[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2022-41128 | 9 Nov 2022 | CVSS 8.8 | Microsoft Windows Scripting Languages Remote Code ExecutionWindows Scripting Languages Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2022-41125 | 9 Nov 2022 | CVSS 7.8 | Microsoft Windows CNG Key Isolation Service Privilege EscalationWindows CNG Key Isolation Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41091 | 9 Nov 2022 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2022-41073 | 9 Nov 2022 | CVSS 7.8 | Microsoft Windows Print Spooler Privilege EscalationWindows Print Spooler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-25370 | 26 Mar 2021 | CVSS 4.4 | Samsung Mobile Devices Memory CorruptionAn incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel… | Exploited |
| CVE-2021-25369 | 26 Mar 2021 | CVSS 5.5 | Samsung Mobile Devices Improper Access ControlAn improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. | Exploited |
| CVE-2021-25337 | 4 Mar 2021 | CVSS 7.1 | Samsung Mobile Devices Improper Access ControlImproper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write… | Exploited |
| CVE-2022-3723 | 1 Nov 2022 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2022-42827 | 1 Nov 2022 | CVSS 7.8 | Apple iOS and iPadOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS… | Exploited |
| CVE-2020-3433 | 17 Aug 2020 | CVSS 7.8 | Cisco AnyConnect Secure Mobility Client for Windows DLL HijackingA vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… | Exploited |
| CVE-2020-3153 | 19 Feb 2020 | CVSS 6.5 | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search PathA vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy… | Exploited |
| CVE-2018-19323 | 21 Dec 2018 | CVSS 9.8 | GIGABYTE Multiple Products Privilege EscalationThe GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC… | Exploited |
| CVE-2018-19322 | 21 Dec 2018 | CVSS 7.8 | GIGABYTE Multiple Products Code ExecutionThe GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before… | Exploited |
| CVE-2018-19321 | 21 Dec 2018 | CVSS 7.8 | GIGABYTE Multiple Products Privilege EscalationThe GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before… | Exploited |
| CVE-2018-19320 | 21 Dec 2018 | CVSS 7.8 | GIGABYTE Multiple Products UnspecifiedThe GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC… | Exploited |
| CVE-2022-41352 | 26 Sep 2022 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole… | ExploitedFix |
| CVE-2021-3493 | 17 Apr 2021 | CVSS 7.8 | Linux Kernel Privilege EscalationThe overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files… | ExploitedFix |
| CVE-2022-41033 | 11 Oct 2022 | CVSS 7.8 | Microsoft Windows COM+ Event System Service Privilege EscalationWindows COM+ Event System Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-40684 | 18 Oct 2022 | CVSS 9.8 | Fortinet Multiple Products Authentication BypassAn authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6… | Exploited |
| CVE-2022-41082 | 3 Oct 2022 | CVSS 8.0 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2022-41040 | 3 Oct 2022 | CVSS 8.8 | Microsoft Exchange Server Server-Side Request ForgeryMicrosoft Exchange Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-36804 | 25 Aug 2022 | CVSS 8.8 | Atlassian Bitbucket Server and Data Center Command InjectionMultiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from… | ExploitedFix |
| CVE-2022-3236 | 23 Sep 2022 | CVSS 9.8 | Sophos Firewall Code InjectionA code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and… | Exploited |
| CVE-2022-35405 | 19 Jul 2022 | CVSS 9.8 | Zoho ManageEngine Multiple Products Remote Code ExecutionZoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also… | ExploitedFix |
| CVE-2022-40139 | 19 Sep 2022 | CVSS 7.2 | Trend Micro Apex One and Apex One as a Service Improper ValidationImproper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could… | ExploitedFix |
| CVE-2013-6282 | 20 Nov 2013 | CVSS 8.8 | Linux Kernel Improper Input ValidationThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses… | ExploitedFix |
| CVE-2013-2597 | 31 Aug 2014 | CVSS 8.4 | Code Aurora ACDB Audio Driver Stack-based Buffer OverflowStack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in… | Exploited |
| CVE-2013-2596 | 13 Apr 2013 | CVSS 7.8 | Linux Kernel Integer OverflowInteger overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android… | ExploitedFix |
| CVE-2013-2094 | 14 May 2013 | CVSS 8.4 | Linux Kernel Privilege EscalationThe perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users… | ExploitedFix |
| CVE-2010-2568 | 22 Jul 2010 | CVSS 7.8 | Microsoft Windows Remote Code ExecutionWindows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote… | ExploitedFix |
| CVE-2022-37969 | 13 Sep 2022 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-32917 | 20 Sep 2022 | CVSS 7.8 | Apple iOS, iPadOS, and macOS Remote Code ExecutionThe issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur… | Exploited |
| CVE-2022-3075 | 26 Sep 2022 | CVSS 9.6 | Google Chromium Mojo Insufficient Data ValidationInsufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to… | Exploited |
| CVE-2022-27593 | 8 Sep 2022 | CVSS 9.1 | QNAP Photo Station Externally Controlled ReferenceAn externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could… | Exploited |
| CVE-2022-26258 | 28 Mar 2022 | CVSS 9.8 | D-Link DIR-820L Remote Code ExecutionD-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. | Exploited |
| CVE-2020-9934 | 16 Oct 2020 | CVSS 5.5 | Apple iOS, iPadOS, and macOS Input ValidationAn issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and… | Exploited |
| CVE-2018-7445 | 19 Mar 2018 | CVSS 9.8 | MikroTik RouterOS Stack-Based Buffer OverflowA buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to… | Exploited |
| CVE-2018-6530 | 6 Mar 2018 | CVSS 9.8 | D-Link Multiple Routers OS Command InjectionOS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous… | Exploited |
| CVE-2018-2628 | 19 Apr 2018 | CVSS 9.8 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are… | ExploitedFix |
| CVE-2018-13374 | 22 Jan 2019 | CVSS 4.3 | Fortinet FortiOS and FortiADC Improper Access ControlA Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the… | Exploited |
| CVE-2017-5521 | 17 Jan 2017 | CVSS 8.1 | NETGEAR Multiple Devices Exposure of Sensitive InformationAn issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000… | Exploited |
| CVE-2011-4723 | 20 Dec 2011 | CVSS 5.7 | D-Link DIR-300 Router Cleartext Storage of a PasswordThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified… | Exploited |
| CVE-2011-1823 | 9 Jun 2011 | CVSS 7.8 | Android OS Privilege EscalationThe vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local… | Exploited |
| CVE-2022-26352 | 17 Jul 2022 | CVSS 9.8 | dotCMS Unrestricted Upload of FileAn issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose… | Exploited |
| CVE-2022-24706 | 26 Apr 2022 | CVSS 9.8 | Apache CouchDB Insecure Default Initialization of ResourceIn Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges… | ExploitedFix |
| CVE-2022-24112 | 11 Feb 2022 | CVSS 9.8 | Apache APISIX Authentication BypassAn attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX… | Exploited |
| CVE-2022-22963 | 1 Apr 2022 | CVSS 9.8 | VMware Tanzu Spring Cloud Function Remote Code ExecutionIn Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide… | ExploitedFix |
| CVE-2022-2294 | 28 Jul 2022 | CVSS 8.8 | WebRTC Heap Buffer OverflowHeap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2021-39226 | 5 Oct 2021 | CVSS 7.3 | Grafana Authentication BypassGrafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot… | ExploitedFix |
| CVE-2021-38406 | 17 Sep 2021 | CVSS 7.8 | Delta Electronics DOPSoft 2 Improper Input ValidationDelta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could… | Exploited |
| CVE-2021-31010 | 24 Aug 2021 | CVSS 7.5 | Apple iOS, macOS, watchOS Sandbox BypassA deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and… | Exploited |
| CVE-2020-36193 | 18 Jan 2021 | CVSS 7.5 | PEAR Archive_Tar Improper Link ResolutionTar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue… | ExploitedFix |
| CVE-2020-28949 | 19 Nov 2020 | CVSS 7.8 | PEAR Archive_Tar Deserialization of Untrusted DataArchive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to… | Exploited |
| CVE-2022-0028 | 10 Aug 2022 | CVSS 8.6 | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-ServiceA PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS)… | Exploited |
| CVE-2022-32894 | 24 Aug 2022 | CVSS 7.8 | Apple iOS and macOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1… | Exploited |
| CVE-2022-32893 | 24 Aug 2022 | CVSS 8.8 | Apple iOS and macOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1… | Exploited |
| CVE-2022-2856 | 26 Sep 2022 | CVSS 6.5 | Google Chromium Intents Insufficient Input ValidationInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily… | ExploitedFix |
| CVE-2022-26923 | 10 May 2022 | CVSS 8.8 | Microsoft Active Directory Domain Services Privilege EscalationActive Directory Domain Services Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-22536 | 9 Feb 2022 | CVSS 10.0 | SAP Multiple Products HTTP Request SmugglingSAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are… | Exploited |
| CVE-2022-21971 | 9 Feb 2022 | CVSS 7.8 | Microsoft Windows Runtime Remote Code ExecutionWindows Runtime Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2017-15944 | 11 Dec 2017 | CVSS 9.8 | Palo Alto Networks PAN-OS Remote Code ExecutionPalo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute… | Exploited |
| CVE-2022-37042 | 12 Aug 2022 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Authentication BypassZimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing… | ExploitedFix |
| CVE-2022-27925 | 21 Apr 2022 | CVSS 7.2 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated… | Exploited |
| CVE-2022-34713 | 9 Aug 2022 | CVSS 7.8 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code ExecutionMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2022-30333 | 9 May 2022 | CVSS 7.5 | RARLAB UnRAR Directory TraversalRARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by… | ExploitedFix |
| CVE-2022-27924 | 21 Apr 2022 | CVSS 7.5 | Synacor Zimbra Collaboration Suite (ZCS) Command InjectionZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance… | Exploited |
| CVE-2022-26138 | 20 Jul 2022 | CVSS 9.8 | Atlassian Questions For Confluence App Hard-coded CredentialsThe Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with… | ExploitedFix |
| CVE-2022-22047 | 12 Jul 2022 | CVSS 7.8 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege EscalationWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-26925 | 10 May 2022 | CVSS 5.9 | Microsoft Windows LSA SpoofingWindows LSA Spoofing Vulnerability | ExploitedFix |
| CVE-2022-29499 | 26 Apr 2022 | CVSS 9.8 | Mitel MiVoice Connect Data ValidationThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The… | Exploited |
| CVE-2021-4034 | 28 Jan 2022 | CVSS 7.8 | Red Hat Polkit Out-of-Bounds Read and WriteA local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow… | ExploitedFix |
| CVE-2021-30983 | 24 Aug 2021 | CVSS 7.8 | Apple iOS and iPadOS Buffer OverflowA buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to… | Exploited |
| CVE-2021-30533 | 7 Jun 2021 | CVSS 6.5 | Google Chromium PopupBlocker Security BypassInsufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions… | ExploitedFix |
| CVE-2020-9907 | 16 Oct 2020 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application… | Exploited |
| CVE-2020-3837 | 27 Feb 2020 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3… | Exploited |
| CVE-2019-8605 | 18 Dec 2019 | CVSS 7.8 | Apple Multiple Products Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS… | Exploited |
| CVE-2018-4344 | 3 Apr 2019 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12… | Exploited |
| CVE-2022-30190 | 1 Jun 2022 | CVSS 7.8 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code ExecutionA remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who… | ExploitedFix |
| CVE-2021-38163 | 14 Sep 2021 | CVSS 8.8 | SAP NetWeaver Unrestricted File UploadSAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user… | Exploited |
| CVE-2016-2388 | 16 Feb 2016 | CVSS 5.3 | SAP NetWeaver Information DisclosureThe Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP… | Exploited |
| CVE-2016-2386 | 16 Feb 2016 | CVSS 9.8 | SAP NetWeaver SQL InjectionSQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via… | Exploited |
| CVE-2019-7195 | 5 Dec 2019 | CVSS 9.8 | QNAP Photo Station Path TraversalThis external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP… | Exploited |
| CVE-2019-7194 | 5 Dec 2019 | CVSS 9.8 | QNAP Photo Station Path TraversalThis external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP… | Exploited |
| CVE-2019-7193 | 5 Dec 2019 | CVSS 9.8 | QNAP QTS Improper Input ValidationThis improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend… | Exploited |
| CVE-2019-7192 | 5 Dec 2019 | CVSS 9.8 | QNAP Photo Station Improper Access ControlThis improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP… | Exploited |
| CVE-2019-5825 | 25 Nov 2019 | CVSS 6.5 | Google Chromium V8 Out-of-Bounds WriteOut of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a… | ExploitedFix |
| CVE-2019-15271 | 26 Nov 2019 | CVSS 8.8 | Cisco RV Series Routers Deserialization of Untrusted DataA vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker… | Exploited |
| CVE-2018-6065 | 14 Nov 2018 | CVSS 8.8 | Google Chromium V8 Integer OverflowInteger overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146… | Exploited |
| CVE-2018-4990 | 9 Jul 2018 | CVSS 8.8 | Adobe Acrobat and Reader Double FreeAdobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free… | Exploited |
| CVE-2018-17480 | 11 Dec 2018 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds WriteExecution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80… | Exploited |
| CVE-2018-17463 | 14 Nov 2018 | CVSS 8.8 | Google Chromium V8 Remote Code ExecutionIncorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox… | Exploited |
| CVE-2017-6862 | 26 May 2017 | CVSS 9.8 | NETGEAR Multiple Devices Buffer OverflowNETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and… | Exploited |
| CVE-2017-5070 | 27 Oct 2017 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to… | Exploited |
| CVE-2017-5030 | 24 Apr 2017 | CVSS 8.8 | Google Chromium V8 Memory CorruptionIncorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed… | Exploited |
| CVE-2016-5198 | 19 Jan 2017 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds MemoryV8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect… | Exploited |
| CVE-2016-1646 | 29 Mar 2016 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds ReadThe Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider… | ExploitedFix |
| CVE-2013-1331 | 12 Jun 2013 | CVSS 7.8 | Microsoft Office Buffer OverflowBuffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an… | ExploitedFix |
| CVE-2012-5054 | 24 Sep 2012 | CVSS 8.8 | Adobe Flash Player Integer OverflowInteger overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute… | Exploited |
| CVE-2012-4969 | 18 Sep 2012 | CVSS 8.1 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to… | ExploitedFix |
| CVE-2012-1889 | 13 Jun 2012 | CVSS 8.8 | Microsoft XML Core Services Memory CorruptionMicrosoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code… | ExploitedFix |
Page 10 of 18