CISA KEV Catalog

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Thi

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corr

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vul

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitra

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local Fil

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 throu

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows o

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary cod

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Wind

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an

Windows Common Log File System Driver Elevation of Privilege Vulnerability

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitra

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Softwa

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use aft

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated u

Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attac

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: be

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allow

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throug

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.c

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticate

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS l

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific condition

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker t

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote at

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual serv

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v