Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

1,779 results · Feed

  • High 7.5
    CVE-2014-0160 Exploited Public exploit EPSS 100%

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension pack…

    openssl Debian
    KEV May 4, 2022
  • High 8.8
    CVE-2014-0322 Exploited Public exploit EPSS 85%

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code …

    KEV May 4, 2022
  • High 7.8
    CVE-2014-4113 Exploited Public exploit EPSS 87%

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 …

    KEV May 4, 2022
  • High 8.8
    CVE-2021-1789 Exploited EPSS 14%

    A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …

    Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
    KEV May 4, 2022
  • High 8.8
    CVE-2019-8506 Exploited Public exploit EPSS 16%

    A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…

    Apple watchOS tvOS Safari Windows iOS Browsers Debian Ubuntu Alpine
    KEV May 4, 2022
  • High 7.8
    CVE-2022-0847 Exploited Public exploit EPSS 93%

    A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
    KEV Apr 25, 2022
  • Critical 9.8
    CVE-2022-29464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fil…

    KEV Apr 25, 2022
  • High 7.0
    CVE-2022-21919 Exploited

    Windows User Profile Service Elevation of Privilege Vulnerability

    Windows User Profile Service Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 25, 2022
  • High 7.0
    CVE-2022-26904 Exploited Public exploit EPSS 17%

    Windows User Profile Service Elevation of Privilege Vulnerability

    Windows User Profile Service Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 25, 2022
  • High 7.8
    CVE-2021-40450 Exploited

    Win32k Elevation of Privilege Vulnerability

    Win32k Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 25, 2022
  • High 7.8
    CVE-2021-41357 Exploited

    Win32k Elevation of Privilege Vulnerability

    Win32k Elevation of Privilege Vulnerability

    Microsoft Windows Server 2022 Windows 11 version 21H2 Windows 10 Version 20H2 Windows
    KEV Apr 25, 2022
  • Critical 9.9
    CVE-2019-1003029 Exploited Public exploit EPSS 74%

    Sandbox bypass in Script Security Plugin

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScr…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
    KEV Apr 25, 2022
  • Medium 6.1
    CVE-2018-6882 Exploited · Ransomware Scanner template EPSS 30%

    Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Su…

    KEV Apr 19, 2022
  • High 7.8
    CVE-2022-22718 Exploited Public exploit EPSS 18%

    Windows Print Spooler Elevation of Privilege Vulnerability

    Windows Print Spooler Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 19, 2022
  • Critical 9.8
    CVE-2019-3568 Exploited EPSS 30%

    A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RT…

    Facebook WhatsApp for Android WhatsApp Business for Android WhatsApp for iOS Windows Android iOS
    KEV Apr 19, 2022
  • Critical 9.8
    CVE-2018-7841 Exploited Public exploit Scanner template EPSS 72%

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted cod…

    U.motion U.motion Builder software version 1.3.4
    KEV Apr 15, 2022
  • High 8.8
    CVE-2022-1364 Exploited Public exploit EPSS 14%

    Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Apr 15, 2022
  • High 7.8
    CVE-2022-22960 Exploited Public exploit EPSS 36%

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due …

    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2014-0780 Exploited Public exploit EPSS 75%

    InduSoft Web Studio Path Traversal

    Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

    InduSoft Web Studio
    KEV Apr 15, 2022
  • High 7.5
    CVE-2016-4523 Exploited EPSS 31%

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause …

    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2010-5330 Exploited EPSS 40%

    On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the i…

    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2019-16057 Exploited · Ransomware Scanner template EPSS 86%

    The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2019-3929 Exploited Public exploit Scanner template EPSS 99%

    The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, B…

    Crestron Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.
    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2007-3010 Exploited Public exploit Scanner template EPSS 97%

    masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows re…

    KEV Apr 15, 2022
  • Critical 9.8
    CVE-2022-22954 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templ…

    KEV Apr 14, 2022
  • High 7.8
    CVE-2015-0311 Exploited Public exploit EPSS 86%

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windo…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-0313 Exploited Public exploit EPSS 95%

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-3113 Exploited Public exploit EPSS 100%

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows a…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 8.8
    CVE-2015-2502 Exploited EPSS 51%

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service…

    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5122 Exploited Public exploit EPSS 87%

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Playe…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 7.8
    CVE-2015-5123 Exploited EPSS 19%

    Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 1…

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • High 8.1
    CVE-2018-7602 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

    A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is relat…

    Drupal Core drupal/core drupal/drupal Ubuntu Alpine Packagist
    KEV Apr 13, 2022
  • Critical 9.8
    CVE-2018-20753 Exploited · Ransomware EPSS 30%

    Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers…

    KEV Apr 13, 2022
  • High 7.8
    CVE-2022-24521 Exploited · Ransomware Public exploit

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 13, 2022
  • High 7.8
    CVE-2014-9163 Exploited EPSS 45%

    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and …

    flashplugin-nonfree Ubuntu
    KEV Apr 13, 2022
  • Critical 9.8
    CVE-2020-2509 Exploited Public exploit EPSS 34%

    Command Injection Vulnerability in QTS and QuTS hero

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: …

    QNAP Systems QTS QuTS hero
    KEV Apr 11, 2022
  • High 8.8
    CVE-2022-23176 Exploited EPSS 11%

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a…

    KEV Apr 11, 2022
  • Critical 9.8
    CVE-2017-11317 Exploited Public exploit EPSS 84%

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…

    KEV Apr 11, 2022
  • High 7.8
    CVE-2021-39793 Exploited

    In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the…

    Android
    KEV Apr 11, 2022
  • Critical 9.8
    CVE-2021-27852 Exploited EPSS 30%

    Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote …

    Checkbox Survey
    KEV Apr 11, 2022