CISA KEV Catalog

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, coul

.NET and Visual Studio Denial of Service Vulnerability

The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command inject

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) a

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iP

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or re

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by

Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improp

Unauthenticated remote code execution

Windows Search Remote Code Execution Vulnerability

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6,

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bot

Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft Outlook Security Feature Bypass Vulnerability

Windows MSHTML Platform Elevation of Privilege Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information d

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated rem

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configura

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0,

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safar

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the con

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, W

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been dis

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attack

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corr

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Pat

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Pa

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware vers

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) pro