CISA Known Exploited Vulnerabilities

1,779 results · Feed

• Medium 4.3
  CVE-2016-0162 Exploited EPSS 22%

  Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaSc…

  Apr 12, 2016

  KEV May 24, 2022
• Medium 5.5
  CVE-2016-4655 Exploited Public exploit EPSS 33%

  The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

  Aug 25, 2016

  KEV May 24, 2022
• High 8.8
  CVE-2016-4657 Exploited Public exploit EPSS 67%

  WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory…

  qtwebkit-source qtwebkit-opensource-src webkitgtk webkit2gtk Ubuntu
  Aug 25, 2016

  KEV May 24, 2022
• High 7.8
  CVE-2016-4656 Exploited Public exploit EPSS 24%

  The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a deni…

  Aug 25, 2016

  KEV May 24, 2022
• High 7.8
  CVE-2016-6367 Exploited Public exploit EPSS 23%

  Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows lo…

  Aug 18, 2016

  KEV May 24, 2022
• High 8.8
  CVE-2016-6366 Exploited Public exploit EPSS 88%

  Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Servic…

  Aug 18, 2016

  KEV May 24, 2022
• Medium 6.5
  CVE-2016-3351 Exploited · Ransomware EPSS 26%

  Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via …

  Sep 14, 2016

  KEV May 24, 2022
• Medium 6.5
  CVE-2016-3298 Exploited EPSS 33%

  Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 a…

  Oct 14, 2016

  KEV May 24, 2022
• High 8.8
  CVE-2017-0210 Exploited EPSS 22%

  An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, …

  Microsoft Internet Explorer
  Apr 12, 2017

  KEV May 24, 2022
• High 7.5
  CVE-2017-0147 Exploited · Ransomware Public exploit EPSS 100%

  The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

  Microsoft Windows SMB Windows
  Mar 17, 2017

  KEV May 24, 2022
• Medium 6.5
  CVE-2017-0022 Exploited EPSS 18%

  Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Win…

  Microsoft XML Core Services
  Mar 17, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2017-0005 Exploited Public exploit EPSS 11%

  The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; …

  Microsoft Windows GDI+ Windows
  Mar 17, 2017

  KEV May 24, 2022
• High 8.8
  CVE-2017-0149 Exploited EPSS 28%

  Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service …

  Microsoft Internet Explorer
  Mar 17, 2017

  KEV May 24, 2022
• Critical 9.8
  CVE-2017-18362 Exploited · Ransomware Scanner template EPSS 87%

  ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that…

  Feb 5, 2019

  KEV May 24, 2022
• Critical 9.8
  CVE-2017-8543 Exploited Public exploit EPSS 74%

  Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 200…

  Microsoft Microsoft Windows Windows
  Jun 15, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2017-8291 Exploited Public exploit EPSS 97%

  Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion…

  ghostscript ghostscript ghostscript Debian Ubuntu Alpine
  Apr 27, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2020-0638 Exploited · Ransomware

  An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Jan 14, 2020

  KEV May 23, 2022
• High 7.8
  CVE-2020-1027 Exploited

  An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windo…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Apr 15, 2020

  KEV May 23, 2022
• High 7.8
  CVE-2018-8589 Exploited

  An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k…

  Microsoft Windows 7 Windows Server 2008 R2 Windows Server 2008 Windows
  Nov 14, 2018

  KEV May 23, 2022
• High 7.8
  CVE-2018-5002 Exploited EPSS 24%

  Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploit…

  flashplugin-nonfree Ubuntu
  Jul 9, 2018

  KEV May 23, 2022
• Medium 6.5
  CVE-2022-20821 Exploited EPSS 11%

  Cisco IOS XR Software Health Check Open Port Vulnerability

  A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379…

  Cisco Cisco IOS XR Software iOS Network devices
  May 26, 2022

  KEV May 23, 2022
• Medium 6.4
  CVE-2021-0920 Exploited

  In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Dec 15, 2021

  KEV May 23, 2022
• High 7.8
  CVE-2021-1048 Exploited

  In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lea…

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Dec 15, 2021

  KEV May 23, 2022
• High 7.8
  CVE-2021-30883 Exploited EPSS 15%

  A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.…

  Apple macOS iOS and iPadOS macOS iOS
  Aug 24, 2021

  KEV May 23, 2022
• Medium 6.5
  CVE-2019-0676 Exploited

  An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker …

  Microsoft Internet Explorer 11 Internet Explorer 10
  Mar 6, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-0880 Exploited

  A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 …

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Jul 15, 2019

  KEV May 23, 2022
• Medium 6.5
  CVE-2019-0703 Exploited

  An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Wi…

  Microsoft Windows Windows Server Windows
  Apr 8, 2019

  KEV May 23, 2022
• High 8.2
  CVE-2019-18426 Exploited Public exploit EPSS 68%

  A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…

  Facebook WhatsApp Desktop
  Jan 21, 2020

  KEV May 23, 2022
• High 7.8
  CVE-2019-7287 Exploited

  A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicati…

  Apple iOS iOS
  Dec 18, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-7286 Exploited Public exploit EPSS 16%

  A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…

  Apple macOS iOS macOS iOS
  Dec 18, 2019

  KEV May 23, 2022
• Critical 10.0
  CVE-2019-11708 Exploited Public exploit EPSS 56%

  Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-11707 Exploited Public exploit EPSS 38%

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-1385 Exploited · Ransomware

  An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privileg…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Nov 12, 2019

  KEV May 23, 2022
• High 7.8
  CVE-2019-1130 Exploited · Ransomware

  An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

  Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
  Jul 29, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-13720 Exploited Public exploit EPSS 49%

  Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Nov 25, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-8720 Exploited

  A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
  Mar 6, 2023

  KEV May 23, 2022
• Medium 6.5
  CVE-2019-5786 Exploited Public exploit EPSS 61%

  Use-After-Free in puppeteer

  Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm
  Jun 27, 2019

  KEV May 23, 2022
• Critical 9.8
  CVE-2022-30525 Exploited Public exploit Scanner template EPSS 100%

  A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…

  Zyxel ATP series firmware VPN series Firmware USG FLEX 50(W) firmware Network devices
  May 12, 2022

  KEV May 16, 2022
• Critical 10.0
  CVE-2022-22947 Exploited Public exploit Scanner template EPSS 98%

  Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

  In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…

  org.springframework.cloud:spring-cloud-gateway Maven
  Mar 3, 2022

  KEV May 16, 2022
• Critical 9.8
  CVE-2022-1388 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

  F5 BIG-IP Network devices
  May 5, 2022

  KEV May 10, 2022