CISA KEV Catalog

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML E

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privilege

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Erro

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Win

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Route

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. T

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE at

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vul

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vu

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via l

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication c

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle req

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.N

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform an

goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevate

Unraid through 6.8.0 allows Remote Code Execution.

Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code wi