[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2021-31207 | 11 May 2021 | CVSS 6.6 | Microsoft Exchange Server Security Feature BypassMicrosoft Exchange Server Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2021-31201 | 8 Jun 2021 | CVSS 5.2 | Microsoft Enhanced Cryptographic Provider Privilege EscalationMicrosoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-31199 | 8 Jun 2021 | CVSS 5.2 | Microsoft Enhanced Cryptographic Provider Privilege EscalationMicrosoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-30869 | 24 Aug 2021 | CVSS 7.8 | Apple iOS, iPadOS, and macOS Type ConfusionA type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2… | Exploited |
| CVE-2021-30860 | 24 Aug 2021 | CVSS 7.8 | Apple Multiple Products Integer OverflowAn integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8… | Exploited |
| CVE-2021-30858 | 24 Aug 2021 | CVSS 8.8 | Apple iOS, iPadOS, macOS Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing… | Exploited |
| CVE-2021-30807 | 19 Oct 2021 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1… | Exploited |
| CVE-2021-30762 | 8 Sep 2021 | CVSS 8.8 | Apple iOS WebKit Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content… | Exploited |
| CVE-2021-30761 | 8 Sep 2021 | CVSS 8.8 | Apple iOS WebKit Memory CorruptionA memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content… | Exploited |
| CVE-2021-30713 | 8 Sep 2021 | CVSS 7.8 | Apple macOS UnspecifiedA permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass… | Exploited |
| CVE-2021-30666 | 8 Sep 2021 | CVSS 8.8 | Apple iOS WebKit Buffer OverflowA buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content… | Exploited |
| CVE-2021-30665 | 8 Sep 2021 | CVSS 8.8 | Apple Multiple Products WebKit Memory CorruptionA memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS… | Exploited |
| CVE-2021-30663 | 8 Sep 2021 | CVSS 8.8 | Apple Multiple Products WebKit Integer OverflowAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari… | Exploited |
| CVE-2021-30661 | 8 Sep 2021 | CVSS 8.8 | Apple Multiple Products WebKit Storage Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5… | Exploited |
| CVE-2021-30657 | 8 Sep 2021 | CVSS 5.5 | Apple macOS UnspecifiedA logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious… | Exploited |
| CVE-2021-30633 | 8 Oct 2021 | CVSS 9.6 | Google Chromium Indexed DB API Use-After-FreeUse after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to… | Exploited |
| CVE-2021-30632 | 8 Oct 2021 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds WriteOut of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2021-30563 | 3 Aug 2021 | CVSS 8.8 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Exploited |
| CVE-2021-30554 | 2 Jul 2021 | CVSS 8.8 | Google Chromium WebGL Use-After-FreeUse after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2021-30551 | 15 Jun 2021 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Exploited |
| CVE-2021-30116 | 9 Jul 2021 | CVSS 9.8 | Kaseya Virtual System/Server Administrator (VSA) Information DisclosureKaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page… | Exploited |
| CVE-2021-28664 | 10 May 2021 | CVSS 8.8 | Arm Mali Graphics Processing Unit (GPU) UnspecifiedThe Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve… | Exploited |
| CVE-2021-28663 | 10 May 2021 | CVSS 8.8 | Arm Mali Graphics Processing Unit (GPU) Use-After-FreeThe Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a… | Exploited |
| CVE-2021-28550 | 2 Sep 2021 | CVSS 8.8 | Adobe Acrobat and Reader Use-After-FreeAcrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use… | Exploited |
| CVE-2021-28310 | 13 Apr 2021 | CVSS 7.8 | Microsoft Win32k Privilege EscalationWin32k Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-27562 | 25 May 2021 | CVSS 5.5 | Arm Trusted Firmware Out-of-Bounds WriteIn Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when… | Exploited |
| CVE-2021-27561 | 15 Oct 2021 | CVSS 9.8 | Yealink Device Management Server-Side Request Forgery (SSRF)Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. | Exploited |
| CVE-2021-27104 | 16 Feb 2021 | CVSS 9.8 | Accellion FTA OS Command InjectionAccellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is… | Exploited |
| CVE-2021-27103 | 16 Feb 2021 | CVSS 9.8 | Accellion FTA Server-Side Request Forgery (SSRF)Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. | Exploited |
| CVE-2021-27102 | 16 Feb 2021 | CVSS 7.8 | Accellion FTA OS Command InjectionAccellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. | Exploited |
| CVE-2021-27101 | 16 Feb 2021 | CVSS 9.8 | Accellion FTA SQL InjectionAccellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is… | Exploited |
| CVE-2021-27085 | 11 Mar 2021 | CVSS 8.8 | Microsoft Internet Explorer Remote Code ExecutionInternet Explorer Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-27065 | 3 Mar 2021 | CVSS 7.8 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-27059 | 11 Mar 2021 | CVSS 7.6 | Microsoft Office Remote Code ExecutionMicrosoft Office Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-26858 | 3 Mar 2021 | CVSS 7.8 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-26857 | 3 Mar 2021 | CVSS 7.8 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-26855 | 3 Mar 2021 | CVSS 9.1 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-26411 | 11 Mar 2021 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionInternet Explorer Memory Corruption Vulnerability | ExploitedFix |
| CVE-2021-26084 | 30 Aug 2021 | CVSS 9.8 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) InjectionIn affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to… | ExploitedFix |
| CVE-2021-23874 | 10 Feb 2021 | CVSS 7.8 | McAfee Total Protection (MTP) Improper Privilege ManagementArbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and… | Exploited |
| CVE-2021-22986 | 31 Mar 2021 | CVSS 9.8 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code ExecutionOn BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd… | Exploited |
| CVE-2021-22900 | 27 May 2021 | CVSS 7.2 | Ivanti Pulse Connect Secure Unrestricted File UploadA vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to… | Exploited |
| CVE-2021-22899 | 27 May 2021 | CVSS 8.8 | Ivanti Pulse Connect Secure Command InjectionA command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code… | Exploited |
| CVE-2021-22894 | 27 May 2021 | CVSS 8.8 | Ivanti Pulse Connect Secure Collaboration Suite Buffer OverflowA buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as… | Exploited |
| CVE-2021-22893 | 23 Apr 2021 | CVSS 10.0 | Ivanti Pulse Connect Secure Use-After-FreePulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and… | Exploited |
| CVE-2021-22506 | 26 Mar 2021 | CVSS 7.5 | Micro Focus Access Manager Information LeakageAdvance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0… | Exploited |
| CVE-2021-22502 | 8 Feb 2021 | CVSS 9.8 | Micro Focus Operation Bridge Report (OBR) Remote Code ExecutionRemote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be… | Exploited |
| CVE-2021-22205 | 23 Apr 2021 | CVSS 10.0 | GitLab Community and Enterprise Editions Remote Code ExecutionAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were… | Exploited |
| CVE-2021-22005 | 23 Sep 2021 | CVSS 9.8 | VMware vCenter Server File UploadThe vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on… | ExploitedFix |
| CVE-2021-21985 | 26 May 2021 | CVSS 9.8 | VMware vCenter Server Improper Input ValidationThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in… | Exploited |
| CVE-2021-21972 | 24 Feb 2021 | CVSS 9.8 | VMware vCenter Server Remote Code ExecutionThe vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port… | Exploited |
| CVE-2021-21224 | 26 Apr 2021 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… | Exploited |
| CVE-2021-21220 | 26 Apr 2021 | CVSS 8.8 | Google Chromium V8 Improper Input ValidationInsufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap… | Exploited |
| CVE-2021-21206 | 26 Apr 2021 | CVSS 8.8 | Google Chromium Blink Use-After-FreeUse after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2021-21193 | 16 Mar 2021 | CVSS 8.8 | Google Chromium Blink Use-After-FreeUse after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2021-21166 | 9 Mar 2021 | CVSS 8.8 | Google Chromium Race ConditionData race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Exploited |
| CVE-2021-21148 | 9 Feb 2021 | CVSS 8.8 | Google Chromium V8 Heap Buffer OverflowHeap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted… | Exploited |
| CVE-2021-21017 | 11 Feb 2021 | CVSS 8.8 | Adobe Acrobat and Reader Heap-based Buffer OverflowAcrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a… | Exploited |
| CVE-2021-20090 | 29 Apr 2021 | CVSS 9.8 | Arcadyan Buffalo Firmware Path TraversalA path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24… | Exploited |
| CVE-2021-20023 | 20 Apr 2021 | CVSS 4.9 | SonicWall Email Security Path TraversalSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote… | Exploited |
| CVE-2021-20022 | 9 Apr 2021 | CVSS 7.2 | SonicWall Email Security Unrestricted Upload of FileSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the… | Exploited |
| CVE-2021-20021 | 9 Apr 2021 | CVSS 9.8 | SonicWall Email Security Improper Privilege ManagementA vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP… | Exploited |
| CVE-2021-20016 | 4 Feb 2021 | CVSS 9.8 | SonicWall SSLVPN SMA100 SQL InjectionA SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username… | Exploited |
| CVE-2021-1906 | 7 May 2021 | CVSS 5.5 | Qualcomm Multiple Chipsets Detection of Error Condition Without ActionImproper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute… | ExploitedFix |
| CVE-2021-1905 | 7 May 2021 | CVSS 7.8 | Qualcomm Multiple Chipsets Use-After-FreePossible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute… | ExploitedFix |
| CVE-2021-1879 | 2 Apr 2021 | CVSS 6.1 | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS)This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3… | Exploited |
| CVE-2021-1871 | 2 Apr 2021 | CVSS 9.8 | Apple iOS, iPadOS, and macOS WebKit Remote Code ExecutionA logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update… | Exploited |
| CVE-2021-1870 | 2 Apr 2021 | CVSS 9.8 | Apple iOS, iPadOS, and macOS WebKit Remote Code ExecutionA logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update… | Exploited |
| CVE-2021-1782 | 2 Apr 2021 | CVSS 7.0 | Apple Multiple Products Race ConditionA race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update… | Exploited |
| CVE-2021-1732 | 25 Feb 2021 | CVSS 7.8 | Microsoft Win32k Privilege EscalationWindows Win32k Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-1675 | 8 Jun 2021 | CVSS 7.8 | Microsoft Windows Print Spooler Remote Code ExecutionWindows Print Spooler Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-1647 | 12 Jan 2021 | CVSS 7.8 | Microsoft Defender Remote Code ExecutionMicrosoft Defender Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2021-1498 | 6 May 2021 | CVSS 9.8 | Cisco HyperFlex HX Data Platform Command InjectionMultiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform… | Exploited |
| CVE-2021-1497 | 6 May 2021 | CVSS 9.8 | Cisco HyperFlex HX Installer Virtual Machine Command InjectionMultiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform… | Exploited |
| CVE-2020-9859 | 5 Jun 2020 | CVSS 7.8 | Apple Multiple Products Code ExecutionA memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5… | Exploited |
| CVE-2020-9819 | 9 Jun 2020 | CVSS 4.3 | Apple iOS, iPadOS, and watchOS Memory CorruptionA memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5… | Exploited |
| CVE-2020-9818 | 9 Jun 2020 | CVSS 8.8 | Apple iOS, iPadOS, and watchOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5… | Exploited |
| CVE-2020-8657 | 6 Feb 2020 | CVSS 9.8 | EyesOfNetwork Use of Hard-Coded CredentialsAn issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API… | Exploited |
| CVE-2020-8655 | 7 Feb 2020 | CVSS 7.8 | EyesOfNetwork Improper Privilege ManagementAn issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to… | Exploited |
| CVE-2020-8644 | 5 Feb 2020 | CVSS 9.8 | PlaySMS Server-Side Template InjectionPlaySMS before 1.4.3 does not sanitize inputs from a malicious string. | Exploited |
| CVE-2020-8599 | 18 Mar 2020 | CVSS 9.8 | Trend Micro Apex One and OfficeScan Authentication BypassTrend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an… | ExploitedFix |
| CVE-2020-8515 | 1 Feb 2020 | CVSS 9.8 | Multiple DrayTek Vigor Routers Web Management PageDrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as… | Exploited |
| CVE-2020-8468 | 18 Mar 2020 | CVSS 8.8 | Trend Micro Multiple Products Content Validation EscapeTrend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape… | ExploitedFix |
| CVE-2020-8467 | 18 Mar 2020 | CVSS 8.8 | Trend Micro Apex One and OfficeScan Remote Code ExecutionA migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute… | ExploitedFix |
| CVE-2020-8260 | 28 Oct 2020 | CVSS 7.2 | Ivanti Pulse Connect Secure Code ExecutionA vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution… | Exploited |
| CVE-2020-8243 | 30 Sep 2020 | CVSS 7.2 | Ivanti Pulse Connect Secure Code ExecutionA vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform… | Exploited |
| CVE-2020-8196 | 10 Jul 2020 | CVSS 4.3 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information DisclosureImproper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix… | Exploited |
| CVE-2020-8195 | 10 Jul 2020 | CVSS 6.5 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information DisclosureImproper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix… | Exploited |
| CVE-2020-8193 | 10 Jul 2020 | CVSS 6.5 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization BypassImproper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix… | Exploited |
| CVE-2020-7961 | 20 Mar 2020 | CVSS 9.8 | Liferay Portal Deserialization of Untrusted DataDeserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services… | Exploited |
| CVE-2020-6820 | 24 Apr 2020 | CVSS 8.1 | Mozilla Firefox And Thunderbird Use-After-FreeUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild… | Exploited |
| CVE-2020-6819 | 24 Apr 2020 | CVSS 8.1 | Mozilla Firefox And Thunderbird Use-After-FreeUnder certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in… | Exploited |
| CVE-2020-6418 | 27 Feb 2020 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ExploitedFix |
| CVE-2020-6287 | 14 Jul 2020 | CVSS 10.0 | SAP NetWeaver Missing Authentication for Critical FunctionSAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker… | Exploited |
| CVE-2020-6207 | 10 Mar 2020 | CVSS 9.8 | SAP Solution Manager Missing Authentication for Critical FunctionSAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a… | Exploited |
| CVE-2020-5902 | 1 Jul 2020 | CVSS 9.8 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code ExecutionIn BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface… | Exploited |
| CVE-2020-5849 | 16 Mar 2020 | CVSS 7.5 | Unraid Authentication BypassUnraid 6.8.0 allows authentication bypass. | Exploited |
| CVE-2020-5847 | 16 Mar 2020 | CVSS 9.8 | Unraid Remote Code ExecutionUnraid through 6.8.0 allows Remote Code Execution. | Exploited |
| CVE-2020-5735 | 8 Apr 2020 | CVSS 8.8 | Amcrest Cameras and NVR Stack-based Buffer OverflowAmcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to… | Exploited |
| CVE-2020-4430 | 7 May 2020 | CVSS 4.3 | IBM Data Risk Manager Directory TraversalIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker… | ExploitedFix |
Page 16 of 18