CISA KEV Catalog

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker t

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker t

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker t

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker t

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), a

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a m

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by una

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compati

Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Offi

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation v

Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit hea

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitr

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an

The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute ar

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and o

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 201

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwar

The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple syst

Win32k Elevation of Privilege Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary co

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafte

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperl

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3,

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco