CISA KEV Catalog

Windows MSHTML Platform Spoofing Vulnerability

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9,

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 181

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a cr

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted func

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 a

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Window

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r

Windows MSHTML Platform Spoofing Vulnerability

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo

Windows Installer Elevation of Privilege Vulnerability

Microsoft Publisher Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially lea

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the D

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the W

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially expl

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are re

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only avai

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

Microsoft Exchange Server Remote Code Execution Vulnerability

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that,

Microsoft Project Remote Code Execution Vulnerability

Windows Power Dependency Coordinator Elevation of Privilege Vulnerability

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Scripting Engine Memory Corruption Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negati

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) per

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platfo

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earl