CISA KEV Catalog

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastruct

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary cod

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoin

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious act

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML E

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vu

Windows Hyper-V Elevation of Privilege Vulnerability

Windows MSHTML Platform Spoofing Vulnerability

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator cred

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML atta

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle scr

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-a

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gai

Windows Error Reporting Service Elevation of Privilege Vulnerability

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege wi

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows,

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local pr

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected

Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name

Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds

Windows MSHTML Platform Security Feature Bypass Vulnerability

Windows DWM Core Library Elevation of Privilege Vulnerability

Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the ren

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.

SmartScreen Prompt Security Feature Bypass Vulnerability

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Fir

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been ava

Windows Print Spooler Elevation of Privilege Vulnerability

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Netwo

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege wi

there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure wi

Microsoft SharePoint Server Remote Code Execution Vulnerability

Linear eMerge E3-Series devices allow Command Injections.

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS versio

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, i