[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2022-29464 | 18 Apr 2022 | CVSS 9.8 | WSO2 Multiple Products Unrestrictive Upload of FileCertain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a… | Exploited |
| CVE-2022-26904 | 15 Apr 2022 | CVSS 7.0 | Microsoft Windows User Profile Service Privilege EscalationWindows User Profile Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-21919 | 11 Jan 2022 | CVSS 7.0 | Microsoft Windows User Profile Service Privilege EscalationWindows User Profile Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-0847 | 10 Mar 2022 | CVSS 7.8 | Linux Kernel Privilege EscalationA flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and… | ExploitedFix |
| CVE-2021-41357 | 13 Oct 2021 | CVSS 7.8 | Microsoft Win32k Privilege EscalationWin32k Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-40450 | 13 Oct 2021 | CVSS 7.8 | Microsoft Win32k Privilege EscalationWin32k Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2019-1003029 | 8 Mar 2019 | CVSS 9.9 | Jenkins Script Security Plugin Sandbox BypassA sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in… | Exploited |
| CVE-2022-22718 | 9 Feb 2022 | CVSS 7.8 | Microsoft Windows Print Spooler Privilege EscalationWindows Print Spooler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2019-3568 | 14 May 2019 | CVSS 9.8 | WhatsApp VOIP Stack Buffer OverflowA buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target… | Exploited |
| CVE-2018-6882 | 27 Mar 2018 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1… | Exploited |
| CVE-2022-22960 | 13 Apr 2022 | CVSS 7.8 | VMware Multiple Products Privilege EscalationVMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in… | ExploitedFix |
| CVE-2022-1364 | 26 Jul 2022 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted… | ExploitedFix |
| CVE-2019-3929 | 30 Apr 2019 | CVSS 9.8 | Crestron Multiple Products Command InjectionThe Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W… | Exploited |
| CVE-2019-16057 | 16 Sep 2019 | CVSS 9.8 | D-Link DNS-320 Remote Code ExecutionThe login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. | Exploited |
| CVE-2018-7841 | 22 May 2019 | CVSS 9.8 | Schneider Electric U.motion Builder SQL InjectionA SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper… | Exploited |
| CVE-2016-4523 | 9 Jun 2016 | CVSS 7.5 | Trihedral VTScada (formerly VTS) Denial-of-ServiceThe WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service… | Exploited |
| CVE-2014-0780 | 25 Apr 2014 | CVSS 9.8 | InduSoft Web Studio NTWebServer Directory TraversalDirectory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative… | ExploitedFix |
| CVE-2010-5330 | 11 Jun 2019 | CVSS 9.8 | Ubiquiti AirOS Command InjectionOn certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not… | ExploitedFix |
| CVE-2007-3010 | 18 Sep 2007 | CVSS 9.8 | Alcatel OmniPCX Enterprise Remote Code ExecutionmasterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute… | Exploited |
| CVE-2022-22954 | 11 Apr 2022 | CVSS 9.8 | VMware Workspace ONE Access and Identity Manager Server-Side Template InjectionVMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious… | Exploited |
| CVE-2022-24521 | 15 Apr 2022 | CVSS 7.8 | Microsoft Windows CLFS Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2018-7602 | 19 Jul 2018 | CVSS 9.8 | Drupal Core Remote Code ExecutionA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple… | ExploitedFix |
| CVE-2018-20753 | 5 Feb 2019 | CVSS 9.8 | Kaseya VSA Remote Code ExecutionKaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell… | Exploited |
| CVE-2015-5123 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5122 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-3113 | 23 Jun 2015 | CVSS 9.8 | Adobe Flash Player Heap-Based Buffer OverflowHeap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-2502 | 19 Aug 2015 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionMicrosoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… | ExploitedFix |
| CVE-2015-0313 | 2 Feb 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-0311 | 23 Jan 2015 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through… | ExploitedFix |
| CVE-2014-9163 | 10 Dec 2014 | CVSS 7.8 | Adobe Flash Player Stack-Based Buffer OverflowStack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425… | Exploited |
| CVE-2022-23176 | 24 Feb 2022 | CVSS 8.8 | WatchGuard Firebox and XTM Privilege EscalationWatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session… | Exploited |
| CVE-2021-42287 | 10 Nov 2021 | CVSS 7.5 | Microsoft Active Directory Domain Services Privilege EscalationActive Directory Domain Services Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-42278 | 10 Nov 2021 | CVSS 7.5 | Microsoft Active Directory Domain Services Privilege EscalationActive Directory Domain Services Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-39793 | 16 Mar 2022 | CVSS 7.8 | Google Pixel Out-of-Bounds WriteIn kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to… | Exploited |
| CVE-2021-27852 | 27 May 2021 | CVSS 9.8 | Checkbox Survey Deserialization of Untrusted DataDeserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary… | Exploited |
| CVE-2021-22600 | 26 Jan 2022 | CVSS 7.0 | Linux Kernel Privilege EscalationA double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or… | ExploitedFix |
| CVE-2020-2509 | 17 Apr 2021 | CVSS 9.8 | QNAP Network-Attached Storage (NAS) Command InjectionA command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute… | Exploited |
| CVE-2017-11317 | 23 Aug 2017 | CVSS 9.8 | Telerik UI for ASP.NET AJAX Unrestricted File UploadTelerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows… | Exploited |
| CVE-2021-3156 | 26 Jan 2021 | CVSS 7.8 | Sudo Heap-Based Buffer OverflowSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via… | ExploitedFix |
| CVE-2021-31166 | 11 May 2021 | CVSS 9.8 | Microsoft HTTP Protocol Stack Remote Code ExecutionHTTP Protocol Stack Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2017-0148 | 17 Mar 2017 | CVSS 8.1 | Microsoft SMBv1 Server Remote Code ExecutionThe SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2… | ExploitedFix |
| CVE-2022-22965 | 1 Apr 2022 | CVSS 9.8 | Spring Framework JDK 9+ Remote Code ExecutionA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit… | ExploitedFix |
| CVE-2022-22675 | 26 May 2022 | CVSS 7.8 | Apple macOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS… | Exploited |
| CVE-2022-22674 | 26 May 2022 | CVSS 5.5 | Apple macOS Out-of-Bounds ReadAn out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is… | Exploited |
| CVE-2021-45382 | 17 Feb 2022 | CVSS 9.8 | D-Link Multiple Routers Remote Code ExecutionA Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L… | Exploited |
| CVE-2022-26871 | 29 Mar 2022 | CVSS 9.8 | Trend Micro Apex Central Arbitrary File UploadAn arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which… | ExploitedFix |
| CVE-2022-1040 | 25 Mar 2022 | CVSS 9.8 | Sophos Firewall Authentication BypassAn authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3… | Exploited |
| CVE-2021-34484 | 12 Aug 2021 | CVSS 7.8 | Microsoft Windows User Profile Service Privilege EscalationWindows User Profile Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-28799 | 13 May 2021 | CVSS 9.8 | QNAP NAS Improper AuthorizationAn improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability… | Exploited |
| CVE-2021-21551 | 4 May 2021 | CVSS 7.8 | Dell dbutil Driver Insufficient Access ControlDell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or… | Exploited |
| CVE-2018-10562 | 4 May 2018 | CVSS 9.8 | Dasan GPON Routers Command InjectionAn issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a… | Exploited |
| CVE-2018-10561 | 4 May 2018 | CVSS 9.8 | Dasan GPON Routers Authentication BypassAn issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device… | Exploited |
| CVE-2022-1096 | 23 Jul 2022 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Exploited |
| CVE-2022-0543 | 18 Feb 2022 | CVSS 10.0 | Debian-specific Redis Server Lua Sandbox EscapeIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which… | ExploitedFix |
| CVE-2021-38646 | 15 Sep 2021 | CVSS 7.8 | Microsoft Office Access Connectivity Engine Remote Code ExecutionMicrosoft Office Access Connectivity Engine Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-34486 | 12 Aug 2021 | CVSS 7.8 | Microsoft Windows Event Tracing Privilege EscalationWindows Event Tracing Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-26085 | 3 Aug 2021 | CVSS 5.3 | Atlassian Confluence Server Pre-Authorization Arbitrary File ReadAffected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read… | Exploited |
| CVE-2021-20028 | 4 Aug 2021 | CVSS 9.8 | SonicWall Secure Remote Access (SRA) SQL InjectionImproper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products… | Exploited |
| CVE-2019-7483 | 19 Dec 2019 | CVSS 7.5 | SonicWall SMA100 Directory TraversalIn SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a… | Exploited |
| CVE-2018-8440 | 13 Sep 2018 | CVSS 7.8 | Microsoft Windows Privilege EscalationAn elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC… | ExploitedFix |
| CVE-2018-8406 | 15 Aug 2018 | CVSS 7.8 | Microsoft DirectX Graphics Kernel Privilege EscalationAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX… | ExploitedFix |
| CVE-2018-8405 | 15 Aug 2018 | CVSS 7.8 | Microsoft DirectX Graphics Kernel Privilege EscalationAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX… | ExploitedFix |
| CVE-2017-0213 | 12 May 2017 | CVSS 7.3 | Microsoft Windows Privilege EscalationWindows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… | ExploitedFix |
| CVE-2017-0059 | 17 Mar 2017 | CVSS 4.3 | Microsoft Internet Explorer Information DisclosureMicrosoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka… | ExploitedFix |
| CVE-2017-0037 | 26 Feb 2017 | CVSS 8.1 | Microsoft Edge and Internet Explorer Type ConfusionMicrosoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the… | ExploitedFix |
| CVE-2016-7201 | 10 Nov 2016 | CVSS 8.8 | Microsoft Edge Memory CorruptionThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory… | ExploitedFix |
| CVE-2016-7200 | 10 Nov 2016 | CVSS 8.8 | Microsoft Edge Memory CorruptionThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory… | ExploitedFix |
| CVE-2016-0189 | 11 May 2016 | CVSS 7.5 | Microsoft Internet Explorer Memory CorruptionThe Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote… | ExploitedFix |
| CVE-2016-0151 | 12 Apr 2016 | CVSS 7.8 | Microsoft Windows CSRSS Security Feature BypassThe Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511… | ExploitedFix |
| CVE-2016-0040 | 10 Feb 2016 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted… | ExploitedFix |
| CVE-2015-2426 | 20 Jul 2015 | CVSS 8.8 | Microsoft Windows Adobe Type Manager Library Remote Code ExecutionBuffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7… | ExploitedFix |
| CVE-2015-2419 | 14 Jul 2015 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionJScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… | ExploitedFix |
| CVE-2015-1770 | 10 Jun 2015 | CVSS 8.8 | Microsoft Office Uninitialized Memory UseMicrosoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office… | ExploitedFix |
| CVE-2013-3660 | 24 May 2013 | CVSS 7.8 | Microsoft Win32k Privilege EscalationThe EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows… | ExploitedFix |
| CVE-2013-2729 | 16 May 2013 | CVSS 9.8 | Adobe Reader and Acrobat Arbitrary Integer OverflowInteger overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code… | ExploitedFix |
| CVE-2013-2551 | 11 Mar 2013 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site… | ExploitedFix |
| CVE-2013-2465 | 18 Jun 2013 | CVSS 9.8 | Oracle Java SE UnspecifiedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0… | ExploitedFix |
| CVE-2013-1690 | 26 Jun 2013 | CVSS 8.8 | Mozilla Firefox and Thunderbird Denial-of-ServiceMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Exploited |
| CVE-2012-5076 | 16 Oct 2012 | CVSS 9.8 | Oracle Java SE Sandbox BypassUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect… | ExploitedFix |
| CVE-2012-2539 | 12 Dec 2012 | CVSS 7.8 | Microsoft Word Remote Code ExecutionMicrosoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow… | ExploitedFix |
| CVE-2012-2034 | 9 Jun 2012 | CVSS 7.5 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux… | Exploited |
| CVE-2012-0518 | 16 Oct 2012 | CVSS 4.7 | Oracle Fusion Middleware UnspecifiedUnspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to… | ExploitedFix |
| CVE-2011-2005 | 12 Oct 2011 | CVSS 7.8 | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validationafd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to… | ExploitedFix |
| CVE-2010-4398 | 6 Dec 2010 | CVSS 7.8 | Microsoft Windows Kernel Stack-Based Buffer OverflowStack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2… | ExploitedFix |
| CVE-2022-26318 | 4 Mar 2022 | CVSS 9.8 | WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionOn WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS… | Exploited |
| CVE-2022-26143 | 10 Mar 2022 | CVSS 9.8 | MiCollab, MiVoice Business Express Access ControlThe TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain… | Exploited |
| CVE-2022-21999 | 9 Feb 2022 | CVSS 7.8 | Microsoft Windows Print Spooler Privilege EscalationWindows Print Spooler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-42237 | 5 Nov 2021 | CVSS 9.8 | Sitecore XP Remote Command ExecutionSitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve… | Exploited |
| CVE-2021-22941 | 23 Sep 2021 | CVSS 9.8 | Citrix ShareFile Improper Access ControlImproper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the… | Exploited |
| CVE-2020-9377 | 9 Jul 2020 | CVSS 8.8 | D-Link DIR-610 Devices Remote Command ExecutionD-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are… | ExploitedFix |
| CVE-2020-9054 | 4 Mar 2020 | CVSS 9.8 | Zyxel Multiple NAS Devices OS Command InjectionMultiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability… | Exploited |
| CVE-2020-7247 | 29 Jan 2020 | CVSS 9.8 | OpenSMTPD Remote Code Executionsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as… | ExploitedFix |
| CVE-2020-5410 | 2 Jun 2020 | CVSS 7.5 | VMware Tanzu Spring Cloud Config Directory TraversalSpring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve… | Exploited |
| CVE-2020-25223 | 25 Sep 2020 | CVSS 9.8 | Sophos SG UTM Remote Code ExecutionA remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 | Exploited |
| CVE-2020-2506 | 3 Feb 2021 | CVSS 9.8 | QNAP Helpdesk Improper Access ControlThe vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow… | Exploited |
| CVE-2020-2021 | 29 Jun 2020 | CVSS 10.0 | Palo Alto Networks PAN-OS Authentication BypassWhen Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled… | Exploited |
| CVE-2020-1956 | 22 May 2020 | CVSS 8.8 | Apache Kylin OS Command InjectionApache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is… | ExploitedFix |
| CVE-2020-1631 | 4 May 2020 | CVSS 9.8 | Juniper Junos OS Path TraversalA vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with… | Exploited |
| CVE-2019-6340 | 21 Feb 2019 | CVSS 8.1 | Drupal Core Remote Code ExecutionSome field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to… | ExploitedFix |
| CVE-2019-2616 | 23 Apr 2019 | CVSS 7.2 | Oracle BI Publisher Unauthorized AccessVulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported… | ExploitedFix |
Page 12 of 18