CISA KEV Catalog

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacke

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software al

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path tr

NTLM Hash Disclosure Spoofing Vulnerability

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco F

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with ad

Windows MSHTML Platform Spoofing Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) per

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoin

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious act

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator cred

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML atta

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-a

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been ava

there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure wi

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craft

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservic

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2,

Windows Mark of the Web Security Feature Bypass Vulnerability

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthen

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauth

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthe

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauth

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Soft

Microsoft WordPad Information Disclosure Vulnerability

Skype for Business Elevation of Privilege Vulnerability

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A mal

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary m

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower

Microsoft Word Information Disclosure Vulnerability

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iP

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attack

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS

Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) conn

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass