CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2017-6884 KEV |
[KEV] OS Command Injection in Zyxel EMG2926 Routers (CVE-2017-6884)
OS command injection in Zyxel EMG2926 Routers (CVE-2017-6884). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-8361 KEV |
[KEV] Vulnerability in Realtek SDK (CVE-2014-8361)
Vulnerability in Realtek SDK (CVE-2014-8361). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22265 KEV |
[KEV] Vulnerability in Samsung Mobile Devices (CVE-2022-22265)
Vulnerability in Samsung Mobile Devices (CVE-2022-22265). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-26369 KEV |
[KEV] Out-of-Bounds Write in Adobe Acrobat and Reader (CVE-2023-26369)
Out-of-bounds write in Adobe Acrobat and Reader (CVE-2023-26369). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-4863 KEV |
[KEV] Out-of-Bounds Write in Google Chromium WebP (CVE-2023-4863)
Out-of-bounds write in Google Chromium WebP (CVE-2023-4863). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 0.1.8 or later.
|
|
| CVE-2023-20269 KEV |
[KEV] Vulnerability in Cisco Adaptive Security Appliance and Firepower Threat Defense (CVE-2023-20269)
Vulnerability in Cisco Adaptive Security Appliance and Firepower Threat Defense (CVE-2023-20269). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-35674 KEV |
[KEV] Vulnerability in Android Framework (CVE-2023-35674)
Vulnerability in Android Framework (CVE-2023-35674). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 13:2023-09-01 or later.
|
|
| CVE-2023-36802 KEV |
[KEV] Use-After-Free in Microsoft Streaming Service Proxy (CVE-2023-36802)
Vulnerability in Microsoft Streaming Service Proxy (CVE-2023-36802). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36761 KEV |
[KEV] Vulnerability in Microsoft Word (CVE-2023-36761)
Vulnerability in Microsoft Word (CVE-2023-36761). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41061 KEV |
[KEV] Vulnerability in Apple iOS, iPadOS, and watchOS (CVE-2023-41061)
Vulnerability in Apple iOS, iPadOS, and watchOS (CVE-2023-41061). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41064 KEV |
[KEV] Vulnerability in Apple iOS, iPadOS, and macOS (CVE-2023-41064)
Vulnerability in Apple iOS, iPadOS, and macOS (CVE-2023-41064). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-33246 KEV |
[KEV] Code Injection in Apache RocketMQ (CVE-2023-33246)
Code injection in Apache RocketMQ (CVE-2023-33246). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32315 KEV |
[KEV] Path Traversal in Ignite Realtime Openfire (CVE-2023-32315)
Path traversal in Ignite Realtime Openfire (CVE-2023-32315). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-38831 KEV |
[KEV] Vulnerability in RARLAB WinRAR (CVE-2023-38831)
Vulnerability in RARLAB WinRAR (CVE-2023-38831). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-27532 KEV |
[KEV] Vulnerability in Veeam Backup & Replication (CVE-2023-27532)
Vulnerability in Veeam Backup & Replication (CVE-2023-27532). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-38035 KEV |
[KEV] Authorization Flaw in Ivanti Sentry (CVE-2023-38035)
Vulnerability in Ivanti Sentry (CVE-2023-38035). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-26359 KEV |
[KEV] Unsafe Deserialization in Adobe ColdFusion (CVE-2023-26359)
Vulnerability in Adobe ColdFusion (CVE-2023-26359). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-24489 KEV |
[KEV] Vulnerability in Citrix Content Collaboration (CVE-2023-24489)
Vulnerability in Citrix Content Collaboration (CVE-2023-24489). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-38180 KEV |
[KEV] Vulnerability in Microsoft .NET Core and Visual Studio (CVE-2023-38180)
Vulnerability in Microsoft .NET Core and Visual Studio (CVE-2023-38180). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-18368 KEV |
[KEV] OS Command Injection in Zyxel P660HN-T1A Routers (CVE-2017-18368)
OS command injection in Zyxel P660HN-T1A Routers (CVE-2017-18368). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-35081 KEV |
[KEV] Path Traversal in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2023-35081)
Path traversal in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2023-35081). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-37580 KEV |
[KEV] Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2023-37580)
Cross-site scripting in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2023-37580). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-38606 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-38606)
Vulnerability in Apple Multiple Products (CVE-2023-38606). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-35078 KEV |
[KEV] Authentication Bypass in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2023-35078)
Authentication bypass in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2023-35078). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-38205 KEV |
[KEV] Vulnerability in Adobe ColdFusion (CVE-2023-38205)
Vulnerability in Adobe ColdFusion (CVE-2023-38205). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29298 KEV |
[KEV] Vulnerability in Adobe ColdFusion (CVE-2023-29298)
Vulnerability in Adobe ColdFusion (CVE-2023-29298). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-3519 KEV |
[KEV] Code Injection in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519)
Code injection in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36884 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-36884)
Vulnerability in Microsoft Windows (CVE-2023-36884). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-37450 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-37450)
Vulnerability in Apple Multiple Products (CVE-2023-37450). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-29303 KEV |
[KEV] OS Command Injection in SolarView Compact (CVE-2022-29303)
OS command injection in SolarView Compact (CVE-2022-29303). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-31199 KEV |
[KEV] Unsafe Deserialization in Netwrix Auditor (CVE-2022-31199)
Vulnerability in Netwrix Auditor (CVE-2022-31199). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36874 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-36874)
Vulnerability in Microsoft Windows (CVE-2023-36874). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-35311 KEV |
[KEV] Vulnerability in Microsoft Outlook (CVE-2023-35311)
Vulnerability in Microsoft Outlook (CVE-2023-35311). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32049 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-32049)
Vulnerability in Microsoft Windows (CVE-2023-32049). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32046 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-32046)
Vulnerability in Microsoft Windows (CVE-2023-32046). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-29256 KEV |
[KEV] Use-After-Free in Arm Mali Graphics Processing Unit (GPU) (CVE-2021-29256)
Vulnerability in Arm Mali Graphics Processing Unit (GPU) (CVE-2021-29256). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2023-07-05 or later.
|
|
| CVE-2021-25372 KEV |
[KEV] Out-of-Bounds Write in Samsung Mobile Devices (CVE-2021-25372)
Out-of-bounds write in Samsung Mobile Devices (CVE-2021-25372). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25371 KEV |
[KEV] Vulnerability in Samsung Mobile Devices (CVE-2021-25371)
Vulnerability in Samsung Mobile Devices (CVE-2021-25371). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25395 KEV |
[KEV] Vulnerability in Samsung Mobile Devices (CVE-2021-25395)
Vulnerability in Samsung Mobile Devices (CVE-2021-25395). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25394 KEV |
[KEV] Use-After-Free in Samsung Mobile Devices (CVE-2021-25394)
Vulnerability in Samsung Mobile Devices (CVE-2021-25394). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25489 KEV |
[KEV] Vulnerability in Samsung Mobile Devices (CVE-2021-25489)
Vulnerability in Samsung Mobile Devices (CVE-2021-25489). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-25487 KEV |
[KEV] Out-of-Bounds Read in Samsung Mobile Devices (CVE-2021-25487)
Vulnerability in Samsung Mobile Devices (CVE-2021-25487). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-20500 KEV |
[KEV] OS Command Injection in D-Link DWL-2600AP Access Point (CVE-2019-20500)
OS command injection in D-Link DWL-2600AP Access Point (CVE-2019-20500). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-17621 KEV |
[KEV] OS Command Injection in D-Link DIR-859 Router (CVE-2019-17621)
OS command injection in D-Link DIR-859 Router (CVE-2019-17621). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-27992 KEV |
[KEV] OS Command Injection in Zyxel Multiple Network-Attached Storage (NAS) Devices (CVE-2023-27992)
OS command injection in Zyxel Multiple Network-Attached Storage (NAS) Devices (CVE-2023-27992). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-20867 KEV |
[KEV] Authentication Bypass in VMware Tools (CVE-2023-20867)
Authentication bypass in VMware Tools (CVE-2023-20867). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32439 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-32439)
Vulnerability in Apple Multiple Products (CVE-2023-32439). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32435 KEV |
[KEV] Out-of-Bounds Write in Apple Multiple Products (CVE-2023-32435)
Out-of-bounds write in Apple Multiple Products (CVE-2023-32435). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32434 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-32434)
Vulnerability in Apple Multiple Products (CVE-2023-32434). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-0165 KEV |
[KEV] Vulnerability in Microsoft Win32k (CVE-2016-0165)
Vulnerability in Microsoft Win32k (CVE-2016-0165). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
