Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

1,779 results · Feed

  • High 7.8
    CVE-2019-0841 Exploited · Ransomware Public exploit EPSS 41%

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

    Microsoft Windows Windows Server Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-0543 Exploited · Ransomware Public exploit

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …

    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1253 Exploited · Ransomware Public exploit EPSS 12%

    An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1064 Exploited · Ransomware Public exploit

    Windows Elevation of Privilege Vulnerability

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1069 Exploited · Ransomware Public exploit

    Task Scheduler Elevation of Privilege Vulnerability

    An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1132 Exploited Public exploit

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Windows Server Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1129 Exploited · Ransomware

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1405 Exploited · Ransomware Public exploit EPSS 30%

    An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1322 Exploited · Ransomware Public exploit EPSS 19%

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Mar 15, 2022
  • High 7.8
    CVE-2019-1315 Exploited · Ransomware Public exploit

    An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Mar 15, 2022
  • High 7.2
    CVE-2020-8218 Exploited Public exploit EPSS 32%

    A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perfor…

    KEV Mar 7, 2022
  • Critical 9.8
    CVE-2013-0625 Exploited Public exploit EPSS 94%

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentica…

    KEV Mar 7, 2022
  • High 7.5
    CVE-2013-0629 Exploited Public exploit EPSS 66%

    Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted di…

    KEV Mar 7, 2022
  • High 7.5
    CVE-2013-0631 Exploited EPSS 66%

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exp…

    KEV Mar 7, 2022
  • High 8.8
    CVE-2022-26485 Exploited Public exploit EPSS 14%

    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

    Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
    KEV Mar 7, 2022
  • Critical 9.6
    CVE-2022-26486 Exploited

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…

    Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
    KEV Mar 7, 2022
  • High 8.8
    CVE-2016-6277 Exploited Public exploit Scanner template EPSS 100%

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.…

    KEV Mar 7, 2022
  • Medium 6.5
    CVE-2009-3960 Exploited · Ransomware Public exploit EPSS 90%

    Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Servic…

    KEV Mar 7, 2022
  • Critical 9.8
    CVE-2017-6077 Exploited Public exploit EPSS 69%

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitr…

    KEV Mar 7, 2022
  • Medium 5.3
    CVE-2021-21973 Exploited Public exploit Scanner template EPSS 88%

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…

    Virtualization
    KEV Mar 7, 2022
  • Critical 9.8
    CVE-2019-11581 Exploited Public exploit Scanner template EPSS 85%

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

    Atlassian Jira Server and Data Center Web / CMS
    KEV Mar 7, 2022
  • Medium 5.4
    CVE-2020-11899 Exploited EPSS 18%

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Tomcat

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

    Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-7645 Exploited · Ransomware Public exploit EPSS 65%

    Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.53…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-1701 Exploited · Ransomware Public exploit EPSS 56%

    Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local…

    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-1642 Exploited EPSS 53%

    Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted docum…

    KEV Mar 3, 2022
  • Medium 5.3
    CVE-2015-4902 Exploited EPSS 14%

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unkno…

    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-3043 Exploited Public exploit EPSS 74%

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.45…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-2545 Exploited EPSS 86%

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a …

    KEV Mar 3, 2022
  • High 8.8
    CVE-2015-2424 Exploited EPSS 40%

    Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, a…

    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-2387 Exploited EPSS 35%

    ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server…

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2015-2590 Exploited EPSS 25%

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

    openjdk-7 openjdk-6 Ubuntu
    KEV Mar 3, 2022
  • High 7.8
    CVE-2015-5119 Exploited Public exploit EPSS 99%

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2011-0611 Exploited Public exploit EPSS 99%

    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; …

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2011-1889 Exploited EPSS 49%

    The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remo…

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2011-3544 Exploited Public exploit EPSS 97%

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and…

    KEV Mar 3, 2022
  • High 7.5
    CVE-2018-0156 Exploited

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…

    iOS
    KEV Mar 3, 2022
  • High 8.6
    CVE-2018-0158 Exploited

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software c…

    iOS
    KEV Mar 3, 2022
  • High 7.5
    CVE-2018-0154 Exploited

    A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Softwa…

    iOS
    KEV Mar 3, 2022
  • High 8.0
    CVE-2018-0175 Exploited

    Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE S…

    iOS
    KEV Mar 3, 2022