Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

1,779 results · Feed

  • Critical 9.8
    CVE-2020-8644 Exploited Public exploit Scanner template EPSS 86%

    PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

    KEV Nov 3, 2021
  • High 7.8
    CVE-2020-8655 Exploited Public exploit EPSS 60%

    An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerabilit…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-8468 Exploited

    Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a c…

    Trend Micro Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS)
    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Azure Linux Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-15505 Exploited Public exploit Scanner template EPSS 100%

    A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2020-9859 Exploited

    A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13…

    Apple macOS watchOS tvOS macOS iOS
    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-9818 Exploited

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13…

    Apple watchOS iOS iOS-1 iOS
    KEV Nov 3, 2021
  • Medium 4.3
    CVE-2020-9819 Exploited

    A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5…

    Apple watchOS iOS iOS-1 iOS
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-25213 Exploited Public exploit Scanner template EPSS 97%

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitr…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-25506 Exploited Scanner template EPSS 100%

    D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-10199 Exploited Public exploit Scanner template EPSS 99%

    Nexus Repository Manager 3 - Remote Code Execution

    Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

    org.sonatype.nexus:nexus-extdirect Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10148 Exploited Public exploit Scanner template EPSS 92%

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …

    SolarWinds Orion Platform
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10189 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …

    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-10221 Exploited Public exploit Scanner template EPSS 77%

    lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10987 Exploited Public exploit Scanner template EPSS 80%

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10181 Exploited EPSS 15%

    goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevat…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-5735 Exploited Public exploit EPSS 36%

    Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5902 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2020-5849 Exploited Public exploit EPSS 93%

    Unraid 6.8.0 allows authentication bypass.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5847 Exploited Public exploit Scanner template EPSS 96%

    Unraid through 6.8.0 allows Remote Code Execution.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14750 Exploited Public exploit Scanner template EPSS 99%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • High 7.2
    CVE-2020-14883 Exploited Public exploit Scanner template EPSS 98%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14882 Exploited Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-14871 Exploited Public exploit EPSS 80%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…

    Oracle Solaris Operating System
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-26919 Exploited Scanner template EPSS 57%

    NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

    KEV Nov 3, 2021
  • High 7.8
    CVE-2015-1641 Exploited Public exploit EPSS 97%

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Com…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2015-4852 Exploited Public exploit EPSS 95%

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…

    openjdk-8 libcommons-collections3-java Ubuntu
    KEV Nov 3, 2021
  • High 8.8
    CVE-2018-0798 Exploited Public exploit EPSS 95%

    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…

    Microsoft Equation Editor
    KEV Nov 3, 2021
  • High 7.8
    CVE-2018-0802 Exploited · Ransomware Public exploit EPSS 93%

    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…

    Microsoft Equation Editor
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-0171 Exploited Public exploit Scanner template EPSS 99%

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…

    iOS
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-0296 Exploited Public exploit Scanner template EPSS 100%

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, rem…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-18325 Exploited Public exploit Scanner template EPSS 74%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-7600 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Drupal Core Remote Code Execution Vulnerability

    Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

    drupal/core drupal/drupal drupal7 drupal7 Web / CMS Ubuntu Alpine Packagist
    KEV Nov 3, 2021
  • High 8.1
    CVE-2018-11776 Exploited Public exploit Scanner template EPSS 100%

    Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-4939 Exploited EPSS 62%

    Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deseri…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2018-13379 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5…

    Fortinet Fortinet FortiOS, FortiProxy Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-6789 Exploited · Ransomware Public exploit EPSS 82%

    An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…

    exim4 exim4 exim Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • Medium 6.6
    CVE-2018-2380 Exploited · Ransomware Public exploit EPSS 29%

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information p…

    SAP SAP CRM
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-8653 Exploited EPSS 30%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 9 Internet Explorer 10
    KEV Nov 3, 2021