[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2023-32435 | 23 Jun 2023 | CVSS 8.8 | Apple Multiple Products WebKit Memory CorruptionA memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS… | Exploited |
| CVE-2023-32434 | 23 Jun 2023 | CVSS 7.8 | Apple Multiple Products Integer OverflowAn integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS… | Exploited |
| CVE-2023-27992 | 19 Jun 2023 | CVSS 9.8 | Zyxel Multiple NAS Devices Command InjectionThe pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions… | ExploitedFix |
| CVE-2023-20867 | 13 Jun 2023 | CVSS 3.9 | VMware Tools Authentication BypassA fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of… | ExploitedFix |
| CVE-2023-20887 | 7 Jun 2023 | CVSS 9.8 | Vmware Aria Operations for Networks Command InjectionAria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks… | ExploitedFix |
| CVE-2021-44026 | 19 Nov 2021 | CVSS 9.8 | Roundcube Webmail SQL InjectionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. | ExploitedFix |
| CVE-2020-35730 | 28 Dec 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text… | ExploitedFix |
| CVE-2020-12641 | 4 May 2020 | CVSS 9.8 | Roundcube Webmail Remote Code Executionrcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for… | ExploitedFix |
| CVE-2016-9079 | 11 Jun 2018 | CVSS 7.5 | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-FreeA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting… | Exploited |
| CVE-2016-0165 | 12 Apr 2016 | CVSS 7.8 | Microsoft Win32k Privilege EscalationThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… | ExploitedFix |
| CVE-2023-27997 | 13 Jun 2023 | CVSS 9.8 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer OverflowA heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version… | Exploited |
| CVE-2023-3079 | 5 Jun 2023 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2023-33010 | 24 May 2023 | CVSS 9.8 | Zyxel Multiple Firewalls Buffer OverflowA buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series… | Exploited |
| CVE-2023-33009 | 24 May 2023 | CVSS 9.8 | Zyxel Multiple Firewalls Buffer OverflowA buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series… | Exploited |
| CVE-2023-34362 | 2 Jun 2023 | CVSS 9.8 | Progress MOVEit Transfer SQL InjectionIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection… | Exploited |
| CVE-2023-28771 | 25 Apr 2023 | CVSS 9.8 | Zyxel Multiple Firewalls OS Command InjectionImproper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG… | Exploited |
| CVE-2023-2868 | 24 May 2023 | CVSS 9.8 | Barracuda Networks ESG Appliance Improper Input ValidationA remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions… | Exploited |
| CVE-2023-32409 | 23 Jun 2023 | CVSS 8.6 | Apple Multiple Products WebKit Sandbox EscapeThe issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8… | Exploited |
| CVE-2023-32373 | 23 Jun 2023 | CVSS 8.8 | Apple Multiple Products WebKit Use-After-FreeA use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6… | Exploited |
| CVE-2023-28204 | 23 Jun 2023 | CVSS 6.5 | Apple Multiple Products WebKit Out-of-Bounds ReadAn out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and… | Exploited |
| CVE-2023-21492 | 4 May 2023 | CVSS 4.4 | Samsung Mobile Devices Insertion of Sensitive Information Into Log FileKernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. | Exploited |
| CVE-2016-6415 | 19 Sep 2016 | CVSS 7.5 | Cisco IOS, IOS XR, and IOS XE IKEv1 Information DisclosureThe server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and… | Exploited |
| CVE-2004-1464 | 31 Dec 2004 | CVSS 5.9 | Cisco IOS Denial-of-ServiceCisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP… | ExploitedFix |
| CVE-2023-25717 | 13 Feb 2023 | CVSS 9.8 | Multiple Ruckus Wireless Products CSRF and RCERuckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a… | ExploitedFix |
| CVE-2021-3560 | 16 Feb 2022 | CVSS 7.8 | Red Hat Polkit Incorrect AuthorizationIt was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the… | ExploitedFix |
| CVE-2016-8735 | 6 Apr 2017 | CVSS 9.8 | Apache Tomcat Remote Code ExecutionRemote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before… | ExploitedFix |
| CVE-2016-3427 | 21 Apr 2016 | CVSS 9.8 | Oracle Java SE and JRockit UnspecifiedUnspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect… | ExploitedFix |
| CVE-2015-5317 | 25 Nov 2015 | CVSS 7.5 | Jenkins User Interface (UI) Information DisclosureThe Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information… | Exploited |
| CVE-2014-0196 | 7 May 2014 | CVSS 5.5 | Linux Kernel Race ConditionThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST"… | ExploitedFix |
| CVE-2010-3904 | 6 Dec 2010 | CVSS 7.8 | Linux Kernel Improper Input ValidationThe rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36… | ExploitedFix |
| CVE-2023-29336 | 9 May 2023 | CVSS 7.8 | Microsoft Win32K Privilege EscalationWin32k Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-21839 | 18 Jan 2023 | CVSS 7.5 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | ExploitedFix |
| CVE-2023-1389 | 15 Mar 2023 | CVSS 8.8 | TP-Link Archer AX-21 Command InjectionTP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the… | Exploited |
| CVE-2021-45046 | 14 Dec 2021 | CVSS 9.0 | Apache Log4j2 Deserialization of Untrusted DataIt was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows… | ExploitedFix |
| CVE-2023-28432 | 22 Mar 2023 | CVSS 7.5 | MinIO Information DisclosureMinio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to… | Exploited |
| CVE-2023-27350 | 20 Apr 2023 | CVSS 9.8 | PaperCut MF/NG Improper Access ControlThis vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is… | Exploited |
| CVE-2023-2136 | 19 Apr 2023 | CVSS 9.6 | Google Chrome Skia Integer OverflowInteger overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially… | Exploited |
| CVE-2017-6742 | 17 Jul 2017 | CVSS 8.8 | Cisco IOS and IOS XE Software SNMP Remote Code ExecutionA vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely… | Exploited |
| CVE-2023-2033 | 14 Apr 2023 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2019-8526 | 18 Dec 2019 | CVSS 7.8 | Apple macOS Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain… | Exploited |
| CVE-2023-29492 | 11 Apr 2023 | CVSS 9.8 | Novi Survey Insecure DeserializationNovi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not… | Exploited |
| CVE-2023-20963 | 24 Mar 2023 | CVSS 7.8 | Android Framework Privilege EscalationIn WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed… | ExploitedFix |
| CVE-2023-28252 | 11 Apr 2023 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-28206 | 10 Apr 2023 | CVSS 8.6 | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS… | Exploited |
| CVE-2023-28205 | 10 Apr 2023 | CVSS 8.8 | Apple Multiple Products WebKit Use-After-FreeA use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1… | Exploited |
| CVE-2023-26083 | 6 Apr 2023 | CVSS 3.3 | Arm Mali GPU Kernel Driver Information DisclosureMemory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all… | Exploited |
| CVE-2021-27878 | 1 Mar 2021 | CVSS 8.8 | Veritas Backup Exec Agent Command ExecutionAn issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which… | Exploited |
| CVE-2021-27877 | 1 Mar 2021 | CVSS 9.8 | Veritas Backup Exec Agent Improper AuthenticationAn issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This… | Exploited |
| CVE-2021-27876 | 1 Mar 2021 | CVSS 8.1 | Veritas Backup Exec Agent File AccessAn issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which… | Exploited |
| CVE-2019-1388 | 12 Nov 2019 | CVSS 7.8 | Microsoft Windows Certificate Dialog Privilege EscalationAn elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows… | ExploitedFix |
| CVE-2022-27926 | 21 Apr 2022 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows… | Exploited |
| CVE-2023-0266 | 30 Jan 2023 | CVSS 7.0 | Linux Kernel Use-After-FreeA use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be… | ExploitedFix |
| CVE-2022-42948 | 24 Mar 2023 | CVSS 9.8 | Fortra Cobalt Strike User Interface Remote Code ExecutionCobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to… | Exploited |
| CVE-2022-39197 | 22 Sep 2022 | CVSS 6.1 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS)An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the… | Exploited |
| CVE-2022-38181 | 25 Oct 2022 | CVSS 8.8 | Arm Mali GPU Kernel Driver Use-After-FreeThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost… | Exploited |
| CVE-2022-3038 | 26 Sep 2022 | CVSS 8.8 | Google Chromium Network Service Use-After-FreeUse after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2022-22706 | 3 Mar 2022 | CVSS 7.8 | Arm Mali GPU Kernel Driver UnspecifiedArm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0… | Exploited |
| CVE-2021-30900 | 24 Aug 2021 | CVSS 7.8 | Apple iOS, iPadOS, and macOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS… | Exploited |
| CVE-2017-7494 | 30 May 2017 | CVSS 9.8 | Samba Remote Code ExecutionSamba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to… | ExploitedFix |
| CVE-2013-3163 | 10 Jul 2013 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionMicrosoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… | ExploitedFix |
| CVE-2023-26360 | 23 Mar 2023 | CVSS 8.6 | Adobe ColdFusion Deserialization of Untrusted DataAdobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that… | ExploitedFix |
| CVE-2023-24880 | 14 Mar 2023 | CVSS 4.4 | Microsoft Windows SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-23397 | 14 Mar 2023 | CVSS 9.8 | Microsoft Office Outlook Privilege EscalationMicrosoft Outlook Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41328 | 7 Mar 2023 | CVSS 7.1 | Fortinet FortiOS Path TraversalA improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through… | Exploited |
| CVE-2021-39144 | 23 Aug 2021 | CVSS 8.5 | XStream Remote Code ExecutionXStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has… | ExploitedFix |
| CVE-2020-5741 | 8 May 2020 | CVSS 7.2 | Plex Media Server Remote Code ExecutionDeserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. | Exploited |
| CVE-2022-35914 | 19 Sep 2022 | CVSS 9.8 | Teclib GLPI Remote Code Execution/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. | ExploitedFix |
| CVE-2022-33891 | 18 Jul 2022 | CVSS 8.8 | Apache Spark Command InjectionThe Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks… | Exploited |
| CVE-2022-28810 | 18 Apr 2022 | CVSS 6.8 | Zoho ManageEngine ADSelfService Plus Remote Code ExecutionZoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as… | ExploitedFix |
| CVE-2022-36537 | 26 Aug 2022 | CVSS 7.5 | ZK Framework AuUploader UnspecifiedZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the… | ExploitedFix |
| CVE-2022-47986 | 17 Feb 2023 | CVSS 9.8 | IBM Aspera Faspex Code ExecutionIBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML… | ExploitedFix |
| CVE-2022-41223 | 22 Nov 2022 | CVSS 6.8 | Mitel MiVoice Connect Code InjectionThe Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection… | Exploited |
| CVE-2022-40765 | 22 Nov 2022 | CVSS 6.8 | Mitel MiVoice Connect Command InjectionA vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with… | Exploited |
| CVE-2022-46169 | 5 Dec 2022 | CVSS 9.8 | Cacti Command InjectionCacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected… | ExploitedFix |
| CVE-2023-23529 | 27 Feb 2023 | CVSS 8.8 | Apple Multiple Products WebKit Type ConfusionA type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS… | Exploited |
| CVE-2023-23376 | 14 Feb 2023 | CVSS 7.8 | Microsoft Windows Common Log File System (CLFS) Driver Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2023-21823 | 14 Feb 2023 | CVSS 7.8 | Microsoft Windows Graphic Component Privilege EscalationWindows Graphics Component Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2023-21715 | 14 Feb 2023 | CVSS 7.3 | Microsoft Office Publisher Security Feature BypassMicrosoft Publisher Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2023-0669 | 6 Feb 2023 | CVSS 7.2 | Fortra GoAnywhere MFT Remote Code ExecutionFortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due… | ExploitedFix |
| CVE-2022-24990 | 7 Feb 2023 | CVSS 7.5 | TerraMaster OS Remote Command ExecutionTerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to… | Exploited |
| CVE-2015-2291 | 9 Aug 2017 | CVSS 7.8 | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a… | ExploitedFix |
| CVE-2023-22952 | 11 Jan 2023 | CVSS 8.8 | Multiple SugarCRM Products Remote Code ExecutionIn SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. | Exploited |
| CVE-2022-21587 | 18 Oct 2022 | CVSS 9.8 | Oracle E-Business Suite UnspecifiedVulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are… | ExploitedFix |
| CVE-2017-11357 | 23 Aug 2017 | CVSS 9.8 | Telerik UI for ASP.NET AJAX Insecure Direct Object ReferenceProgress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to… | Exploited |
| CVE-2022-47966 | 18 Jan 2023 | CVSS 9.8 | Zoho ManageEngine Multiple Products Remote Code ExecutionMultiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario… | ExploitedFix |
| CVE-2022-44877 | 5 Jan 2023 | CVSS 9.8 | CWP Control Web Panel OS Command Injectionlogin/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via… | Exploited |
| CVE-2023-21674 | 10 Jan 2023 | CVSS 8.8 | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege EscalationWindows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2022-41080 | 9 Nov 2022 | CVSS 8.8 | Microsoft Exchange Server Privilege EscalationMicrosoft Exchange Server Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2018-5430 | 17 Apr 2018 | CVSS 8.8 | TIBCO JasperReports Server Information DisclosureThe Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server… | Exploited |
| CVE-2018-18809 | 7 Mar 2019 | CVSS 6.5 | TIBCO JasperReports Library Directory TraversalThe default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO… | Exploited |
| CVE-2022-42856 | 15 Dec 2022 | CVSS 8.8 | Apple iOS Type ConfusionA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and… | Exploited |
| CVE-2022-44698 | 13 Dec 2022 | CVSS 5.4 | Microsoft Defender SmartScreen Security Feature BypassWindows SmartScreen Security Feature Bypass Vulnerability | ExploitedFix |
| CVE-2022-42475 | 2 Jan 2023 | CVSS 9.8 | Fortinet FortiOS Heap-Based Buffer OverflowA heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through… | Exploited |
| CVE-2022-27518 | 13 Dec 2022 | CVSS 9.8 | Citrix Application Delivery Controller (ADC) and Gateway Authentication BypassUnauthenticated remote arbitrary code execution | Exploited |
| CVE-2022-26501 | 17 Mar 2022 | CVSS 9.8 | Veeam Backup & Replication Remote Code ExecutionVeeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). | Exploited |
| CVE-2022-26500 | 17 Mar 2022 | CVSS 8.8 | Veeam Backup & Replication Remote Code ExecutionImproper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API… | Exploited |
| CVE-2022-4262 | 2 Dec 2022 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | ExploitedFix |
| CVE-2022-4135 | 25 Nov 2022 | CVSS 9.6 | Google Chromium GPU Heap Buffer OverflowHeap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to… | Exploited |
| CVE-2021-35587 | 19 Jan 2022 | CVSS 9.8 | Oracle Fusion Middleware UnspecifiedVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are… | Exploited |
| CVE-2022-41049 | 9 Nov 2022 | CVSS 5.4 | Microsoft Windows Mark of the Web (MOTW) Security Feature BypassWindows Mark of the Web Security Feature Bypass Vulnerability | ExploitedFix |
Page 9 of 18