Lucene search
+L
Cisa KevMost viewed

1678 matches found

CISA KEV Catalog
CISA KEV Catalog
added 2025/12/17 12:0 a.m.27 views

SonicWall SMA1000 Missing Authorization Vulnerability

SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console AMC of affected devices...

6.6CVSS7AI score0.02114EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2025/10/24 12:0 a.m.27 views

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API...

9.1CVSS7AI score0.94532EPSS
SaveExploits9
CISA KEV Catalog
CISA KEV Catalog
added 2025/10/15 12:0 a.m.27 views

Adobe Experience Manager Forms Code Execution Vulnerability

Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution...

10CVSS7.8AI score0.87515EPSS
SaveExploits7
CISA KEV Catalog
CISA KEV Catalog
added 2025/06/25 12:0 a.m.27 views

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key...

6.5CVSS7AI score0.05617EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2025/05/19 12:0 a.m.27 views

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Zimbra Collaboration contains a cross-site scripting XSS vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript...

6.1CVSS5.9AI score0.23632EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2025/03/03 12:0 a.m.27 views

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution...

8.8CVSS7.3AI score0.9767EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
added 2025/02/24 12:0 a.m.27 views

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Oracle Agile Product Lifecycle Management PLM contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system...

8.8CVSS6.5AI score0.03934EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2025/02/20 12:0 a.m.27 views

Palo Alto Networks PAN-OS File Read Vulnerability

Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user...

7.1CVSS6.3AI score0.0196EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2024/11/21 12:0 a.m.27 views

Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

Oracle Agile Product Lifecycle Management PLM contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure...

7.5CVSS6.8AI score0.01496EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2024/11/14 12:0 a.m.27 views

Palo Alto Networks Expedition OS Command Injection Vulnerability

Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

9.9CVSS7.7AI score0.98494EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2024/03/06 12:0 a.m.27 views

Apple Multiple Products Memory Corruption Vulnerability

Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections...

7.8CVSS7.4AI score0.01411EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2024/02/22 12:0 a.m.27 views

ConnectWise ScreenConnect Authentication Bypass Vulnerability

ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices...

10CVSS7.3AI score0.99959EPSS
SaveExploits10
CISA KEV Catalog
CISA KEV Catalog
added 2023/06/29 12:0 a.m.27 views

D-Link DIR-859 Router Command Execution Vulnerability

D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local...

10CVSS7.6AI score0.89624EPSS
SaveExploits8
CISA KEV Catalog
CISA KEV Catalog
added 2023/03/30 12:0 a.m.27 views

Google Chromium Network Service Use-After-Free Vulnerability

Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsof...

8.8CVSS8.8AI score0.24738EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2022/05/23 12:0 a.m.27 views

WhatsApp Cross-Site Scripting Vulnerability

A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading...

8.2CVSS1.7AI score0.67859EPSS
SaveExploits5
CISA KEV Catalog
CISA KEV Catalog
added 2022/04/11 12:0 a.m.27 views

QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution...

9.8CVSS6AI score0.33381EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2022/03/28 12:0 a.m.27 views

Microsoft Windows Event Tracing Privilege Escalation Vulnerability

Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation...

7.8CVSS3.9AI score0.09253EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2022/03/25 12:0 a.m.27 views

phpMyAdmin Remote Code Execution Vulnerability

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file...

9.8CVSS2.1AI score0.95438EPSS
SaveExploits17
CISA KEV Catalog
CISA KEV Catalog
added 2022/03/15 12:0 a.m.27 views

Microsoft Windows Kernel Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode...

7.8CVSS3AI score0.20625EPSS
SaveExploits8
CISA KEV Catalog
CISA KEV Catalog
added 2022/03/07 12:0 a.m.27 views

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution...

9.8CVSS4.9AI score0.84621EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
added 2022/03/03 12:0 a.m.27 views

Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

There is a vulnerability in the implementation of the Common Industrial Protocol CIP feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service...

7.8CVSS5AI score0.07128EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2022/03/03 12:0 a.m.27 views

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code...

9CVSS4.3AI score0.70559EPSS
SaveExploits8
CISA KEV Catalog
CISA KEV Catalog
added 2022/01/10 12:0 a.m.27 views

Exim Mail Transfer Agent (MTA) Improper Input Validation

Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution...

10CVSS4.1AI score0.99961EPSS
SaveExploits27
CISA KEV Catalog
CISA KEV Catalog
added 2022/01/10 12:0 a.m.27 views

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem...

9.8CVSS3.2AI score0.39824EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
added 2021/12/10 12:0 a.m.27 views

Fortinet FortiOS Arbitrary File Download

Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files...

7.8CVSS3.9AI score0.00873EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
added 2021/12/01 12:0 a.m.27 views

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

7.8CVSS1.5AI score0.01772EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/17 12:0 a.m.27 views

ExifTool Remote Code Execution Vulnerability

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...

7.8CVSS8.1AI score0.99982EPSS
SaveExploits38
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/17 12:0 a.m.27 views

Microsoft Windows Win32k Privilege Escalation Vulnerability

Unspecified vulnerability allows for an authenticated user to escalate privileges...

7.8CVSS3.7AI score0.74129EPSS
SaveExploits11
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/17 12:0 a.m.27 views

Microsoft Excel Security Feature Bypass

A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution...

7.8CVSS2.9AI score0.43277EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Google Chromium V8 Type Confusion Vulnerability

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge...

8.8CVSS8.8AI score0.48574EPSS
SaveExploits3
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Google Chromium V8 Incorrect Implementation Vulnerabililty

Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,...

8.8CVSS8.9AI score0.02826EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode...

7.8CVSS7.3AI score0.4523EPSS
SaveExploits26
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database RDB products contain an unspecified vulnerability that allows for remote code execution...

9.8CVSS9.5AI score0.99737EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

VMware vCenter Server File Upload Vulnerability

VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code...

9.8CVSS9.1AI score0.99999EPSS
SaveExploits11
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...

9.8CVSS8.8AI score0.99996EPSS
SaveExploits65
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...

7.8CVSS8.8AI score0.93651EPSS
SaveExploits3
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Drupal Core Remote Code Execution Vulnerability

Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise...

9.8CVSS9.4AI score0.99995EPSS
SaveExploits49
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Google Chromium WebGL Use-After-Free Vulnerability

Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, an...

8.8CVSS8.8AI score0.07367EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution...

8.8CVSS8AI score0.9745EPSS
SaveExploits38
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office contains an unspecified vulnerability that allows for remote code execution...

8.5CVSS7.7AI score0.06076EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Adobe Acrobat and Reader Use-After-Free Vulnerability

Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user...

9.6CVSS8.6AI score0.52005EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
added 2021/11/03 12:0 a.m.27 views

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function LoadSBitPng when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and...

9.6CVSS8AI score0.44303EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
added 2026/07/10 12:0 a.m.26 views

Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE...

10CVSS6.2AI score0.76066EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
added 2026/03/26 12:0 a.m.26 views

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory...

9.4CVSS6.1AI score0.59164EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
added 2026/01/26 12:0 a.m.26 views

Microsoft Office Security Feature Bypass Vulnerability

Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted products could be end-of-life EoL and/or end-of-servic...

7.8CVSS7.3AI score0.72152EPSS
SaveExploits15
CISA KEV Catalog
CISA KEV Catalog
added 2025/12/05 12:0 a.m.26 views

Meta React Server Components Remote Code Execution Vulnerability

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with...

10CVSS7.9AI score0.99616EPSS
SaveExploits398
CISA KEV Catalog
CISA KEV Catalog
added 2025/09/02 12:0 a.m.26 views

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device...

5.4CVSS7.1AI score0.04207EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
added 2025/08/12 12:0 a.m.26 views

Microsoft Internet Explorer Resource Management Errors Vulnerability

Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

9.3CVSS8.2AI score0.8593EPSS
SaveExploits17
CISA KEV Catalog
CISA KEV Catalog
added 2025/07/02 12:0 a.m.26 views

Google Chromium V8 Type Confusion Vulnerability

Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Ope...

8.1CVSS7AI score0.12723EPSS
SaveExploits5
CISA KEV Catalog
CISA KEV Catalog
added 2025/06/25 12:0 a.m.26 views

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...

10CVSS7.4AI score0.60826EPSS
SaveExploits0
Total number of security vulnerabilities1678