CISA KEV Catalog

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which ca

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can impo

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could resu

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up

Windows Common Log File System Driver Elevation of Privilege Vulnerability

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail S

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated at

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Pro

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious acto

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Serve

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitra

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software al

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the c

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path tr

Windows Task Scheduler Elevation of Privilege Vulnerability

NTLM Hash Disclosure Spoofing Vulnerability

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypas

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prev

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not su

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco F

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2

Microsoft SharePoint Remote Code Execution Vulnerability

ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party compone

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timeli

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthe

Windows Kernel Elevation of Privilege Vulnerability

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.

An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authen

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with ad

Memory corruption while maintaining memory maps of HLOS memory.

Microsoft Management Console Remote Code Execution Vulnerability