CISA KEV Catalog

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alre

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploita

An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 E

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicatio

An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker w

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Win

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Window

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loca

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to acce

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code v

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security U

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

Windows User Profile Service Elevation of Privilege Vulnerability

Windows User Profile Service Elevation of Privilege Vulnerability

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Sui

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTC

Windows Print Spooler Elevation of Privilege Vulnerability

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows rem

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers t

The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the if

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.