CISA KEV Catalog

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as e

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security rest

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary s

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a us

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbe

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH clien

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The p

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API com

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploi

Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromi

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary co

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command i

A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inpu

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated,

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corru

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands vi

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow r

Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a co

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacke

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow a

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software coul

Microsoft Exchange Remote Code Execution Vulnerability

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aw

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of t

An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'W

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka '

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the softwar

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploit