[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2021-33045 | 15 Sep 2021 | CVSS 9.8 | Dahua IP Camera Authentication BypassThe identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity… | Exploited |
| CVE-2021-33044 | 15 Sep 2021 | CVSS 9.8 | Dahua IP Camera Authentication BypassThe identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity… | Exploited |
| CVE-2021-31196 | 14 Jul 2021 | CVSS 7.2 | Microsoft Exchange Server Information DisclosureMicrosoft Exchange Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-23897 | 24 Jan 2024 | CVSS 9.8 | Jenkins Command Line Interface (CLI) Path TraversalJenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a… | Exploited |
| CVE-2024-28986 | 13 Aug 2024 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an… | Exploited |
| CVE-2024-38213 | 13 Aug 2024 | CVSS 6.5 | Microsoft Windows SmartScreen Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-38193 | 13 Aug 2024 | CVSS 7.8 | Microsoft Windows Ancillary Function Driver for WinSock Privilege EscalationWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-38189 | 13 Aug 2024 | CVSS 8.8 | Microsoft Project Remote Code ExecutionMicrosoft Project Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2024-38178 | 13 Aug 2024 | CVSS 7.5 | Microsoft Windows Scripting Engine Memory CorruptionScripting Engine Memory Corruption Vulnerability | ExploitedFix |
| CVE-2024-38107 | 13 Aug 2024 | CVSS 7.8 | Microsoft Windows Power Dependency Coordinator Privilege EscalationWindows Power Dependency Coordinator Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-38106 | 13 Aug 2024 | CVSS 7.0 | Microsoft Windows Kernel Privilege EscalationWindows Kernel Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-36971 | 10 Jun 2024 | CVSS 7.8 | Android Kernel Remote Code ExecutionIn the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce… | ExploitedFix |
| CVE-2024-32113 | 8 May 2024 | CVSS 9.8 | Apache OFBiz Path TraversalImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before… | ExploitedFix |
| CVE-2018-0824 | 9 May 2018 | CVSS 8.8 | Microsoft COM for Windows Deserialization of Untrusted DataA remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM… | ExploitedFix |
| CVE-2024-37085 | 25 Jun 2024 | CVSS 7.2 | VMware ESXi Authentication BypassVMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access… | ExploitedFix |
| CVE-2024-5217 | 10 Jul 2024 | CVSS 9.8 | ServiceNow Incomplete List of Disallowed InputsServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases… | Exploited |
| CVE-2024-4879 | 10 Jul 2024 | CVSS 9.8 | ServiceNow Improper Input ValidationServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This… | Exploited |
| CVE-2023-45249 | 24 Jul 2024 | CVSS 9.8 | Acronis Cyber Infrastructure (ACI) Insecure Default PasswordRemote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build… | Exploited |
| CVE-2024-39891 | 2 Jul 2024 | CVSS 5.3 | Twilio Authy Information DisclosureIn the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain… | Exploited |
| CVE-2012-4792 | 30 Dec 2012 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that… | ExploitedFix |
| CVE-2024-34102 | 13 Jun 2024 | CVSS 9.8 | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference… | Exploited |
| CVE-2024-28995 | 6 Jun 2024 | CVSS 7.5 | SolarWinds Serv-U Path TraversalSolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. | Exploited |
| CVE-2022-22948 | 29 Mar 2022 | CVSS 6.5 | VMware vCenter Server Incorrect Default File PermissionsThe vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative… | ExploitedFix |
| CVE-2024-36401 | 1 Jul 2024 | CVSS 9.8 | OSGeo GeoServer GeoTools Eval InjectionGeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2… | ExploitedFix |
| CVE-2024-38112 | 9 Jul 2024 | CVSS 7.5 | Microsoft Windows MSHTML Platform SpoofingWindows MSHTML Platform Spoofing Vulnerability | ExploitedFix |
| CVE-2024-38080 | 9 Jul 2024 | CVSS 7.8 | Microsoft Windows Hyper-V Privilege EscalationWindows Hyper-V Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-23692 | 31 May 2024 | CVSS 9.8 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template EngineRejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote… | ExploitedFix |
| CVE-2024-20399 | 1 Jul 2024 | CVSS 6.7 | Cisco NX-OS Command InjectionA vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary… | Exploited |
| CVE-2022-2586 | 8 Jan 2024 | CVSS 7.8 | Linux Kernel Use-After-FreeIt was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was… | ExploitedFix |
| CVE-2022-24816 | 13 Apr 2022 | CVSS 10.0 | OSGeo GeoServer JAI-EXT Code InjectionJAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via… | ExploitedFix |
| CVE-2020-13965 | 9 Jun 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is… | ExploitedFix |
| CVE-2024-4358 | 29 May 2024 | CVSS 9.8 | Progress Telerik Report Server Authentication Bypass by SpoofingIn Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report… | Exploited |
| CVE-2024-32896 | 13 Jun 2024 | CVSS 7.8 | Android Pixel Privilege Escalationthere is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution… | Exploited |
| CVE-2024-26169 | 12 Mar 2024 | CVSS 7.8 | Microsoft Windows Error Reporting Service Improper Privilege ManagementWindows Error Reporting Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-4610 | 7 Jun 2024 | CVSS 7.8 | Arm Mali GPU Kernel Driver Use-After-FreeUse After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make… | Exploited |
| CVE-2024-4577 | 9 Jun 2024 | CVSS 9.8 | PHP-CGI OS Command InjectionIn PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to… | ExploitedFix |
| CVE-2017-3506 | 24 Apr 2017 | CVSS 7.4 | Oracle WebLogic Server OS Command InjectionVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected… | ExploitedFix |
| CVE-2024-24919 | 28 May 2024 | CVSS 8.6 | Check Point Quantum Security Gateways Information DisclosurePotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote… | ExploitedFix |
| CVE-2024-1086 | 31 Jan 2024 | CVSS 7.8 | Linux Kernel Use-After-FreeA use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The… | ExploitedFix |
| CVE-2024-4978 | 23 May 2024 | CVSS 8.4 | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious CodeJustice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A… | Exploited |
| CVE-2024-5274 | 28 May 2024 | CVSS 9.6 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… | Exploited |
| CVE-2020-17519 | 5 Jan 2021 | CVSS 7.5 | Apache Flink Improper Access ControlA change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of… | Exploited |
| CVE-2024-4947 | 15 May 2024 | CVSS 9.6 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… | Exploited |
| CVE-2023-43208 | 26 Oct 2023 | CVSS 9.8 | NextGen Healthcare Mirth Connect Deserialization of Untrusted DataNextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused… | Exploited |
| CVE-2024-4761 | 14 May 2024 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds Memory WriteOut of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted… | Exploited |
| CVE-2021-40655 | 24 Sep 2021 | CVSS 7.5 | D-Link DIR-605 Router Information DisclosureAn informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a… | Exploited |
| CVE-2014-100005 | 13 Jan 2015 | CVSS 8.0 | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF)Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to… | ExploitedFix |
| CVE-2024-30051 | 14 May 2024 | CVSS 7.8 | Microsoft DWM Core Library Privilege EscalationWindows DWM Core Library Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-30040 | 14 May 2024 | CVSS 8.8 | Microsoft Windows MSHTML Platform Security Feature BypassWindows MSHTML Platform Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-4671 | 14 May 2024 | CVSS 9.6 | Google Chromium Visuals Use-After-FreeUse after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially… | Exploited |
| CVE-2023-7028 | 12 Jan 2024 | CVSS 9.8 | GitLab Community and Enterprise Editions Improper Access ControlAn issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior… | Exploited |
| CVE-2024-29988 | 9 Apr 2024 | CVSS 8.8 | Microsoft SmartScreen Prompt Security Feature BypassSmartScreen Prompt Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-4040 | 22 Apr 2024 | CVSS 10.0 | CrushFTP VFS Sandbox EscapeA server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote… | ExploitedFix |
| CVE-2024-20359 | 24 Apr 2024 | CVSS 6.0 | Cisco ASA and FTD Privilege EscalationA vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive… | Exploited |
| CVE-2024-20353 | 24 Apr 2024 | CVSS 8.6 | Cisco ASA and FTD Denial of ServiceA vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)… | Exploited |
| CVE-2022-38028 | 11 Oct 2022 | CVSS 7.8 | Microsoft Windows Print Spooler Privilege EscalationWindows Print Spooler Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-3400 | 12 Apr 2024 | CVSS 10.0 | Palo Alto Networks PAN-OS Command InjectionA command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for… | Exploited |
| CVE-2024-3273 | 4 Apr 2024 | CVSS 9.8 | D-Link Multiple NAS Devices Command Injection** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to… | Exploited |
| CVE-2024-3272 | 4 Apr 2024 | CVSS 9.8 | D-Link Multiple NAS Devices Use of Hard-Coded Credentials** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and… | Exploited |
| CVE-2024-29748 | 5 Apr 2024 | CVSS 7.8 | Android Pixel Privilege Escalationthere is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution… | Exploited |
| CVE-2024-29745 | 5 Apr 2024 | CVSS 5.5 | Android Pixel Information Disclosurethere is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution… | Exploited |
| CVE-2023-24955 | 9 May 2023 | CVSS 7.2 | Microsoft SharePoint Server Code InjectionMicrosoft SharePoint Server Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2023-48788 | 12 Mar 2024 | CVSS 9.8 | Fortinet FortiClient EMS SQL InjectionA improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2… | Exploited |
| CVE-2021-44529 | 8 Dec 2021 | CVSS 9.8 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code InjectionA code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited… | ExploitedFix |
| CVE-2019-7256 | 2 Jul 2019 | CVSS 9.8 | Nice Linear eMerge E3-Series OS Command InjectionLinear eMerge E3-Series devices allow Command Injections. | Exploited |
| CVE-2024-27198 | 4 Mar 2024 | CVSS 9.8 | JetBrains TeamCity Authentication BypassIn JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible | Exploited |
| CVE-2024-23296 | 5 Mar 2024 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4… | Exploited |
| CVE-2024-23225 | 5 Mar 2024 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4… | Exploited |
| CVE-2023-21237 | 28 Jun 2023 | CVSS 5.5 | Android Pixel Information DisclosureIn applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or… | Exploited |
| CVE-2021-36380 | 13 Aug 2021 | CVSS 9.8 | Sunhillo SureLine OS Command Injection VulnerablitySunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi. | Exploited |
| CVE-2024-21338 | 13 Feb 2024 | CVSS 7.8 | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access ControlWindows Kernel Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-29360 | 14 Jun 2023 | CVSS 8.4 | Microsoft Streaming Service Untrusted Pointer DereferenceMicrosoft Streaming Service Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2024-1709 | 21 Feb 2024 | CVSS 10.0 | ConnectWise ScreenConnect Authentication BypassConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow… | ExploitedFix |
| CVE-2024-21410 | 13 Feb 2024 | CVSS 9.8 | Microsoft Exchange Server Privilege EscalationMicrosoft Exchange Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2020-3259 | 6 May 2020 | CVSS 7.5 | Cisco ASA and FTD Information DisclosureA vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… | Exploited |
| CVE-2024-21412 | 13 Feb 2024 | CVSS 8.1 | Microsoft Windows Internet Shortcut Files Security Feature BypassInternet Shortcut Files Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2024-21351 | 13 Feb 2024 | CVSS 7.6 | Microsoft Windows SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-43770 | 22 Sep 2023 | CVSS 6.1 | Roundcube Webmail Persistent Cross-Site Scripting (XSS)Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of… | ExploitedFix |
| CVE-2024-21762 | 9 Feb 2024 | CVSS 9.8 | Fortinet FortiOS Out-of-Bound WriteA out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0… | Exploited |
| CVE-2023-4762 | 5 Sep 2023 | CVSS 8.8 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium… | ExploitedFix |
| CVE-2024-21893 | 31 Jan 2024 | CVSS 8.2 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF)A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and… | Exploited |
| CVE-2022-48618 | 9 Jan 2024 | CVSS 7.0 | Apple Multiple Products Memory CorruptionThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An… | Exploited |
| CVE-2023-22527 | 16 Jan 2024 | CVSS 9.8 | Atlassian Confluence Data Center and Server Template InjectionA template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an… | Exploited |
| CVE-2024-23222 | 23 Jan 2024 | CVSS 8.8 | Apple Multiple Products WebKit Type ConfusionA type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS… | Exploited |
| CVE-2023-34048 | 25 Oct 2023 | CVSS 9.8 | VMware vCenter Server Out-of-Bounds WritevCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to… | Exploited |
| CVE-2023-35082 | 15 Aug 2023 | CVSS 9.8 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication BypassAn authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of… | Exploited |
| CVE-2024-0519 | 16 Jan 2024 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds Memory AccessOut of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2023-6549 | 17 Jan 2024 | CVSS 7.5 | Citrix NetScaler ADC and NetScaler Gateway Buffer OverflowImproper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of… | Exploited |
| CVE-2023-6548 | 17 Jan 2024 | CVSS 8.8 | Citrix NetScaler ADC and NetScaler Gateway Code InjectionImproper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP… | Exploited |
| CVE-2018-15133 | 9 Aug 2018 | CVSS 8.1 | Laravel Deserialization of Untrusted DataIn Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially… | Exploited |
| CVE-2024-21887 | 12 Jan 2024 | CVSS 9.1 | Ivanti Connect Secure and Policy Secure Command InjectionA command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated… | Exploited |
| CVE-2023-46805 | 12 Jan 2024 | CVSS 8.2 | Ivanti Connect Secure and Policy Secure Authentication BypassAn authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access… | Exploited |
| CVE-2023-29357 | 14 Jun 2023 | CVSS 9.8 | Microsoft SharePoint Server Privilege EscalationMicrosoft SharePoint Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-41990 | 12 Sep 2023 | CVSS 7.8 | Apple Multiple Products Code ExecutionThe issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS… | Exploited |
| CVE-2023-38203 | 20 Jul 2023 | CVSS 9.8 | Adobe ColdFusion Deserialization of Untrusted DataAdobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data… | ExploitedFix |
| CVE-2023-29300 | 12 Jul 2023 | CVSS 9.8 | Adobe ColdFusion Deserialization of Untrusted DataAdobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of… | Exploited |
| CVE-2023-27524 | 24 Apr 2023 | CVSS 9.8 | Apache Superset Insecure Default Initialization of ResourceSession Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured… | Exploited |
| CVE-2023-23752 | 16 Feb 2023 | CVSS 5.3 | Joomla! Improper Access ControlAn issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. | Exploited |
| CVE-2016-20017 | 19 Oct 2022 | CVSS 9.8 | D-Link DSL-2750B Devices Command InjectionD-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016… | ExploitedFix |
| CVE-2023-7101 | 24 Dec 2023 | CVSS 7.8 | Spreadsheet::ParseExcel Remote Code ExecutionSpreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code… | ExploitedFix |
Page 7 of 18