CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2021-35394 KEV |
[KEV] OS Command Injection in Realtek Jungle Software Development Kit (SDK) (CVE-2021-35394)
OS command injection in Realtek Jungle Software Development Kit (SDK) (CVE-2021-35394). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-13272 KEV |
[KEV] Privilege Escalation in Linux Kernel (CVE-2019-13272)
Vulnerability in Linux Kernel (CVE-2019-13272). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-44515 KEV |
[KEV] Vulnerability in Zoho Desktop Central (CVE-2021-44515)
Vulnerability in Zoho Desktop Central (CVE-2021-44515). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-44077 KEV |
[KEV] Vulnerability in Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus (CVE-2021-44077)
Vulnerability in Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus (CVE-2021-44077). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-40438 KEV |
[KEV] SSRF (Server-Side Request Forgery) in Apache (CVE-2021-40438)
SSRF in Apache (CVE-2021-40438). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-37415 KEV |
[KEV] Vulnerability in Zoho ManageEngine ServiceDesk Plus (SDP) (CVE-2021-37415)
Vulnerability in Zoho ManageEngine ServiceDesk Plus (SDP) (CVE-2021-37415). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-14847 KEV |
[KEV] Path Traversal in MikroTik RouterOS (CVE-2018-14847)
Path traversal in MikroTik RouterOS (CVE-2018-14847). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-11261 KEV |
[KEV] Vulnerability in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (CVE-2020-11261)
Vulnerability in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (CVE-2020-11261). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2021-01-05 or later.
|
|
| CVE-2021-42292 KEV |
[KEV] Vulnerability in Microsoft Office (CVE-2021-42292)
Vulnerability in Microsoft Office (CVE-2021-42292). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-42321 KEV |
[KEV] Vulnerability in Microsoft Exchange (CVE-2021-42321)
Vulnerability in Microsoft Exchange (CVE-2021-42321). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-40449 KEV |
[KEV] Use-After-Free in Microsoft Windows (CVE-2021-40449)
Vulnerability in Microsoft Windows (CVE-2021-40449). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22204 KEV |
[KEV] Vulnerability in Perl Exiftool (CVE-2021-22204)
Vulnerability in Perl Exiftool (CVE-2021-22204). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-29583 KEV |
[KEV] Vulnerability in Zyxel Multiple Products (CVE-2020-29583)
Vulnerability in Zyxel Multiple Products (CVE-2020-29583). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-8394 KEV |
[KEV] Unrestricted File Upload in Zoho ManageEngine (CVE-2019-8394)
Vulnerability in Zoho ManageEngine (CVE-2019-8394). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-10189 KEV |
[KEV] Unsafe Deserialization in Zoho ManageEngine (CVE-2020-10189)
Vulnerability in Zoho ManageEngine (CVE-2020-10189). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-40539 KEV |
[KEV] Vulnerability in Zoho ManageEngine (CVE-2021-40539)
Vulnerability in Zoho ManageEngine (CVE-2021-40539). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-27561 KEV |
[KEV] OS Command Injection in Yealink Device Management (CVE-2021-27561)
OS command injection in Yealink Device Management (CVE-2021-27561). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-9978 KEV |
[KEV] Cross-Site Scripting (XSS) in Wordpress Social Warfare Plugin (CVE-2019-9978)
Cross-site scripting in Wordpress Social Warfare Plugin (CVE-2019-9978). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-11738 KEV |
[KEV] Path Traversal in WordPress Snap Creek Duplicator Plugin (CVE-2020-11738)
Path traversal in WordPress Snap Creek Duplicator Plugin (CVE-2020-11738). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-25213 KEV |
[KEV] Unrestricted File Upload in WordPress File Manager Plugin (CVE-2020-25213)
Vulnerability in WordPress File Manager Plugin (CVE-2020-25213). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-4006 KEV |
[KEV] OS Command Injection in VMware Multiple Products (CVE-2020-4006)
OS command injection in VMware Multiple Products (CVE-2020-4006). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-21985 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2021-21985)
Vulnerability in VMware vCenter Server (CVE-2021-21985). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-21972 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2021-21972)
Vulnerability in VMware vCenter Server (CVE-2021-21972). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-3952 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2020-3952)
Vulnerability in VMware vCenter Server (CVE-2020-3952). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22005 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2021-22005)
Vulnerability in VMware vCenter Server (CVE-2021-22005). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-3950 KEV |
[KEV] Privilege Escalation in VMware Multiple Products (CVE-2020-3950)
Vulnerability in VMware Multiple Products (CVE-2020-3950). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-3992 KEV |
[KEV] Use-After-Free in VMware ESXi (CVE-2020-3992)
Vulnerability in VMware ESXi (CVE-2020-3992). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-5544 KEV |
[KEV] Out-of-Bounds Write in VMware ESXi and Horizon DaaS (CVE-2019-5544)
Out-of-bounds write in VMware ESXi and Horizon DaaS (CVE-2019-5544). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-17496 KEV |
[KEV] Vulnerability in vBulletin (CVE-2020-17496)
Vulnerability in vBulletin (CVE-2020-17496). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-16759 KEV |
[KEV] Code Injection in vBulletin (CVE-2019-16759)
Code injection in vBulletin (CVE-2019-16759). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-5847 KEV |
[KEV] Vulnerability in Unraid (CVE-2020-5847)
Vulnerability in Unraid (CVE-2020-5847). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-5849 KEV |
[KEV] Authentication Bypass in Unraid (CVE-2020-5849)
Authentication bypass in Unraid (CVE-2020-5849). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-20085 KEV |
[KEV] Path Traversal in TVT NVMS-1000 (CVE-2019-20085)
Path traversal in TVT NVMS-1000 (CVE-2019-20085). Risk of unauthorized operations or information disclosure. Exploitable via GET /... Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-36741 KEV |
[KEV] Path Traversal in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security (CVE-2021-36741)
Path traversal in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security (CVE-2021-36741). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-36742 KEV |
[KEV] Vulnerability in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security (CVE-2021-36742)
Vulnerability in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security (CVE-2021-36742). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-8599 KEV |
[KEV] Vulnerability in Trend Micro Apex One and OfficeScan (CVE-2020-8599)
Vulnerability in Trend Micro Apex One and OfficeScan (CVE-2020-8599). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-24557 KEV |
[KEV] Vulnerability in Trend Micro Apex One, OfficeScan, and Worry-Free Business Security (CVE-2020-24557)
Vulnerability in Trend Micro Apex One, OfficeScan, and Worry-Free Business Security (CVE-2020-24557). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-8468 KEV |
[KEV] Vulnerability in Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents (CVE-2020-8468)
Vulnerability in Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents (CVE-2020-8468). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-8467 KEV |
[KEV] Vulnerability in Trend Micro Apex One and OfficeScan (CVE-2020-8467)
Vulnerability in Trend Micro Apex One and OfficeScan (CVE-2020-8467). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-18187 KEV |
[KEV] Path Traversal in Trend Micro OfficeScan (CVE-2019-18187)
Path traversal in Trend Micro OfficeScan (CVE-2019-18187). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-9082 KEV |
[KEV] Vulnerability in ThinkPHP (CVE-2019-9082)
Vulnerability in ThinkPHP (CVE-2019-9082). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-20062 KEV |
[KEV] Vulnerability in ThinkPHP noneCms (CVE-2018-20062)
Vulnerability in ThinkPHP noneCms (CVE-2018-20062). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-14558 KEV |
[KEV] OS Command Injection in Tenda AC7, AC9, and AC10 Routers (CVE-2018-14558)
OS command injection in Tenda AC7, AC9, and AC10 Routers (CVE-2018-14558). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-10987 KEV |
[KEV] OS Command Injection in Tenda AC1900 Router AC15 Model (CVE-2020-10987)
OS command injection in Tenda AC1900 Router AC15 Model (CVE-2020-10987). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-31755 KEV |
[KEV] Out-of-Bounds Write in Tenda AC11 Router (CVE-2021-31755)
Out-of-bounds write in Tenda AC11 Router (CVE-2021-31755). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-9248 KEV |
[KEV] Vulnerability in Progress ASP.NET AJAX and Sitefinity (CVE-2017-9248)
Vulnerability in Progress ASP.NET AJAX and Sitefinity (CVE-2017-9248). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-18988 KEV |
[KEV] Vulnerability in TeamViewer Desktop (CVE-2019-18988)
Vulnerability in TeamViewer Desktop (CVE-2019-18988). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-6327 KEV |
[KEV] Vulnerability in Symantec Messaging Gateway (CVE-2017-6327)
Vulnerability in Symantec Messaging Gateway (CVE-2017-6327). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-10181 KEV |
[KEV] Cross-Site Request Forgery (CSRF) in Sumavision Enhanced Multimedia Router (EMR) (CVE-2020-10181)
Vulnerability in Sumavision Enhanced Multimedia Router (EMR) (CVE-2020-10181). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-12271 KEV |
[KEV] SQL Injection in Sophos SFOS (CVE-2020-12271)
SQL injection in Sophos SFOS (CVE-2020-12271). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
