CISA KEV Catalog

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML E

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privilege

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Erro

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Win

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Route

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. T

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE at

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vul

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vu

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated,

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corru

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands vi

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow r

Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a co

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacke

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow a

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software coul

Microsoft Exchange Remote Code Execution Vulnerability

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aw

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of t

An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability