[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2019-16920 | 27 Sep 2019 | CVSS 9.8 | D-Link Multiple Routers Command InjectionUnauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker… | Exploited |
| CVE-2019-15107 | 16 Aug 2019 | CVSS 9.8 | Webmin Command InjectionAn issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. | Exploited |
| CVE-2019-12991 | 16 Jul 2019 | CVSS 8.8 | Citrix SD-WAN and NetScaler Command InjectionCitrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). | Exploited |
| CVE-2019-12989 | 16 Jul 2019 | CVSS 9.8 | Citrix SD-WAN and NetScaler SQL InjectionCitrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. | Exploited |
| CVE-2019-11043 | 28 Oct 2019 | CVSS 9.8 | PHP FastCGI Process Manager (FPM) Buffer OverflowIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM… | ExploitedFix |
| CVE-2019-10068 | 26 Mar 2019 | CVSS 9.8 | Kentico Xperience Deserialization of Untrusted DataAn issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to… | Exploited |
| CVE-2019-1003030 | 8 Mar 2019 | CVSS 9.9 | Jenkins Matrix Project Plugin Remote Code ExecutionA sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml… | Exploited |
| CVE-2019-0903 | 16 May 2019 | CVSS 8.8 | Microsoft GDI Remote Code ExecutionA remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+… | ExploitedFix |
| CVE-2018-8414 | 15 Aug 2018 | CVSS 8.8 | Microsoft Windows Shell Remote Code ExecutionA remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution… | ExploitedFix |
| CVE-2018-8373 | 15 Aug 2018 | CVSS 7.5 | Microsoft Scripting Engine Memory CorruptionA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting… | ExploitedFix |
| CVE-2018-6961 | 11 Jun 2018 | CVSS 8.1 | VMware SD-WAN Edge by VeloCloud Command InjectionVMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component… | Exploited |
| CVE-2018-14839 | 14 May 2019 | CVSS 9.8 | LG N1A1 NAS Remote Command ExecutionLG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with… | Exploited |
| CVE-2018-1273 | 11 Apr 2018 | CVSS 9.8 | VMware Tanzu Spring Data Commons Property BinderSpring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused… | ExploitedFix |
| CVE-2018-11138 | 31 May 2018 | CVSS 9.8 | Quest KACE System Management Appliance Remote Command ExecutionThe '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be… | Exploited |
| CVE-2018-0147 | 8 Mar 2018 | CVSS 9.8 | Cisco Secure Access Control System Java DeserializationA vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated… | Exploited |
| CVE-2018-0125 | 8 Feb 2018 | CVSS 9.8 | Cisco VPN Routers Remote Code ExecutionA vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an… | Exploited |
| CVE-2017-6334 | 6 Mar 2017 | CVSS 8.8 | NETGEAR DGN2200 Devices OS Command Injectiondnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell… | Exploited |
| CVE-2017-6316 | 20 Jul 2017 | CVSS 9.8 | Citrix Multiple Products Remote Code ExecutionCitrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie… | Exploited |
| CVE-2017-3881 | 17 Mar 2017 | CVSS 9.8 | Cisco IOS and IOS XE Remote Code ExecutionA vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated… | Exploited |
| CVE-2017-12617 | 4 Oct 2017 | CVSS 8.1 | Apache Tomcat Remote Code ExecutionWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via… | ExploitedFix |
| CVE-2017-12615 | 19 Sep 2017 | CVSS 8.1 | Apache Tomcat on Windows Remote Code ExecutionWhen running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default… | ExploitedFix |
| CVE-2017-0146 | 17 Mar 2017 | CVSS 8.8 | Microsoft Windows SMB Remote Code ExecutionThe SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2… | ExploitedFix |
| CVE-2016-7892 | 15 Dec 2016 | CVSS 8.8 | Adobe Flash Player Use-After-FreeAdobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class… | ExploitedFix |
| CVE-2016-4171 | 16 Jun 2016 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as… | Exploited |
| CVE-2016-1555 | 21 Apr 2017 | CVSS 9.8 | NETGEAR Multiple WAP Devices Command Injection(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and… | ExploitedFix |
| CVE-2016-11021 | 9 Mar 2020 | CVSS 7.2 | D-Link DCS-930L Devices OS Command InjectionsetSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter. | Exploited |
| CVE-2016-10174 | 30 Jan 2017 | CVSS 9.8 | NETGEAR WNR2000v5 Router Buffer OverflowThe NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This… | Exploited |
| CVE-2016-0752 | 16 Feb 2016 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x… | Exploited |
| CVE-2015-4068 | 29 May 2015 | CVSS 9.1 | Arcserve Unified Data Protection (UDP) Directory TraversalDirectory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of… | Exploited |
| CVE-2015-3035 | 22 Apr 2015 | CVSS 7.5 | TP-Link Multiple Archer Devices Directory TraversalDirectory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with… | Exploited |
| CVE-2015-1427 | 17 Feb 2015 | CVSS 9.8 | Elasticsearch Groovy Scripting Engine Remote Code ExecutionThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism… | ExploitedFix |
| CVE-2015-1187 | 21 Sep 2017 | CVSS 9.8 | D-Link and TRENDnet Multiple Devices Remote Code ExecutionThe ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. | Exploited |
| CVE-2015-0666 | 3 Apr 2015 | CVSS 7.5 | Cisco Prime Data Center Network Manager (DCNM) Directory TraversalDirectory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to… | Exploited |
| CVE-2014-6332 | 11 Nov 2014 | CVSS 8.8 | Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code ExecutionOleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… | ExploitedFix |
| CVE-2014-6324 | 18 Nov 2014 | CVSS 8.8 | Microsoft Kerberos Key Distribution Center (KDC) Privilege EscalationThe Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7… | ExploitedFix |
| CVE-2014-6287 | 7 Oct 2014 | CVSS 9.8 | Rejetto HTTP File Server (HFS) Remote Code ExecutionThe findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to… | Exploited |
| CVE-2014-3120 | 28 Jul 2014 | CVSS 8.1 | Elasticsearch Remote Code ExecutionThe default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions… | Exploited |
| CVE-2014-0130 | 7 May 2014 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18… | Exploited |
| CVE-2013-5223 | 19 Nov 2013 | CVSS 5.4 | D-Link DSL-2760U Gateway Cross-Site ScriptingMultiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web… | Exploited |
| CVE-2013-4810 | 16 Sep 2013 | CVSS 9.8 | HP Multiple Products Remote Code ExecutionHP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote… | Exploited |
| CVE-2013-2251 | 20 Jul 2013 | CVSS 9.8 | Apache Struts Improper Input ValidationApache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2)… | ExploitedFix |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |
| CVE-2010-4345 | 14 Dec 2010 | CVSS 7.8 | Exim Privilege EscalationExim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration… | ExploitedFix |
| CVE-2010-4344 | 14 Dec 2010 | CVSS 9.8 | Exim Heap-Based Buffer OverflowHeap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an… | ExploitedFix |
| CVE-2010-3035 | 30 Aug 2010 | CVSS 7.5 | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-ServiceCisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to… | Exploited |
| CVE-2010-2861 | 11 Aug 2010 | CVSS 9.8 | Adobe ColdFusion Directory TraversalMultiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read… | Exploited |
| CVE-2009-2055 | 19 Aug 2009 | CVSS 5.9 | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-ServiceCisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid… | ExploitedFix |
| CVE-2009-1151 | 26 Mar 2009 | CVSS 9.8 | phpMyAdmin Remote Code ExecutionStatic code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject… | ExploitedFix |
| CVE-2009-0927 | 19 Mar 2009 | CVSS 8.8 | Adobe Reader and Adobe Acrobat Stack-Based Buffer OverflowStack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute… | ExploitedFix |
| CVE-2005-2773 | 2 Sep 2005 | CVSS 9.8 | HP OpenView Network Node Manager Remote Code ExecutionHP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node… | Exploited |
| CVE-2020-5135 | 12 Oct 2020 | CVSS 9.8 | SonicWall SonicOS Buffer OverflowA buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by… | Exploited |
| CVE-2019-1405 | 12 Nov 2019 | CVSS 7.8 | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege EscalationAn elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka… | ExploitedFix |
| CVE-2019-1322 | 10 Oct 2019 | CVSS 7.8 | Microsoft Windows Privilege EscalationAn elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege… | ExploitedFix |
| CVE-2019-1315 | 10 Oct 2019 | CVSS 7.8 | Microsoft Windows Error Reporting Manager Privilege EscalationAn elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting… | ExploitedFix |
| CVE-2019-1253 | 11 Sep 2019 | CVSS 7.8 | Microsoft Windows AppX Deployment Server Privilege EscalationAn elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an… | ExploitedFix |
| CVE-2019-1132 | 15 Jul 2019 | CVSS 7.8 | Microsoft Win32k Privilege EscalationAn elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation… | ExploitedFix |
| CVE-2019-1129 | 15 Jul 2019 | CVSS 7.8 | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege EscalationAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation… | ExploitedFix |
| CVE-2019-1069 | 12 Jun 2019 | CVSS 7.8 | Microsoft Task Scheduler Privilege EscalationAn elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully… | ExploitedFix |
| CVE-2019-1064 | 12 Jun 2019 | CVSS 7.8 | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege EscalationAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who… | ExploitedFix |
| CVE-2019-0841 | 9 Apr 2019 | CVSS 7.8 | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege EscalationAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation… | ExploitedFix |
| CVE-2019-0543 | 8 Jan 2019 | CVSS 7.8 | Microsoft Windows Privilege EscalationAn elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege… | ExploitedFix |
| CVE-2018-8120 | 9 May 2018 | CVSS 7.0 | Microsoft Win32k Privilege EscalationAn elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation… | ExploitedFix |
| CVE-2017-0101 | 17 Mar 2017 | CVSS 7.8 | Microsoft Windows Transaction Manager Privilege EscalationThe kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows… | ExploitedFix |
| CVE-2016-3309 | 9 Aug 2016 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationThe kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and… | ExploitedFix |
| CVE-2015-2546 | 9 Sep 2015 | CVSS 8.2 | Microsoft Win32k Memory CorruptionThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012… | ExploitedFix |
| CVE-2022-26486 | 22 Dec 2022 | CVSS 9.6 | Mozilla Firefox Use-After-FreeAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in… | Exploited |
| CVE-2022-26485 | 22 Dec 2022 | CVSS 8.8 | Mozilla Firefox Use-After-FreeRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing… | Exploited |
| CVE-2021-21973 | 24 Feb 2021 | CVSS 5.3 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF)The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server… | Exploited |
| CVE-2020-8218 | 30 Jul 2020 | CVSS 7.2 | Pulse Connect Secure Code InjectionA code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution… | Exploited |
| CVE-2019-11581 | 9 Aug 2019 | CVSS 9.8 | Atlassian Jira Server and Data Center Server-Side Template InjectionThere was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions… | Exploited |
| CVE-2017-6077 | 22 Feb 2017 | CVSS 9.8 | NETGEAR DGN2200 Remote Code Executionping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell… | Exploited |
| CVE-2016-6277 | 14 Dec 2016 | CVSS 8.8 | NETGEAR Multiple Routers Remote Code ExecutionNETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before… | ExploitedFix |
| CVE-2013-0631 | 9 Jan 2013 | CVSS 7.5 | Adobe ColdFusion Information DisclosureAdobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January… | Exploited |
| CVE-2013-0629 | 9 Jan 2013 | CVSS 7.5 | Adobe ColdFusion Directory TraversalAdobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified… | Exploited |
| CVE-2013-0625 | 9 Jan 2013 | CVSS 9.8 | Adobe ColdFusion Authentication BypassAdobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute… | Exploited |
| CVE-2009-3960 | 15 Feb 2010 | CVSS 6.5 | Adobe BlazeDS Information DisclosureUnspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex… | Exploited |
| CVE-2022-20708 | 10 Feb 2022 | CVSS 8.0 | Cisco Small Business RV Series Routers Stack-based Buffer OverflowMultiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following… | Exploited |
| CVE-2022-20703 | 10 Feb 2022 | CVSS 8.0 | Cisco Small Business RV Series Routers Stack-based Buffer OverflowMultiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following… | Exploited |
| CVE-2022-20701 | 10 Feb 2022 | CVSS 7.8 | Cisco Small Business RV Series Routers Stack-based Buffer OverflowMultiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following… | Exploited |
| CVE-2022-20700 | 10 Feb 2022 | CVSS 9.8 | Cisco Small Business RV Series Routers Stack-based Buffer OverflowMultiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following… | Exploited |
| CVE-2022-20699 | 10 Feb 2022 | CVSS 9.8 | Cisco Small Business RV Series Routers Stack-based Buffer OverflowMultiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following… | Exploited |
| CVE-2021-41379 | 10 Nov 2021 | CVSS 5.5 | Microsoft Windows Installer Privilege EscalationWindows Installer Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2020-1938 | 24 Feb 2020 | CVSS 9.8 | Apache Tomcat Improper Privilege ManagementWhen using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as… | ExploitedFix |
| CVE-2020-11899 | 17 Jun 2020 | CVSS 5.4 | Treck TCP/IP stack Out-of-Bounds ReadThe Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. | Exploited |
| CVE-2019-16928 | 27 Sep 2019 | CVSS 9.8 | Exim Out-of-bounds WriteExim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in… | ExploitedFix |
| CVE-2019-1652 | 24 Jan 2019 | CVSS 7.2 | Cisco Small Business Routers Improper Input ValidationA vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an… | Exploited |
| CVE-2019-1297 | 11 Sep 2019 | CVSS 8.8 | Microsoft Excel Remote Code ExecutionA remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft… | ExploitedFix |
| CVE-2018-8581 | 14 Nov 2018 | CVSS 7.4 | Microsoft Exchange Server Privilege EscalationAn elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."… | ExploitedFix |
| CVE-2018-8298 | 11 Jul 2018 | CVSS 7.5 | ChakraCore Scripting Engine Type ConfusionA remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory… | ExploitedFix |
| CVE-2018-0180 | 28 Mar 2018 | CVSS 5.9 | Cisco IOS Software Denial-of-ServiceMultiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to… | Exploited |
| CVE-2018-0179 | 28 Mar 2018 | CVSS 5.9 | Cisco IOS Software Denial-of-ServiceMultiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to… | Exploited |
| CVE-2018-0175 | 28 Mar 2018 | CVSS 8.0 | Cisco IOS, XR, and XE Software Buffer OverflowFormat String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR… | Exploited |
| CVE-2018-0174 | 28 Mar 2018 | CVSS 8.6 | Cisco IOS Software and Cisco IOS XE Software Improper Input ValidationA vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated… | Exploited |
| CVE-2018-0173 | 28 Mar 2018 | CVSS 8.6 | Cisco IOS and IOS XE Software Improper Input ValidationA vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4… | Exploited |
| CVE-2018-0172 | 28 Mar 2018 | CVSS 8.6 | Cisco IOS and IOS XE Software Improper Input ValidationA vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated… | Exploited |
| CVE-2018-0167 | 28 Mar 2018 | CVSS 8.8 | Cisco IOS, XR, and XE Software Buffer OverflowMultiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and… | Exploited |
| CVE-2018-0161 | 28 Mar 2018 | CVSS 6.3 | Cisco IOS Software Resource Management ErrorsA vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches… | Exploited |
| CVE-2018-0159 | 28 Mar 2018 | CVSS 7.5 | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-ServiceA vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could… | Exploited |
| CVE-2018-0158 | 28 Mar 2018 | CVSS 8.6 | Cisco IOS and XE Software Internet Key Exchange Memory LeakA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated… | Exploited |
| CVE-2018-0156 | 28 Mar 2018 | CVSS 7.5 | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-ServiceA vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to… | Exploited |
Page 13 of 18