 15, 2022
• High 8.4
  CVE-2013-2094 Exploited Public exploit EPSS 48%

  The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data …

  linux kernel Debian Azure Linux
  May 14, 2013

  KEV Sep 15, 2022
• High 7.2
  CVE-2022-40139 Exploited

  Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One …

  Trend Micro Trend Micro Apex One
  Sep 19, 2022

  KEV Sep 15, 2022
• High 7.8
  CVE-2010-2568 Exploited Public exploit EPSS 90%

  Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 al…

  Jul 22, 2010

  KEV Sep 15, 2022
• High 7.8
  CVE-2022-32917 Exploited

  The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15…

  Apple macOS iOS macOS iOS
  Sep 20, 2022

  KEV Sep 14, 2022
• High 7.8
  CVE-2022-37969 Exploited · Ransomware Public exploit EPSS 28%

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Sep 13, 2022

  KEV Sep 14, 2022
• Medium 5.5
  CVE-2020-9934 Exploited Public exploit

  An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…

  Apple macOS iOS macOS iOS
  Oct 16, 2020

  KEV Sep 8, 2022
• High 7.8
  CVE-2011-1823 Exploited EPSS 41%

  The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK …

  Jun 9, 2011

  KEV Sep 8, 2022
• Medium 5.7
  CVE-2011-4723 Exploited

  The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive info…

  Dec 20, 2011

  KEV Sep 8, 2022