CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2016-9079 KEV |
[KEV] Use-After-Free in Mozilla Firefox, Firefox ESR, and Thunderbird (CVE-2016-9079)
Vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird (CVE-2016-9079). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-44026 KEV |
[KEV] SQL Injection in Roundcube Webmail (CVE-2021-44026)
SQL injection in Roundcube Webmail (CVE-2021-44026). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-12641 KEV |
[KEV] OS Command Injection in Roundcube Webmail (CVE-2020-12641)
OS command injection in Roundcube Webmail (CVE-2020-12641). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-35730 KEV |
[KEV] Cross-Site Scripting (XSS) in Roundcube Webmail (CVE-2020-35730)
Cross-site scripting in Roundcube Webmail (CVE-2020-35730). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-20887 KEV |
[KEV] Command Injection in VMware Aria Operations for Networks (CVE-2023-20887)
Command injection in VMware Aria Operations for Networks (CVE-2023-20887). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-27997 KEV |
[KEV] Vulnerability in Fortinet FortiOS and FortiProxy SSL-VPN (CVE-2023-27997)
Vulnerability in Fortinet FortiOS and FortiProxy SSL-VPN (CVE-2023-27997). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-3079 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2023-3079)
Vulnerability in Google Chromium V8 (CVE-2023-3079). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-33010 KEV |
[KEV] Vulnerability in Zyxel Multiple Firewalls (CVE-2023-33010)
Vulnerability in Zyxel Multiple Firewalls (CVE-2023-33010). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-33009 KEV |
[KEV] Vulnerability in Zyxel Multiple Firewalls (CVE-2023-33009)
Vulnerability in Zyxel Multiple Firewalls (CVE-2023-33009). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-34362 KEV |
[KEV] SQL Injection in Progress MOVEit Transfer (CVE-2023-34362)
SQL injection in Progress MOVEit Transfer (CVE-2023-34362). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28771 KEV |
[KEV] OS Command Injection in Zyxel Multiple Firewalls (CVE-2023-28771)
OS command injection in Zyxel Multiple Firewalls (CVE-2023-28771). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-2868 KEV |
[KEV] Vulnerability in Barracuda Networks Email Security Gateway (ESG) Appliance (CVE-2023-2868)
Vulnerability in Barracuda Networks Email Security Gateway (ESG) Appliance (CVE-2023-2868). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32373 KEV |
[KEV] Use-After-Free in Apple Multiple Products (CVE-2023-32373)
Vulnerability in Apple Multiple Products (CVE-2023-32373). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28204 KEV |
[KEV] Out-of-Bounds Read in Apple Multiple Products (CVE-2023-28204)
Vulnerability in Apple Multiple Products (CVE-2023-28204). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-32409 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-32409)
Vulnerability in Apple Multiple Products (CVE-2023-32409). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21492 KEV |
[KEV] Vulnerability in Samsung Mobile Devices (CVE-2023-21492)
Vulnerability in Samsung Mobile Devices (CVE-2023-21492). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-6415 KEV |
[KEV] Information Disclosure in Cisco IOS, IOS XR, and IOS XE (CVE-2016-6415)
Vulnerability in Cisco IOS, IOS XR, and IOS XE (CVE-2016-6415). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2004-1464 KEV |
[KEV] Vulnerability in Cisco IOS (CVE-2004-1464)
Vulnerability in Cisco IOS (CVE-2004-1464). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-8735 KEV |
[KEV] Vulnerability in Apache Tomcat (CVE-2016-8735)
Vulnerability in Apache Tomcat (CVE-2016-8735). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-3427 KEV |
[KEV] Vulnerability in Oracle Java Se And Jrockit (CVE-2016-3427)
Vulnerability in Oracle Java Se And Jrockit (CVE-2016-3427). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-5317 KEV |
[KEV] Information Disclosure in Jenkins User Interface (UI) (CVE-2015-5317)
Vulnerability in Jenkins User Interface (UI) (CVE-2015-5317). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-3904 KEV |
[KEV] Vulnerability in Linux Kernel (CVE-2010-3904)
Vulnerability in Linux Kernel (CVE-2010-3904). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-0196 KEV |
[KEV] Vulnerability in Linux Kernel (CVE-2014-0196)
Vulnerability in Linux Kernel (CVE-2014-0196). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-3560 KEV |
[KEV] Authorization Flaw in Red Hat Polkit (CVE-2021-3560)
Vulnerability in Red Hat Polkit (CVE-2021-3560). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-25717 KEV |
[KEV] Code Injection in Ruckus Wireless Multiple Products (CVE-2023-25717)
Code injection in Ruckus Wireless Multiple Products (CVE-2023-25717). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29336 KEV |
[KEV] Use-After-Free in Microsoft Win32k (CVE-2023-29336)
Vulnerability in Microsoft Win32k (CVE-2023-29336). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21839 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2023-21839)
Vulnerability in Oracle WebLogic Server (CVE-2023-21839). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-45046 KEV |
[KEV] Unsafe Deserialization in org.apache.logging.log4j:log4j-core (CVE-2021-45046)
Vulnerability in org.apache.logging.log4j:log4j-core (CVE-2021-45046). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2.3.1 or later.
|
|
| CVE-2023-1389 KEV |
[KEV] Command Injection in TP-Link Archer AX21 (CVE-2023-1389)
Command injection in TP-Link Archer AX21 (CVE-2023-1389). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-2136 KEV |
[KEV] Vulnerability in Google Chromium Skia (CVE-2023-2136)
Vulnerability in Google Chromium Skia (CVE-2023-2136). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 13:2023-07-01 or later.
|
|
| CVE-2023-27350 KEV |
[KEV] Vulnerability in PaperCut MF/NG (CVE-2023-27350)
Vulnerability in PaperCut MF/NG (CVE-2023-27350). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28432 KEV |
[KEV] Information Disclosure in MinIO (CVE-2023-28432)
Vulnerability in MinIO (CVE-2023-28432). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-6742 KEV |
[KEV] Buffer Overflow in Cisco IOS and IOS XE Software (CVE-2017-6742)
Vulnerability in Cisco IOS and IOS XE Software (CVE-2017-6742). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-2033 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2023-2033)
Vulnerability in Google Chromium V8 (CVE-2023-2033). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-8526 KEV |
[KEV] Use-After-Free in Apple macOS (CVE-2019-8526)
Vulnerability in Apple macOS (CVE-2019-8526). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29492 KEV |
[KEV] Code Injection in Novi Survey (CVE-2023-29492)
Code injection in Novi Survey (CVE-2023-29492). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-20963 KEV |
[KEV] Vulnerability in Android Framework (CVE-2023-20963)
Vulnerability in Android Framework (CVE-2023-20963). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 13:2023-03-01 or later.
|
|
| CVE-2023-28252 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-28252)
Vulnerability in Microsoft Windows (CVE-2023-28252). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28206 KEV |
[KEV] Out-of-Bounds Write in Apple iOS, iPadOS, and macOS (CVE-2023-28206)
Out-of-bounds write in Apple iOS, iPadOS, and macOS (CVE-2023-28206). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28205 KEV |
[KEV] Use-After-Free in Apple Multiple Products (CVE-2023-28205)
Vulnerability in Apple Multiple Products (CVE-2023-28205). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-26083 KEV |
[KEV] Vulnerability in Arm Mali Graphics Processing Unit (GPU) (CVE-2023-26083)
Vulnerability in Arm Mali Graphics Processing Unit (GPU) (CVE-2023-26083). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-1388 KEV |
[KEV] Privilege Escalation in Microsoft Windows (CVE-2019-1388)
Vulnerability in Microsoft Windows (CVE-2019-1388). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-27878 KEV |
[KEV] Authentication Bypass in Veritas Backup Exec Agent (CVE-2021-27878)
Authentication bypass in Veritas Backup Exec Agent (CVE-2021-27878). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-27877 KEV |
[KEV] Authentication Bypass in Veritas Backup Exec Agent (CVE-2021-27877)
Authentication bypass in Veritas Backup Exec Agent (CVE-2021-27877). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-27876 KEV |
[KEV] Authentication Bypass in Veritas Backup Exec Agent (CVE-2021-27876)
Authentication bypass in Veritas Backup Exec Agent (CVE-2021-27876). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-27926 KEV |
[KEV] Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2022-27926)
Cross-site scripting in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2022-27926). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22706 KEV |
[KEV] Buffer Overflow in Arm Mali Graphics Processing Unit (GPU) (CVE-2022-22706)
Vulnerability in Arm Mali Graphics Processing Unit (GPU) (CVE-2022-22706). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2023-06-05 or later.
|
|
| CVE-2022-3038 KEV |
[KEV] Use-After-Free in Google Chromium Network Service (CVE-2022-3038)
Vulnerability in Google Chromium Network Service (CVE-2022-3038). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-0266 KEV |
[KEV] Use-After-Free in Linux Kernel (CVE-2023-0266)
Vulnerability in Linux Kernel (CVE-2023-0266). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-38181 KEV |
[KEV] Use-After-Free in Arm Mali Graphics Processing Unit (GPU) (CVE-2022-38181)
Vulnerability in Arm Mali Graphics Processing Unit (GPU) (CVE-2022-38181). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2023-04-05 or later.
|
