Lucene search
+L
Cisa KevMost viewed

1678 matches found

CISA KEV Catalog
CISA KEV Catalog
•added 2025/11/12 12:00 a.m.•32 views

Gladinet Triofox Improper Access Control Vulnerability

Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete...

9.1CVSS6.9AI score0.90532EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2025/06/25 12:00 a.m.•32 views

D-Link DIR-859 Router Path Traversal Vulnerability

D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling...

9.8CVSS7.8AI score0.82714EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2025/06/09 12:00 a.m.•32 views

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution RCE. By exploiting a flaw in how SSH protocol...

10CVSS10AI score0.98594EPSS
SaveExploits38
CISA KEV Catalog
CISA KEV Catalog
•added 2025/05/06 12:00 a.m.•32 views

FreeType Out-of-Bounds Write Vulnerability

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution...

8.1CVSS7.9AI score0.27775EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2025/03/18 12:00 a.m.•32 views

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests...

8.1CVSS7.8AI score0.03579EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2025/03/10 12:00 a.m.•32 views

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti Endpoint Manager EPM contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information...

9.8CVSS7.2AI score0.99847EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2025/02/11 12:00 a.m.•32 views

Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges...

7.8CVSS7.3AI score0.01537EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2025/01/08 12:00 a.m.•32 views

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution...

9CVSS8.7AI score0.99971EPSS
SaveExploits14
CISA KEV Catalog
CISA KEV Catalog
•added 2024/03/05 12:00 a.m.•32 views

Sunhillo SureLine OS Command Injection Vulnerablity

Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi...

10CVSS7.7AI score0.97599EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2024/03/05 12:00 a.m.•32 views

Android Pixel Information Disclosure Vulnerability

Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information...

6.2CVSS6.6AI score0.00264EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2023/07/20 12:00 a.m.•32 views

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass...

7.5CVSS6.9AI score0.99757EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2023/06/29 12:00 a.m.•32 views

D-Link DWL-2600AP Access Point Command Injection Vulnerability

D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=configsave configBackup or downloadServerip parameter...

7.8CVSS7.6AI score0.97109EPSS
SaveExploits3
CISA KEV Catalog
CISA KEV Catalog
•added 2022/08/04 12:00 a.m.•32 views

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Synacor Zimbra Collaboration Suite ZCS allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries...

7.5CVSS7.7AI score0.85398EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2022/05/24 12:00 a.m.•32 views

Microsoft Windows SMBv1 Information Disclosure Vulnerability

The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet...

7.5CVSS4.2AI score0.99693EPSS
SaveExploits22
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/31 12:00 a.m.•32 views

Trend Micro Apex Central Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution...

9.8CVSS4.2AI score0.19633EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/28 12:00 a.m.•32 views

Google Chromium V8 Type Confusion Vulnerability

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge...

8.8CVSS8.8AI score0.23633EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/25 12:00 a.m.•32 views

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands...

9.8CVSS9.1AI score0.99906EPSS
SaveExploits19
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/15 12:00 a.m.•32 views

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation...

7.8CVSS4.4AI score0.2995EPSS
SaveExploits25
CISA KEV Catalog
CISA KEV Catalog
•added 2022/01/21 12:00 a.m.•32 views

SolarWinds Serv-U Improper Input Validation Vulnerability

SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization...

5.3CVSS6.4AI score0.03453EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

TeamViewer Desktop Bypass Remote Login Vulnerability

TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended...

7CVSS7.1AI score0.04707EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

VMware vCenter Server Remote Code Execution Vulnerability

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system...

10CVSS9.6AI score0.99518EPSS
SaveExploits48
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Cisco IOS XR Distance Vector Multicast Routing Protocol DVMRP incorrectly handles Internet Group Management Protocol IGMP packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash...

8.6CVSS7.3AI score0.0332EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution...

9CVSS8.5AI score0.99965EPSS
SaveExploits29
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 BIG-IP Traffic Management User Interface TMUI contains a remote code execution vulnerability in undisclosed pages...

10CVSS9.4AI score0.99999EPSS
SaveExploits62
CISA KEV Catalog
CISA KEV Catalog
•added 2026/05/26 12:00 a.m.•31 views

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges...

10CVSS6.2AI score0.18914EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2026/05/22 12:00 a.m.•31 views

Drupal Core SQL Injection Vulnerability

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API...

9.8CVSS6.7AI score0.88319EPSS
SaveExploits16
CISA KEV Catalog
CISA KEV Catalog
•added 2026/05/20 12:00 a.m.•31 views

Microsoft DirectX NULL Byte Overwrite Vulnerability

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file...

9.3CVSS6.2AI score0.51207EPSS
SaveExploits7
CISA KEV Catalog
CISA KEV Catalog
•added 2026/04/20 12:00 a.m.•31 views

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow...

5.4CVSS7.7AI score0.24585EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2025/07/22 12:00 a.m.•31 views

Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust...

9.8CVSS8.9AI score0.99983EPSS
SaveExploits42
CISA KEV Catalog
CISA KEV Catalog
•added 2025/06/02 12:00 a.m.•31 views

ASUS Routers Improper Authentication Vulnerability

ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

9.8CVSS9.9AI score0.99393EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2025/05/15 12:00 a.m.•31 views

Google Chromium Loader Insufficient Policy Enforcement Vulnerability

Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page...

4.3CVSS6.8AI score
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2025/04/28 12:00 a.m.•31 views

Commvault Web Server Unspecified Vulnerability

Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells...

8.8CVSS8.6AI score0.02089EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2025/02/18 12:00 a.m.•31 views

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts...

9.1CVSS9.6AI score0.98455EPSS
SaveExploits8
CISA KEV Catalog
CISA KEV Catalog
•added 2025/02/11 12:00 a.m.•31 views

Zyxel DSL CPE OS Command Injection Vulnerability

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet...

8.8CVSS7.8AI score0.21829EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2025/02/06 12:00 a.m.•31 views

7-Zip Mark of the Web Bypass Vulnerability

7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user...

7CVSS8AI score0.67071EPSS
SaveExploits8
CISA KEV Catalog
CISA KEV Catalog
•added 2024/12/18 12:00 a.m.•31 views

Reolink RLC-410W IP Camera OS Command Injection Vulnerability

Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality...

9.1CVSS7.2AI score0.47635EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2024/11/04 12:00 a.m.•31 views

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference IDOR vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root...

9.1CVSS8.4AI score0.8204EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2024/09/17 12:00 a.m.•31 views

Adobe Flash Player Double Free Vulnerablity

Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code...

10CVSS7.6AI score0.24204EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2024/03/06 12:00 a.m.•31 views

Apple Multiple Products Memory Corruption Vulnerability

Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections...

7.8CVSS7.4AI score0.01481EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2023/06/29 12:00 a.m.•31 views

Samsung Mobile Devices Out-of-Bounds Read Vulnerability

Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in setskbpriv, leading to remote code execution by dereference of an invalid function pointer...

7.8CVSS8AI score0.00635EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2023/04/07 12:00 a.m.•31 views

Veritas Backup Exec Agent Command Execution Vulnerability

Veritas Backup Exec BE Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine...

9CVSS9.2AI score0.23952EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2022/06/08 12:00 a.m.•31 views

Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges...

9CVSS7.2AI score0.05979EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/06/08 12:00 a.m.•31 views

Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

The Universal 3D U3D component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service DoS...

10CVSS9.7AI score0.86563EPSS
SaveExploits11
CISA KEV Catalog
CISA KEV Catalog
•added 2022/06/08 12:00 a.m.•31 views

Google Chromium V8 Out-of-Bounds Memory Vulnerability

Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limit...

8.8CVSS8.3AI score0.34814EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/25 12:00 a.m.•31 views

Sitecore XP Remote Command Execution Vulnerability

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution...

10CVSS4.3AI score0.97904EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:00 a.m.•31 views

Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

A vulnerability in the Bidirectional Forwarding Detection BFD offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service DoS condition...

8.6CVSS2.6AI score0.07793EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:00 a.m.•31 views

Oracle Java SE Integrity Check Vulnerability

Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment...

5.3CVSS6.6AI score0.13354EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:00 a.m.•31 views

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code...

10CVSS4.6AI score0.96714EPSS
SaveExploits13
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:00 a.m.•31 views

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or...

10CVSS7.3AI score0.14863EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:00 a.m.•31 views

Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service...

7.8CVSS5.3AI score0.07128EPSS
SaveExploits0
Total number of security vulnerabilities1678