[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2018-19410 | 21 Nov 2018 | CVSS 9.8 | Paessler PRTG Network Monitor Local File InclusionPRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including… | Exploited |
| CVE-2025-24085 | 27 Jan 2025 | CVSS 10.0 | Apple Multiple Products Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia… | Exploited |
| CVE-2025-23006 | 23 Jan 2025 | CVSS 9.8 | SonicWall SMA1000 Appliances DeserializationPre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central… | Exploited |
| CVE-2020-11023 | 29 Apr 2020 | CVSS 6.1 | JQuery Cross-Site Scripting (XSS)In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after… | ExploitedFix |
| CVE-2024-50603 | 8 Jan 2025 | CVSS 9.8 | Aviatrix Controllers OS Command InjectionAn issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used… | Exploited |
| CVE-2025-21335 | 14 Jan 2025 | CVSS 7.8 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-FreeWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2025-21334 | 14 Jan 2025 | CVSS 7.8 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-FreeWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2025-21333 | 14 Jan 2025 | CVSS 7.8 | Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer OverflowWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-55591 | 14 Jan 2025 | CVSS 9.8 | Fortinet FortiOS and FortiProxy Authentication BypassAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy… | Exploited |
| CVE-2024-12686 | 18 Dec 2024 | CVSS 7.2 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command InjectionA vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing… | Exploited |
| CVE-2023-48365 | 15 Nov 2023 | CVSS 9.9 | Qlik Sense HTTP TunnelingQlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation… | Exploited |
| CVE-2025-0282 | 8 Jan 2025 | CVSS 9.0 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer OverflowA stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for… | Exploited |
| CVE-2024-55550 | 10 Dec 2024 | CVSS 2.7 | Mitel MiCollab Path TraversalMitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient… | Exploited |
| CVE-2024-41713 | 21 Oct 2024 | CVSS 9.1 | Mitel MiCollab Path TraversalA vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated… | Exploited |
| CVE-2020-2883 | 15 Apr 2020 | CVSS 9.8 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | Exploited |
| CVE-2024-3393 | 27 Dec 2024 | CVSS 7.5 | Palo Alto Networks PAN-OS Malicious DNS PacketA Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a… | Exploited |
| CVE-2021-44207 | 21 Dec 2021 | CVSS 8.1 | Acclaim Systems USAHERDS Use of Hard-Coded CredentialsAcclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. | Exploited |
| CVE-2024-12356 | 17 Dec 2024 | CVSS 9.8 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command InjectionA critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated… | Exploited |
| CVE-2022-23227 | 14 Jan 2022 | CVSS 9.8 | NUUO NVRmini2 Devices Missing AuthenticationNUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because… | Exploited |
| CVE-2021-40407 | 28 Jan 2022 | CVSS 7.2 | Reolink RLC-410W IP Camera OS Command InjectionAn OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2]… | Exploited |
| CVE-2019-11001 | 8 Apr 2019 | CVSS 7.2 | Reolink Multiple IP Cameras OS Command InjectionOn Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to… | Exploited |
| CVE-2018-14933 | 4 Aug 2018 | CVSS 9.8 | NUUO NVRmini Devices OS Command Injectionupgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir… | Exploited |
| CVE-2024-55956 | 13 Dec 2024 | CVSS 9.8 | Cleo Multiple Products Unauthenticated File UploadIn Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash… | Exploited |
| CVE-2024-35250 | 11 Jun 2024 | CVSS 7.8 | Microsoft Windows Kernel-Mode Driver Untrusted Pointer DereferenceWindows Kernel-Mode Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-20767 | 18 Mar 2024 | CVSS 7.4 | Adobe ColdFusion Improper Access ControlColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system… | Exploited |
| CVE-2024-50623 | 28 Oct 2024 | CVSS 9.8 | Cleo Multiple Products Unrestricted File UploadIn Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could… | Exploited |
| CVE-2024-49138 | 12 Dec 2024 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer OverflowWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-51378 | 29 Oct 2024 | CVSS 9.8 | CyberPanel Incorrect Default Permissionsgetresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and… | ExploitedFix |
| CVE-2024-11680 | 26 Nov 2024 | CVSS 9.8 | ProjectSend Improper AuthenticationProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw… | ExploitedFix |
| CVE-2024-11667 | 27 Nov 2024 | CVSS 9.8 | Zyxel Multiple Firewalls Path TraversalA directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series… | Exploited |
| CVE-2023-45727 | 18 Oct 2023 | CVSS 7.5 | North Grid Proself Improper Restriction of XML External Entity (XXE) ReferenceProself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and… | Exploited |
| CVE-2023-28461 | 15 Mar 2023 | CVSS 9.8 | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical FunctionArray Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN… | Exploited |
| CVE-2024-44309 | 20 Nov 2024 | CVSS 6.3 | Apple Multiple Products Cross-Site Scripting (XSS)A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS… | Exploited |
| CVE-2024-44308 | 20 Nov 2024 | CVSS 8.8 | Apple Multiple Products Code ExecutionThe issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS… | Exploited |
| CVE-2024-21287 | 18 Nov 2024 | CVSS 7.5 | Oracle Agile Product Lifecycle Management (PLM) Incorrect AuthorizationVulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The… | Exploited |
| CVE-2024-38813 | 17 Sep 2024 | CVSS 9.8 | VMware vCenter Server Privilege EscalationThe vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this… | Exploited |
| CVE-2024-38812 | 17 Sep 2024 | CVSS 9.8 | VMware vCenter Server Heap-Based Buffer OverflowThe vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to… | Exploited |
| CVE-2024-9474 | 18 Nov 2024 | CVSS 7.2 | Palo Alto Networks PAN-OS Management Interface OS Command InjectionA privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface… | Exploited |
| CVE-2024-1212 | 21 Feb 2024 | CVSS 9.8 | Progress Kemp LoadMaster OS Command InjectionUnauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. | Exploited |
| CVE-2024-0012 | 18 Nov 2024 | CVSS 9.8 | Palo Alto Networks PAN-OS Management Interface Authentication BypassAn authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web… | Exploited |
| CVE-2024-9465 | 9 Oct 2024 | CVSS 9.1 | Palo Alto Networks Expedition SQL InjectionAn SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as… | Exploited |
| CVE-2024-9463 | 9 Oct 2024 | CVSS 7.5 | Palo Alto Networks Expedition OS Command InjectionAn OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in… | Exploited |
| CVE-2024-49039 | 12 Nov 2024 | CVSS 8.8 | Microsoft Windows Task Scheduler Privilege EscalationWindows Task Scheduler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-43451 | 12 Nov 2024 | CVSS 6.5 | Microsoft Windows NTLMv2 Hash Disclosure SpoofingNTLM Hash Disclosure Spoofing Vulnerability | ExploitedFix |
| CVE-2021-41277 | 17 Nov 2021 | CVSS 7.5 | Metabase GeoJSON API Local File InclusionMetabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map… | ExploitedFix |
| CVE-2021-26086 | 16 Aug 2021 | CVSS 5.3 | Atlassian Jira Server and Data Center Path TraversalAffected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the… | Exploited |
| CVE-2014-2120 | 19 Mar 2014 | CVSS 6.1 | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to… | Exploited |
| CVE-2024-5910 | 10 Jul 2024 | CVSS 9.8 | Palo Alto Networks Expedition Missing AuthenticationMissing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with… | Exploited |
| CVE-2024-51567 | 29 Oct 2024 | CVSS 9.8 | CyberPanel Incorrect Default Permissionsupgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute… | ExploitedFix |
| CVE-2024-43093 | 13 Nov 2024 | CVSS 7.3 | Android Framework Privilege EscalationIn shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive… | ExploitedFix |
| CVE-2019-16278 | 14 Oct 2019 | CVSS 9.8 | Nostromo nhttpd Directory TraversalDirectory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted… | Exploited |
| CVE-2024-8957 | 17 Sep 2024 | CVSS 7.2 | PTZOptics PT30X-SDI/NDI Cameras OS Command InjectionPTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the… | Exploited |
| CVE-2024-8956 | 17 Sep 2024 | CVSS 9.1 | PTZOptics PT30X-SDI/NDI Cameras Authentication BypassPTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce… | Exploited |
| CVE-2024-37383 | 7 Jun 2024 | CVSS 6.1 | RoundCube Webmail Cross-Site Scripting (XSS)Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. | ExploitedFix |
| CVE-2024-20481 | 23 Oct 2024 | CVSS 5.8 | Cisco ASA and FTD Denial-of-ServiceA vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)… | Exploited |
| CVE-2024-47575 | 23 Oct 2024 | CVSS 9.8 | Fortinet FortiManager Missing AuthenticationA missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7… | Exploited |
| CVE-2024-38094 | 9 Jul 2024 | CVSS 7.2 | Microsoft SharePoint DeserializationMicrosoft SharePoint Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-9537 | 18 Oct 2024 | CVSS 9.8 | ScienceLogic SL1 UnspecifiedScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The… | Exploited |
| CVE-2024-40711 | 7 Sep 2024 | CVSS 9.8 | Veeam Backup and Replication DeserializationA deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). | Exploited |
| CVE-2024-9680 | 9 Oct 2024 | CVSS 9.8 | Mozilla Firefox Use-After-FreeAn attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of… | ExploitedFix |
| CVE-2024-30088 | 11 Jun 2024 | CVSS 7.0 | Microsoft Windows Kernel TOCTOU Race ConditionWindows Kernel Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-28987 | 21 Aug 2024 | CVSS 9.1 | SolarWinds Web Help Desk Hardcoded CredentialThe SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access… | Exploited |
| CVE-2024-9380 | 8 Oct 2024 | CVSS 7.2 | Ivanti Cloud Services Appliance (CSA) OS Command InjectionAn OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin… | Exploited |
| CVE-2024-9379 | 8 Oct 2024 | CVSS 7.2 | Ivanti Cloud Services Appliance (CSA) SQL InjectionSQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run… | Exploited |
| CVE-2024-23113 | 15 Feb 2024 | CVSS 9.8 | Fortinet Multiple Products Format StringA use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy… | Exploited |
| CVE-2024-43573 | 8 Oct 2024 | CVSS 8.1 | Microsoft Windows MSHTML Platform SpoofingWindows MSHTML Platform Spoofing Vulnerability | ExploitedFix |
| CVE-2024-43572 | 8 Oct 2024 | CVSS 7.8 | Microsoft Windows Management Console Remote Code ExecutionMicrosoft Management Console Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-43047 | 7 Oct 2024 | CVSS 7.8 | Qualcomm Multiple Chipsets Use-After-FreeMemory corruption while maintaining memory maps of HLOS memory. | ExploitedFix |
| CVE-2024-45519 | 2 Oct 2024 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Command ExecutionThe postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1… | Exploited |
| CVE-2024-29824 | 31 May 2024 | CVSS 8.8 | Ivanti Endpoint Manager (EPM) SQL InjectionAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network… | Exploited |
| CVE-2023-25280 | 16 Mar 2023 | CVSS 9.8 | D-Link DIR-820 Router OS Command InjectionOS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the… | Exploited |
| CVE-2020-15415 | 30 Jun 2020 | CVSS 9.8 | DrayTek Multiple Vigor Routers OS Command InjectionOn DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell… | Exploited |
| CVE-2019-0344 | 14 Aug 2019 | CVSS 9.8 | SAP Commerce Cloud Deserialization of Untrusted DataDue to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to… | Exploited |
| CVE-2024-7593 | 13 Aug 2024 | CVSS 9.8 | Ivanti Virtual Traffic Manager Authentication BypassIncorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker… | ExploitedFix |
| CVE-2024-8963 | 19 Sep 2024 | CVSS 9.1 | Ivanti Cloud Services Appliance (CSA) Path TraversalPath Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | Exploited |
| CVE-2024-27348 | 22 Apr 2024 | CVSS 9.8 | Apache HugeGraph-Server Improper Access ControlRCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 &… | Exploited |
| CVE-2022-21445 | 19 Apr 2022 | CVSS 9.8 | Oracle ADF Faces Deserialization of Untrusted DataVulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions… | Exploited |
| CVE-2020-14644 | 15 Jul 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | Exploited |
| CVE-2020-0618 | 11 Feb 2020 | CVSS 8.8 | Microsoft SQL Server Reporting Services Remote Code ExecutionA remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL… | ExploitedFix |
| CVE-2014-0502 | 21 Feb 2014 | CVSS 8.8 | Adobe Flash Player Double Free VulnerablityDouble free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before… | ExploitedFix |
| CVE-2014-0497 | 5 Feb 2014 | CVSS 9.8 | Adobe Flash Player Integer Underflow VulnerablityInteger underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before… | ExploitedFix |
| CVE-2013-0648 | 27 Feb 2013 | CVSS 8.8 | Adobe Flash Player Code ExecutionUnspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171… | ExploitedFix |
| CVE-2013-0643 | 27 Feb 2013 | CVSS 8.8 | Adobe Flash Player Incorrect Default PermissionsThe Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x… | ExploitedFix |
| CVE-2024-6670 | 29 Aug 2024 | CVSS 9.8 | Progress WhatsUp Gold SQL InjectionIn WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted… | Exploited |
| CVE-2024-43461 | 10 Sep 2024 | CVSS 8.8 | Microsoft Windows MSHTML Platform SpoofingWindows MSHTML Platform Spoofing Vulnerability | ExploitedFix |
| CVE-2024-8190 | 10 Sep 2024 | CVSS 7.2 | Ivanti Cloud Services Appliance OS Command InjectionAn OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to… | Exploited |
| CVE-2024-38226 | 10 Sep 2024 | CVSS 7.3 | Microsoft Publisher Protection Mechanism FailureMicrosoft Publisher Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-38217 | 10 Sep 2024 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism FailureWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-38014 | 10 Sep 2024 | CVSS 7.8 | Microsoft Windows Installer Improper Privilege ManagementWindows Installer Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-40766 | 23 Aug 2024 | CVSS 9.8 | SonicWall SonicOS Improper Access ControlAn improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource… | Exploited |
| CVE-2017-1000253 | 5 Oct 2017 | CVSS 7.8 | Linux Kernel PIE Stack Buffer CorruptionLinux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86… | ExploitedFix |
| CVE-2016-3714 | 5 May 2016 | CVSS 8.4 | ImageMagick Improper Input ValidationThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… | ExploitedFix |
| CVE-2024-7262 | 15 Aug 2024 | CVSS 7.8 | Kingsoft WPS Office Path TraversalImproper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows… | Exploited |
| CVE-2021-20124 | 13 Oct 2021 | CVSS 7.5 | Draytek VigorConnect Path TraversalA local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An… | Exploited |
| CVE-2021-20123 | 13 Oct 2021 | CVSS 7.5 | Draytek VigorConnect Path TraversalA local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint… | Exploited |
| CVE-2024-7965 | 21 Aug 2024 | CVSS 8.8 | Google Chromium V8 Inappropriate ImplementationInappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2024-38856 | 5 Aug 2024 | CVSS 9.8 | Apache OFBiz Incorrect AuthorizationIncorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version… | ExploitedFix |
| CVE-2024-7971 | 21 Aug 2024 | CVSS 9.6 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium… | ExploitedFix |
| CVE-2024-39717 | 22 Aug 2024 | CVSS 7.2 | Versa Director Dangerous File Type UploadThe Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with… | Exploited |
| CVE-2022-0185 | 11 Feb 2022 | CVSS 8.4 | Linux Kernel Heap-Based Buffer OverflowA heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel… | ExploitedFix |
Page 6 of 18