[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2012-0767 | 16 Feb 2012 | CVSS 6.1 | Adobe Flash Player Cross-Site Scripting (XSS)Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and… | ExploitedFix |
| CVE-2012-0754 | 16 Feb 2012 | CVSS 8.1 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x… | ExploitedFix |
| CVE-2012-0151 | 10 Apr 2012 | CVSS 7.8 | Microsoft Windows Authenticode Signature Verification Remote Code ExecutionThe Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… | ExploitedFix |
| CVE-2011-2462 | 7 Dec 2011 | CVSS 9.8 | Adobe Reader and Acrobat Universal 3D Memory CorruptionUnspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through… | Exploited |
| CVE-2011-0609 | 15 Mar 2011 | CVSS 7.8 | Adobe Flash Player UnspecifiedUnspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android… | Exploited |
| CVE-2010-2883 | 9 Sep 2010 | CVSS 7.3 | Adobe Acrobat and Reader Stack-Based Buffer OverflowStack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote… | Exploited |
| CVE-2010-2572 | 10 Nov 2010 | CVSS 7.8 | Microsoft PowerPoint Buffer OverflowBuffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document… | ExploitedFix |
| CVE-2010-1297 | 8 Jun 2010 | CVSS 7.8 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x… | Exploited |
| CVE-2009-4324 | 15 Dec 2009 | CVSS 7.8 | Adobe Acrobat and Reader Use-After-FreeUse-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on… | Exploited |
| CVE-2009-3953 | 13 Jan 2010 | CVSS 8.8 | Adobe Acrobat and Reader Universal 3D Remote Code ExecutionThe U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote… | ExploitedFix |
| CVE-2009-1862 | 23 Jul 2009 | CVSS 7.8 | Adobe Acrobat and Reader, Flash Player UnspecifiedUnspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87… | Exploited |
| CVE-2009-0563 | 10 Jun 2009 | CVSS 7.8 | Microsoft Office Buffer OverflowStack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File… | ExploitedFix |
| CVE-2009-0557 | 10 Jun 2009 | CVSS 7.8 | Microsoft Office Object Record CorruptionExcel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and… | ExploitedFix |
| CVE-2008-0655 | 7 Feb 2008 | CVSS 8.8 | Adobe Acrobat and Reader UnspecifiedMultiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors. | ExploitedFix |
| CVE-2007-5659 | 12 Feb 2008 | CVSS 7.8 | Adobe Acrobat and Reader Buffer OverflowMultiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long… | Exploited |
| CVE-2006-2492 | 20 May 2006 | CVSS 8.8 | Microsoft Word Malformed Object PointerBuffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows… | ExploitedFix |
| CVE-2022-26134 | 3 Jun 2022 | CVSS 9.8 | Atlassian Confluence Server and Data Center Remote Code ExecutionIn affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to… | ExploitedFix |
| CVE-2019-3010 | 16 Oct 2019 | CVSS 8.8 | Oracle Solaris Privilege EscalationVulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily… | ExploitedFix |
| CVE-2016-7256 | 10 Nov 2016 | CVSS 8.8 | Microsoft Windows Open Type Font Remote Code Executionatmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server… | ExploitedFix |
| CVE-2016-3393 | 14 Oct 2016 | CVSS 7.8 | Microsoft Windows Graphics Device Interface (GDI) Remote Code ExecutionGraphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows… | ExploitedFix |
| CVE-2016-1010 | 12 Mar 2016 | CVSS 8.8 | Adobe Flash Player and AIR Integer OverflowInteger overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on… | ExploitedFix |
| CVE-2016-0984 | 10 Feb 2016 | CVSS 8.8 | Adobe Flash Player and AIR Use-After-FreeUse-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569… | ExploitedFix |
| CVE-2016-0034 | 13 Jan 2016 | CVSS 8.8 | Microsoft Silverlight Runtime Remote Code ExecutionMicrosoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or… | ExploitedFix |
| CVE-2015-8651 | 28 Dec 2015 | CVSS 8.8 | Adobe Flash Player Integer OverflowInteger overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux… | ExploitedFix |
| CVE-2015-6175 | 9 Dec 2015 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationThe kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of… | ExploitedFix |
| CVE-2015-4495 | 8 Aug 2015 | CVSS 8.8 | Mozilla Firefox Security Feature BypassThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | ExploitedFix |
| CVE-2015-2425 | 14 Jul 2015 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionMicrosoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web… | ExploitedFix |
| CVE-2015-2360 | 10 Jun 2015 | CVSS 8.8 | Microsoft Win32k Privilege Escalationwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows… | ExploitedFix |
| CVE-2015-1769 | 15 Aug 2015 | CVSS 6.6 | Microsoft Windows Mount Manager Privilege EscalationMount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and… | ExploitedFix |
| CVE-2015-1671 | 13 May 2015 | CVSS 7.8 | Microsoft Windows Remote Code ExecutionThe Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2… | ExploitedFix |
| CVE-2015-0310 | 23 Jan 2015 | CVSS 7.8 | Adobe Flash Player ASLR BypassAdobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly… | ExploitedFix |
| CVE-2015-0071 | 11 Feb 2015 | CVSS 6.5 | Microsoft Internet Explorer ASLR BypassMicrosoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet… | ExploitedFix |
| CVE-2015-0016 | 13 Jan 2015 | CVSS 7.8 | Microsoft Windows TS WebProxy Directory TraversalDirectory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2… | ExploitedFix |
| CVE-2014-8439 | 25 Nov 2014 | CVSS 8.8 | Adobe Flash Player Dereferenced PointerAdobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before… | Exploited |
| CVE-2014-4148 | 15 Oct 2014 | CVSS 8.8 | Microsoft Windows Remote Code Executionwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1… | ExploitedFix |
| CVE-2014-4123 | 15 Oct 2014 | CVSS 8.8 | Microsoft Internet Explorer Privilege EscalationMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of… | ExploitedFix |
| CVE-2014-4077 | 11 Nov 2014 | CVSS 7.8 | Microsoft IME Japanese Privilege EscalationMicrosoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka… | ExploitedFix |
| CVE-2014-3153 | 7 Jun 2014 | CVSS 7.8 | Linux Kernel Privilege EscalationThe futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which… | ExploitedFix |
| CVE-2014-2817 | 12 Aug 2014 | CVSS 8.8 | Microsoft Internet Explorer Privilege EscalationMicrosoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of… | ExploitedFix |
| CVE-2014-0546 | 12 Aug 2014 | CVSS 9.8 | Adobe Reader and Acrobat Sandbox BypassAdobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and… | ExploitedFix |
| CVE-2013-7331 | 26 Feb 2014 | CVSS 6.5 | Microsoft Internet Explorer Information DisclosureThe Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC… | ExploitedFix |
| CVE-2013-3993 | 7 Jul 2014 | CVSS 6.5 | IBM InfoSphere BigInsights Invalid InputIBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted… | Exploited |
| CVE-2013-3896 | 9 Oct 2013 | CVSS 5.5 | Microsoft Silverlight Information DisclosureMicrosoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers… | ExploitedFix |
| CVE-2013-2423 | 17 Apr 2013 | CVSS 3.7 | Oracle JRE UnspecifiedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote… | ExploitedFix |
| CVE-2013-0431 | 31 Jan 2013 | CVSS 3.7 | Oracle JRE Sandbox BypassUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted… | Exploited |
| CVE-2013-0422 | 10 Jan 2013 | CVSS 9.8 | Oracle JRE Remote Code ExecutionMultiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public… | Exploited |
| CVE-2013-0074 | 13 Mar 2013 | CVSS 7.8 | Microsoft Silverlight Double DereferenceMicrosoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows… | ExploitedFix |
| CVE-2012-1710 | 3 May 2012 | CVSS 9.8 | Oracle Fusion Middleware UnspecifiedUnspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect… | ExploitedFix |
| CVE-2010-1428 | 28 Apr 2010 | CVSS 7.5 | Red Hat JBoss Information DisclosureThe Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3… | Exploited |
| CVE-2010-0840 | 1 Apr 2010 | CVSS 9.8 | Oracle JRE UnspecifiedUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25… | ExploitedFix |
| CVE-2010-0738 | 28 Apr 2010 | CVSS 5.3 | Red Hat JBoss Authentication BypassThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3… | Exploited |
| CVE-2018-8611 | 12 Dec 2018 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of… | ExploitedFix |
| CVE-2018-19953 | 28 Oct 2020 | CVSS 6.1 | QNAP NAS File Station Cross-Site ScriptingIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the… | Exploited |
| CVE-2018-19949 | 28 Oct 2020 | CVSS 9.8 | QNAP NAS File Station Command InjectionIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the… | Exploited |
| CVE-2018-19943 | 28 Oct 2020 | CVSS 5.4 | QNAP NAS File Station Cross-Site ScriptingIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in… | Exploited |
| CVE-2017-8543 | 15 Jun 2017 | CVSS 9.8 | Microsoft Windows Search Remote Code ExecutionMicrosoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8… | ExploitedFix |
| CVE-2017-8291 | 27 Apr 2017 | CVSS 7.8 | Artifex Ghostscript Type ConfusionArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%"… | ExploitedFix |
| CVE-2017-18362 | 5 Feb 2019 | CVSS 9.8 | Kaseya VSA SQL InjectionConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to… | Exploited |
| CVE-2017-0210 | 12 Apr 2017 | CVSS 8.8 | Microsoft Internet Explorer Privilege EscalationAn elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker… | ExploitedFix |
| CVE-2017-0149 | 17 Mar 2017 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionMicrosoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… | ExploitedFix |
| CVE-2017-0147 | 17 Mar 2017 | CVSS 7.5 | Microsoft Windows SMBv1 Information DisclosureThe SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2… | ExploitedFix |
| CVE-2017-0022 | 17 Mar 2017 | CVSS 6.5 | Microsoft XML Core Services Information DisclosureMicrosoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2… | ExploitedFix |
| CVE-2017-0005 | 17 Mar 2017 | CVSS 7.8 | Microsoft Windows Graphics Device Interface (GDI) Privilege EscalationThe Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server… | ExploitedFix |
| CVE-2016-6367 | 18 Aug 2016 | CVSS 7.8 | Cisco Adaptive Security Appliance (ASA) CLI Remote Code ExecutionCisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges… | Exploited |
| CVE-2016-6366 | 18 Aug 2016 | CVSS 8.8 | Cisco Adaptive Security Appliance (ASA) SNMP Buffer OverflowBuffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv… | Exploited |
| CVE-2016-4657 | 25 Aug 2016 | CVSS 8.8 | Apple iOS Webkit Memory CorruptionWebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web… | Exploited |
| CVE-2016-4656 | 25 Aug 2016 | CVSS 7.8 | Apple iOS Memory CorruptionThe kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory… | Exploited |
| CVE-2016-4655 | 25 Aug 2016 | CVSS 5.5 | Apple iOS Information DisclosureThe kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. | Exploited |
| CVE-2016-3351 | 14 Sep 2016 | CVSS 6.5 | Microsoft Internet Explorer and Edge Information DisclosureMicrosoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka… | ExploitedFix |
| CVE-2016-3298 | 14 Oct 2016 | CVSS 6.5 | Microsoft Internet Explorer Messaging API Information DisclosureMicrosoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1… | ExploitedFix |
| CVE-2016-0162 | 12 Apr 2016 | CVSS 4.3 | Microsoft Internet Explorer Information DisclosureMicrosoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet… | ExploitedFix |
| CVE-2022-20821 | 26 May 2022 | CVSS 6.5 | Cisco IOS XR Open PortA vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is… | Exploited |
| CVE-2021-30883 | 24 Aug 2021 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1… | Exploited |
| CVE-2021-1048 | 15 Dec 2021 | CVSS 7.8 | Android Kernel Use-After-FreeIn ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of… | ExploitedFix |
| CVE-2021-0920 | 15 Dec 2021 | CVSS 6.4 | Android Kernel Race ConditionIn unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege… | Exploited |
| CVE-2020-1027 | 15 Apr 2020 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationAn elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of… | ExploitedFix |
| CVE-2020-0638 | 14 Jan 2020 | CVSS 7.8 | Microsoft Update Notification Manager Privilege EscalationAn elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker… | ExploitedFix |
| CVE-2019-8720 | 6 Mar 2023 | CVSS 8.8 | WebKitGTK Memory CorruptionA vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution… | Exploited |
| CVE-2019-7287 | 18 Dec 2019 | CVSS 7.8 | Apple iOS Memory CorruptionA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute… | Exploited |
| CVE-2019-7286 | 18 Dec 2019 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update… | Exploited |
| CVE-2019-5786 | 27 Jun 2019 | CVSS 6.5 | Google Chrome Blink Use-After-FreeObject lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access… | Exploited |
| CVE-2019-18426 | 21 Jan 2020 | CVSS 8.2 | WhatsApp Cross-Site ScriptingA vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site… | Exploited |
| CVE-2019-1385 | 12 Nov 2019 | CVSS 7.8 | Microsoft Windows AppX Deployment Extensions Privilege EscalationAn elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in… | ExploitedFix |
| CVE-2019-13720 | 25 Nov 2019 | CVSS 8.8 | Google Chrome WebAudio Use-After-FreeUse after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2019-11708 | 23 Jul 2019 | CVSS 10.0 | Mozilla Firefox and Thunderbird Sandbox EscapeInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent… | Exploited |
| CVE-2019-11707 | 23 Jul 2019 | CVSS 8.8 | Mozilla Firefox and Thunderbird Type ConfusionA type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We… | Exploited |
| CVE-2019-1130 | 15 Jul 2019 | CVSS 7.8 | Microsoft Windows AppX Deployment Service Privilege EscalationAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation… | ExploitedFix |
| CVE-2019-0880 | 15 Jul 2019 | CVSS 7.8 | Microsoft Windows Privilege EscalationA local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege… | ExploitedFix |
| CVE-2019-0703 | 9 Apr 2019 | CVSS 6.5 | Microsoft Windows SMB Information DisclosureAn information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information… | ExploitedFix |
| CVE-2019-0676 | 5 Mar 2019 | CVSS 6.5 | Microsoft Internet Explorer Information DisclosureAn information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited… | ExploitedFix |
| CVE-2018-8589 | 14 Nov 2018 | CVSS 7.8 | Microsoft Win32k Privilege EscalationAn elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege… | ExploitedFix |
| CVE-2018-5002 | 9 Jul 2018 | CVSS 7.8 | Adobe Flash Player Stack-based Buffer OverflowAdobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary… | ExploitedFix |
| CVE-2022-30525 | 12 May 2022 | CVSS 9.8 | Zyxel Multiple Firewalls OS Command InjectionA OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware… | Exploited |
| CVE-2022-22947 | 3 Mar 2022 | CVSS 10.0 | VMware Spring Cloud Gateway Code InjectionIn spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator… | ExploitedFix |
| CVE-2022-1388 | 5 May 2022 | CVSS 9.8 | F5 BIG-IP Missing AuthenticationOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to… | Exploited |
| CVE-2021-1789 | 2 Apr 2021 | CVSS 8.8 | Apple Multiple Products Type ConfusionA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina… | Exploited |
| CVE-2019-8506 | 18 Dec 2019 | CVSS 8.8 | Apple Multiple Products Type ConfusionA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes… | Exploited |
| CVE-2014-4113 | 15 Oct 2014 | CVSS 7.8 | Microsoft Win32k Privilege Escalationwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1… | ExploitedFix |
| CVE-2014-0322 | 14 Feb 2014 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted… | ExploitedFix |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |
Page 11 of 18