CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2015-4068 KEV |
[KEV] Path Traversal in Arcserve Unified Data Protection (UDP) (CVE-2015-4068)
Path traversal in Arcserve Unified Data Protection (UDP) (CVE-2015-4068). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-0752 KEV |
[KEV] Path Traversal in Ruby on Rails (CVE-2016-0752)
Path traversal in Ruby on Rails (CVE-2016-0752). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-10174 KEV |
[KEV] Buffer Overflow in NETGEAR WNR2000v5 Router (CVE-2016-10174)
Vulnerability in NETGEAR WNR2000v5 Router (CVE-2016-10174). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-11021 KEV |
[KEV] OS Command Injection in D-Link DCS-930L Devices (CVE-2016-11021)
OS command injection in D-Link DCS-930L Devices (CVE-2016-11021). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-1555 KEV |
[KEV] Command Injection in NETGEAR Wireless Access Point (WAP) Devices (CVE-2016-1555)
Command injection in NETGEAR Wireless Access Point (WAP) Devices (CVE-2016-1555). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-4171 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2016-4171)
Vulnerability in Adobe Flash Player (CVE-2016-4171). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-7892 KEV |
[KEV] Use-After-Free in Adobe Flash Player (CVE-2016-7892)
Vulnerability in Adobe Flash Player (CVE-2016-7892). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0146 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2017-0146)
Vulnerability in Microsoft Windows (CVE-2017-0146). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-12615 KEV |
[KEV] Unrestricted File Upload in Apache Tomcat (CVE-2017-12615)
Vulnerability in Apache Tomcat (CVE-2017-12615). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-12617 KEV |
[KEV] Unrestricted File Upload in Apache Tomcat (CVE-2017-12617)
Vulnerability in Apache Tomcat (CVE-2017-12617). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-3881 KEV |
[KEV] Vulnerability in Cisco IOS and IOS XE (CVE-2017-3881)
Vulnerability in Cisco IOS and IOS XE (CVE-2017-3881). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-6316 KEV |
[KEV] Vulnerability in Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server (CVE-2017-6316)
Vulnerability in Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server (CVE-2017-6316). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-6334 KEV |
[KEV] OS Command Injection in NETGEAR DGN2200 Devices (CVE-2017-6334)
OS command injection in NETGEAR DGN2200 Devices (CVE-2017-6334). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-0125 KEV |
[KEV] Vulnerability in Cisco VPN Routers (CVE-2018-0125)
Vulnerability in Cisco VPN Routers (CVE-2018-0125). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-0147 KEV |
[KEV] Vulnerability in Cisco Secure Access Control System (ACS) (CVE-2018-0147)
Vulnerability in Cisco Secure Access Control System (ACS) (CVE-2018-0147). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-11138 KEV |
[KEV] OS Command Injection in Quest KACE System Management Appliance (CVE-2018-11138)
OS command injection in Quest KACE System Management Appliance (CVE-2018-11138). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-1273 KEV |
[KEV] Code Injection in VMware Tanzu Spring Data Commons (CVE-2018-1273)
Code injection in VMware Tanzu Spring Data Commons (CVE-2018-1273). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-14839 KEV |
[KEV] OS Command Injection in LG N1A1 NAS (CVE-2018-14839)
OS command injection in LG N1A1 NAS (CVE-2018-14839). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-6961 KEV |
[KEV] OS Command Injection in VMware SD-WAN Edge (CVE-2018-6961)
OS command injection in VMware SD-WAN Edge (CVE-2018-6961). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-8373 KEV |
[KEV] Out-of-Bounds Write in Microsoft Internet Explorer Scripting Engine (CVE-2018-8373)
Out-of-bounds write in Microsoft Internet Explorer Scripting Engine (CVE-2018-8373). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-8414 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2018-8414)
Vulnerability in Microsoft Windows (CVE-2018-8414). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-0903 KEV |
[KEV] Vulnerability in Microsoft Graphics Device Interface (GDI) (CVE-2019-0903)
Vulnerability in Microsoft Graphics Device Interface (GDI) (CVE-2019-0903). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-1003030 KEV |
[KEV] Vulnerability in Jenkins Matrix Project Plugin (CVE-2019-1003030)
Vulnerability in Jenkins Matrix Project Plugin (CVE-2019-1003030). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-10068 KEV |
[KEV] Unsafe Deserialization in Kentico Xperience (CVE-2019-10068)
Vulnerability in Kentico Xperience (CVE-2019-10068). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-11043 KEV |
[KEV] Vulnerability in Php Fastcgi Process Manager Fpm (CVE-2019-11043)
Vulnerability in Php Fastcgi Process Manager Fpm (CVE-2019-11043). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-12989 KEV |
[KEV] SQL Injection in Citrix SD-WAN and NetScaler (CVE-2019-12989)
SQL injection in Citrix SD-WAN and NetScaler (CVE-2019-12989). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-12991 KEV |
[KEV] OS Command Injection in Citrix SD-WAN and NetScaler (CVE-2019-12991)
OS command injection in Citrix SD-WAN and NetScaler (CVE-2019-12991). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-15107 KEV |
[KEV] OS Command Injection in Webmin (CVE-2019-15107)
OS command injection in Webmin (CVE-2019-15107). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-16920 KEV |
[KEV] OS Command Injection in D-Link Multiple Routers (CVE-2019-16920)
OS command injection in D-Link Multiple Routers (CVE-2019-16920). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-2616 KEV |
[KEV] Vulnerability in Oracle BI Publisher (Formerly XML Publisher) (CVE-2019-2616)
Vulnerability in Oracle BI Publisher (Formerly XML Publisher) (CVE-2019-2616). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-6340 KEV |
[KEV] Unsafe Deserialization in Drupal Core (CVE-2019-6340)
Vulnerability in Drupal Core (CVE-2019-6340). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-1631 KEV |
[KEV] Path Traversal in Juniper Junos OS (CVE-2020-1631)
Path traversal in Juniper Junos OS (CVE-2020-1631). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-1956 KEV |
[KEV] OS Command Injection in Apache Kylin (CVE-2020-1956)
OS command injection in Apache Kylin (CVE-2020-1956). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-2021 KEV |
[KEV] Vulnerability in Palo Alto Networks PAN-OS (CVE-2020-2021)
Vulnerability in Palo Alto Networks PAN-OS (CVE-2020-2021). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-2506 KEV |
[KEV] Vulnerability in QNAP Systems Helpdesk (CVE-2020-2506)
Vulnerability in QNAP Systems Helpdesk (CVE-2020-2506). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-25223 KEV |
[KEV] OS Command Injection in Sophos SG UTM (CVE-2020-25223)
OS command injection in Sophos SG UTM (CVE-2020-25223). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-5410 KEV |
[KEV] Vulnerability in Vmware tanzu Spring Cloud Configuration Config Server (CVE-2020-5410)
Vulnerability in Vmware tanzu Spring Cloud Configuration Config Server (CVE-2020-5410). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-7247 KEV |
[KEV] Vulnerability in OpenBSD OpenSMTPD (CVE-2020-7247)
Vulnerability in OpenBSD OpenSMTPD (CVE-2020-7247). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-9054 KEV |
[KEV] OS Command Injection in Zyxel Multiple Network-Attached Storage (NAS) Devices (CVE-2020-9054)
OS command injection in Zyxel Multiple Network-Attached Storage (NAS) Devices (CVE-2020-9054). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-9377 KEV |
[KEV] OS Command Injection in D-Link DIR-610 Devices (CVE-2020-9377)
OS command injection in D-Link DIR-610 Devices (CVE-2020-9377). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22941 KEV |
[KEV] Vulnerability in Citrix ShareFile (CVE-2021-22941)
Vulnerability in Citrix ShareFile (CVE-2021-22941). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-42237 KEV |
[KEV] Unsafe Deserialization in Sitecore XP (CVE-2021-42237)
Vulnerability in Sitecore XP (CVE-2021-42237). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-21999 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2022-21999)
Vulnerability in Microsoft Windows (CVE-2022-21999). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-26143 KEV |
[KEV] Vulnerability in Mitel MiCollab, MiVoice Business Express (CVE-2022-26143)
Vulnerability in Mitel MiCollab, MiVoice Business Express (CVE-2022-26143). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-26318 KEV |
[KEV] Vulnerability in WatchGuard Firebox and XTM Appliances (CVE-2022-26318)
Vulnerability in WatchGuard Firebox and XTM Appliances (CVE-2022-26318). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-2546 KEV |
[KEV] Buffer Overflow in Microsoft Win32k (CVE-2015-2546)
Vulnerability in Microsoft Win32k (CVE-2015-2546). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-3309 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2016-3309)
Vulnerability in Microsoft Windows (CVE-2016-3309). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-0101 KEV |
[KEV] Buffer Overflow in Microsoft Windows (CVE-2017-0101)
Vulnerability in Microsoft Windows (CVE-2017-0101). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-8120 KEV |
[KEV] Vulnerability in Microsoft Win32k (CVE-2018-8120)
Vulnerability in Microsoft Win32k (CVE-2018-8120). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-0543 KEV |
[KEV] Authentication Bypass in Microsoft Windows (CVE-2019-0543)
Authentication bypass in Microsoft Windows (CVE-2019-0543). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
