Known Ransomware CVEs
361 CVEs with confirmed ransomware exploitation per CISA KEV.
| CVE | Vendor | Product | CVSS | EPSS | Added to KEV | Due Date | Flags | Description |
|---|---|---|---|---|---|---|---|---|
CVE-2025-53770 |
Microsoft | SharePoint | — | 1.0000 | 2025-07-20 | 2025-07-21 | Microsoft SharePoint Server on-premises contains a deserialization of untrusted | |
CVE-2024-23897 |
Jenkins | Jenkins Command Line Interface (CLI) | — | 1.0000 | 2024-08-19 | 2024-09-09 | Jenkins Command Line Interface (CLI) contains a path traversal vulnerability tha | |
CVE-2024-3400 |
Palo Alto Networks | PAN-OS | — | 1.0000 | 2024-04-12 | 2024-04-19 | Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vul | |
CVE-2024-21893 |
Ivanti | Connect Secure, Policy Secure, and Neurons | — | 1.0000 | 2024-01-31 | 2024-02-02 | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Poli | |
CVE-2023-35082 |
Ivanti | Endpoint Manager Mobile (EPMM) and MobileIron Core | — | 1.0000 | 2024-01-18 | 2024-02-08 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authenticat | |
CVE-2024-21887 |
Ivanti | Connect Secure and Policy Secure | — | 1.0000 | 2024-01-10 | 2024-01-22 | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti P | |
CVE-2023-22518 |
Atlassian | Confluence Data Center and Server | — | 1.0000 | 2023-11-07 | 2023-11-28 | Atlassian Confluence Data Center and Server contain an improper authorization vu | |
CVE-2023-4966 |
Citrix | NetScaler ADC and NetScaler Gateway | — | 1.0000 | 2023-10-18 | 2023-11-08 | Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerabili | |
CVE-2023-35078 |
Ivanti | Endpoint Manager Mobile (EPMM) | — | 1.0000 | 2023-07-25 | 2023-08-15 | Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contai | |
CVE-2023-27350 |
PaperCut | MF/NG | — | 1.0000 | 2023-04-21 | 2023-05-12 | PaperCut MF/NG contains an improper access control vulnerability within the Setu | |
CVE-2023-0669 |
Fortra | GoAnywhere MFT | — | 1.0000 | 2023-02-10 | 2023-03-03 | Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remo | |
CVE-2022-26134 |
Atlassian | Confluence Server/Data Center | — | 1.0000 | 2022-06-02 | 2022-06-06 | Atlassian Confluence Server and Data Center contain a remote code execution vuln | |
CVE-2022-29464 |
WSO2 | Multiple Products | — | 1.0000 | 2022-04-25 | 2022-05-16 | Multiple WSO2 products allow for unrestricted file upload, resulting in remote c | |
CVE-2025-49704 |
Microsoft | SharePoint | — | 1.0000 | 2025-07-22 | 2025-07-23 | Microsoft SharePoint contains a code injection vulnerability that could allow an | |
CVE-2025-3248 |
Langflow | Langflow | — | 0.9999 | 2025-05-05 | 2025-05-26 | Langflow contains a missing authentication vulnerability in the /api/v1/validate | |
CVE-2023-46604 |
Apache | ActiveMQ | — | 0.9999 | 2023-11-02 | 2023-11-23 | Apache ActiveMQ contains a deserialization of untrusted data vulnerability that | |
CVE-2024-27199 |
JetBrains | TeamCity | — | 0.9999 | 2026-04-20 | 2026-05-04 | JetBrains TeamCity contains a relative path traversal vulnerability that could a | |
CVE-2023-29300 |
Adobe | ColdFusion | — | 0.9999 | 2024-01-08 | 2024-01-29 | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that | |
CVE-2024-4577 |
PHP Group | PHP | — | 0.9999 | 2024-06-12 | 2024-07-03 | PHP, specifically Windows-based PHP used in CGI mode, contains an OS command inj | |
CVE-2023-42793 |
JetBrains | TeamCity | — | 0.9999 | 2023-10-04 | 2023-10-25 | JetBrains TeamCity contains an authentication bypass vulnerability that allows f | |
CVE-2023-22527 |
Atlassian | Confluence Data Center and Server | — | 0.9998 | 2024-01-24 | 2024-02-14 | Atlassian Confluence Data Center and Server contain an unauthenticated OGNL temp | |
CVE-2023-29357 |
Microsoft | SharePoint Server | — | 0.9998 | 2024-01-10 | 2024-01-31 | Microsoft SharePoint Server contains an unspecified vulnerability that allows an | |
CVE-2023-46805 |
Ivanti | Connect Secure and Policy Secure | — | 0.9998 | 2024-01-10 | 2024-01-22 | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti P | |
CVE-2022-40684 |
Fortinet | Multiple Products | — | 0.9998 | 2022-10-11 | 2022-11-01 | Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication b | |
CVE-2025-22457 |
Ivanti | Connect Secure, Policy Secure, and ZTA Gateways | — | 0.9998 | 2025-04-04 | 2025-04-11 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based bu | |
CVE-2025-0282 |
Ivanti | Connect Secure, Policy Secure, and ZTA Gateways | — | 0.9998 | 2025-01-08 | 2025-01-15 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buf | |
CVE-2024-1709 |
ConnectWise | ScreenConnect | — | 0.9998 | 2024-02-22 | 2024-02-29 | ConnectWise ScreenConnect contains an authentication bypass vulnerability that a | |
CVE-2024-24919 |
Check Point | Quantum Security Gateways | — | 0.9998 | 2024-05-30 | 2024-06-20 | Check Point Quantum Security Gateways contain an unspecified information disclos | |
CVE-2025-5777 |
Citrix | NetScaler ADC and Gateway | — | 0.9997 | 2025-07-10 | 2025-07-11 | Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due | |
CVE-2022-41082 |
Microsoft | Exchange Server | — | 0.9997 | 2022-09-30 | 2022-10-21 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2025-31161 |
CrushFTP | CrushFTP | — | 0.9997 | 2025-04-07 | 2025-04-28 | CrushFTP contains an authentication bypass vulnerability in the HTTP authorizati | |
CVE-2022-47986 |
IBM | Aspera Faspex | — | 0.9997 | 2023-02-21 | 2023-03-14 | IBM Aspera Faspex could allow a remote attacker to execute code on the system, c | |
CVE-2022-41040 |
Microsoft | Exchange Server | — | 0.9996 | 2022-09-30 | 2022-10-21 | Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyN | |
CVE-2023-38035 |
Ivanti | Sentry | — | 0.9995 | 2023-08-22 | 2023-09-12 | Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication b | |
CVE-2024-27198 |
JetBrains | TeamCity | — | 0.9994 | 2024-03-07 | 2024-03-28 | JetBrains TeamCity contains an authentication bypass vulnerability that allows a | |
CVE-2023-34362 |
Progress | MOVEit Transfer | — | 0.9993 | 2023-06-02 | 2023-06-23 | Progress MOVEit Transfer contains a SQL injection vulnerability that could allow | |
CVE-2025-10035 |
Fortra | GoAnywhere MFT | — | 0.9982 | 2025-09-29 | 2025-10-20 | Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability | |
CVE-2023-38831 |
RARLAB | WinRAR | — | 0.9981 | 2023-08-24 | 2023-09-14 | RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to e | |
CVE-2025-55182 |
Meta | React Server Components | — | 0.9980 | 2025-12-05 | 2025-12-12 | Meta React Server Components contains a remote code execution vulnerability that | |
CVE-2024-0012 |
Palo Alto Networks | PAN-OS | — | 0.9979 | 2024-11-18 | 2024-12-09 | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the | |
CVE-2022-47966 |
Zoho | ManageEngine | — | 0.9975 | 2023-01-23 | 2023-02-13 | Multiple Zoho ManageEngine products contain an unauthenticated remote code execu | |
CVE-2023-3519 |
Citrix | NetScaler ADC and NetScaler Gateway | — | 0.9975 | 2023-07-19 | 2023-08-09 | Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerabili | |
CVE-2025-61882 |
Oracle | E-Business Suite | — | 0.9973 | 2025-10-06 | 2025-10-27 | Oracle E-Business Suite contains an unspecified vulnerability in the BI Publishe | |
CVE-2025-31324 |
SAP | NetWeaver | — | 0.9949 | 2025-04-29 | 2025-05-20 | SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file up | |
CVE-2024-23692 |
Rejetto | HTTP File Server | — | 0.9949 | 2024-07-09 | 2024-07-30 | Rejetto HTTP File Server contains an improper neutralization of special elements | |
CVE-2022-42475 |
Fortinet | FortiOS | — | 0.9947 | 2022-12-13 | 2023-01-03 | Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overfl | |
CVE-2023-36884 |
Microsoft | Windows | — | 0.9944 | 2023-07-17 | 2023-08-29 | Microsoft Windows Search contains an unspecified vulnerability that could allow | |
CVE-2024-21412 |
Microsoft | Windows | — | 0.9941 | 2024-02-13 | 2024-03-05 | Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability | |
CVE-2022-30333 |
RARLAB | UnRAR | — | 0.9923 | 2022-08-09 | 2022-08-30 | RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, all | |
CVE-2023-22515 |
Atlassian | Confluence Data Center and Server | — | 0.9922 | 2023-10-05 | 2023-10-13 | Atlassian Confluence Data Center and Server contains a broken access control vul | |
CVE-2022-30190 |
Microsoft | Windows | — | 0.9916 | 2022-06-14 | 2022-07-05 | A remote code execution vulnerability exists when MSDT is called using the URL p | |
CVE-2025-49706 |
Microsoft | SharePoint | — | 0.9906 | 2025-07-22 | 2025-07-23 | Microsoft SharePoint contains an improper authentication vulnerability that allo | |
CVE-2023-47246 |
SysAid | SysAid Server | — | 0.9885 | 2023-11-13 | 2023-12-04 | SysAid Server (on-premises version) contains a path traversal vulnerability that | |
CVE-2022-27925 |
Synacor | Zimbra Collaboration Suite (ZCS) | — | 0.9868 | 2022-08-11 | 2022-09-01 | Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functio | |
CVE-2024-50623 |
Cleo | Multiple Products | — | 0.9861 | 2024-12-13 | 2025-01-03 | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, c | |
CVE-2026-41940 |
WebPros | cPanel & WHM and WP2 (WordPress Squared) | 9.3 | 0.9853 | 2026-04-30 | 2026-05-03 | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an au | |
CVE-2023-48788 |
Fortinet | FortiClient EMS | — | 0.9845 | 2024-03-25 | 2024-04-15 | Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an u | |
CVE-2024-41713 |
Mitel | MiCollab | — | 0.9721 | 2025-01-07 | 2025-01-28 | Mitel MiCollab contains a path traversal vulnerability that could allow an attac | |
CVE-2023-38203 |
Adobe | ColdFusion | — | 0.9707 | 2024-01-08 | 2024-01-29 | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that | |
CVE-2024-57727 |
SimpleHelp | SimpleHelp | — | 0.9683 | 2025-02-13 | 2025-03-06 | SimpleHelp remote support software contains multiple path traversal vulnerabilit | |
CVE-2023-46747 |
F5 | BIG-IP Configuration Utility | — | 0.9675 | 2023-10-31 | 2023-11-21 | F5 BIG-IP Configuration utility contains an authentication bypass using an alter | |
CVE-2026-35273 |
Oracle | PeopleSoft Enterprise PeopleTools | — | 0.9668 | 2026-06-12 | 2026-06-15 | Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for c | |
CVE-2026-23760 |
SmarterTools | SmarterMail | — | 0.9643 | 2026-01-26 | 2026-02-16 | SmarterTools SmarterMail contains an authentication bypass using an alternate pa | |
CVE-2025-61884 |
Oracle | E-Business Suite | — | 0.9589 | 2025-10-20 | 2025-11-10 | Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerabil | |
CVE-2022-41352 |
Synacor | Zimbra Collaboration Suite (ZCS) | — | 0.9548 | 2022-10-20 | 2022-11-10 | Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary | |
CVE-2024-1708 |
ConnectWise | ScreenConnect | — | 0.9544 | 2026-04-28 | 2026-05-12 | ConnectWise ScreenConnect contains a path traversal vulnerability which could al | |
CVE-2022-36537 |
ZK Framework | AuUploader | — | 0.9540 | 2023-02-27 | 2023-03-20 | ZK Framework AuUploader servlets contain an unspecified vulnerability that could | |
CVE-2024-53704 |
SonicWall | SonicOS | — | 0.9531 | 2025-02-18 | 2025-03-11 | SonicWall SonicOS contains an improper authentication vulnerability in the SSLVP | |
CVE-2026-0257 |
Palo Alto Networks | PAN-OS | 7.8 | 0.9501 | 2026-05-29 | 2026-06-01 | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that a | |
CVE-2024-51378 |
CyberPersons | CyberPanel | — | 0.9475 | 2024-12-04 | 2024-12-25 | CyberPanel contains an incorrect default permissions vulnerability that allows f | |
CVE-2025-8088 |
RARLAB | WinRAR | — | 0.9451 | 2025-08-12 | 2025-09-02 | RARLAB WinRAR contains a path traversal vulnerability affecting the Windows vers | |
CVE-2024-55591 |
Fortinet | FortiOS and FortiProxy | — | 0.9435 | 2025-01-14 | 2025-01-21 | Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability t | |
CVE-2024-55956 |
Cleo | Multiple Products | — | 0.9397 | 2024-12-17 | 2025-01-07 | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, c | |
CVE-2022-27924 |
Synacor | Zimbra Collaboration Suite (ZCS) | — | 0.9391 | 2022-08-04 | 2022-08-25 | Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache c | |
CVE-2024-9474 |
Palo Alto Networks | PAN-OS | — | 0.9375 | 2024-11-18 | 2024-12-09 | Palo Alto Networks PAN-OS contains an OS command injection vulnerability that al | |
CVE-2026-63077 |
JetBrains | TeamCity | 9.8 | 0.9356 | 2026-08-05 | 2026-08-08 | JetBrains TeamCity contains a deserialization of untrusted data vulnerability th | |
CVE-2026-1731 |
BeyondTrust | Remote Support (RS) and Privileged Remote Access (PRA) | — | 0.9310 | 2026-02-13 | 2026-02-16 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS | |
CVE-2024-6670 |
Progress | WhatsUp Gold | — | 0.9291 | 2024-09-16 | 2024-10-07 | Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unau | |
CVE-2022-37042 |
Synacor | Zimbra Collaboration Suite (ZCS) | — | 0.9207 | 2022-08-11 | 2022-09-01 | Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulne | |
CVE-2022-26352 |
dotCMS | dotCMS | — | 0.9125 | 2022-08-25 | 2022-09-15 | dotCMS ContentResource API contains an unrestricted upload of file with a danger | |
CVE-2024-40711 |
Veeam | Backup & Replication | — | 0.9037 | 2024-10-17 | 2024-11-07 | Veeam Backup and Replication contains a deserialization vulnerability allowing a | |
CVE-2023-40044 |
Progress | WS_FTP Server | — | 0.9035 | 2023-10-05 | 2023-10-26 | Progress WS_FTP Server contains a deserialization of untrusted data vulnerabilit | |
CVE-2025-26399 |
SolarWinds | Web Help Desk | — | 0.9012 | 2026-03-09 | 2026-03-12 | SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerabili | |
CVE-2023-41265 |
Qlik | Sense | — | 0.8821 | 2023-12-07 | 2023-12-28 | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to e | |
CVE-2026-24423 |
SmarterTools | SmarterMail | — | 0.8818 | 2026-02-05 | 2026-02-26 | SmarterTools SmarterMail contains a missing authentication for critical function | |
CVE-2022-27593 |
QNAP | Photo Station | — | 0.8791 | 2022-09-08 | 2022-09-29 | Certain QNAP NAS running Photo Station with internet exposure contain an externa | |
CVE-2023-27997 |
Fortinet | FortiOS and FortiProxy SSL-VPN | — | 0.8569 | 2023-06-13 | 2023-07-04 | Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vul | |
CVE-2025-52691 |
SmarterTools | SmarterMail | — | 0.8566 | 2026-01-26 | 2026-02-16 | SmarterTools SmarterMail contains an unrestricted upload of file with dangerous | |
CVE-2023-43208 |
NextGen Healthcare | Mirth Connect | — | 0.8542 | 2024-05-20 | 2024-06-10 | NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vu | |
CVE-2026-50751 |
Check Point | Security Gateway | — | 0.8534 | 2026-06-08 | 2026-06-11 | Check Point Security Gateway contains an improper authentication vulnerability i | |
CVE-2023-24955 |
Microsoft | SharePoint Server | — | 0.8497 | 2024-03-26 | 2024-04-16 | Microsoft SharePoint Server contains a code injection vulnerability that allows | |
CVE-2023-41266 |
Qlik | Sense | — | 0.8484 | 2023-12-07 | 2023-12-28 | Qlik Sense contains a path traversal vulnerability that allows a remote, unauthe | |
CVE-2024-21762 |
Fortinet | FortiOS | 9.8 | 0.8459 | 2024-02-09 | 2024-02-16 | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remo | |
CVE-2024-51567 |
CyberPersons | CyberPanel | — | 0.8440 | 2024-11-07 | 2024-11-28 | CyberPanel contains an incorrect default permissions vulnerability that allows a | |
CVE-2023-27532 |
Veeam | Backup & Replication | — | 0.8060 | 2023-08-22 | 2023-09-12 | Veeam Backup & Replication Cloud Connect component contains a missing authentica | |
CVE-2026-45659 |
Microsoft | SharePoint Server | — | 0.8024 | 2026-07-01 | 2026-07-04 | Microsoft SharePoint Server contains a deserialization of untrusted data vulnera | |
CVE-2023-27351 |
PaperCut | NG/MF | — | 0.7805 | 2026-04-20 | 2026-05-04 | PaperCut NG/MF contains an improper authentication vulnerability that could allo | |
CVE-2023-24880 |
Microsoft | Windows | — | 0.7801 | 2023-03-14 | 2023-04-04 | Microsoft Windows SmartScreen contains a security feature bypass vulnerability t | |
CVE-2022-41080 |
Microsoft | Exchange Server | — | 0.7733 | 2023-01-10 | 2023-01-31 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2022-44698 |
Microsoft | Defender | — | 0.7627 | 2022-12-13 | 2023-01-03 | Microsoft Defender SmartScreen contains a security feature bypass vulnerability | |
CVE-2024-30088 |
Microsoft | Windows | — | 0.6820 | 2024-10-15 | 2024-11-05 | Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race c | |
CVE-2023-28461 |
Array Networks | AG/vxAG ArrayOS | — | 0.6808 | 2024-11-25 | 2024-12-16 | Array Networks AG and vxAG ArrayOS contain a missing authentication for critical | |
CVE-2024-57726 |
SimpleHelp | SimpleHelp | — | 0.6641 | 2026-04-24 | 2026-05-08 | SimpleHelp contains a missing authorization vulnerability that could allow low-p | |
CVE-2024-57728 |
SimpleHelp | SimpleHelp | — | 0.6447 | 2026-04-24 | 2026-05-08 | SimpleHelp contains a path traversal vulnerability that allows admin users to up | |
CVE-2024-21338 |
Microsoft | Windows | — | 0.5981 | 2024-03-04 | 2024-03-25 | Microsoft Windows Kernel contains an exposed IOCTL with insufficient access cont | |
CVE-2023-21529 |
Microsoft | Exchange Server | — | 0.5929 | 2026-04-13 | 2026-04-27 | Microsoft Exchange Server contains a deserialization of untrusted data that allo | |
CVE-2022-29499 |
Mitel | MiVoice Connect | — | 0.5524 | 2022-06-27 | 2022-07-18 | The Service Appliance component in Mitel MiVoice Connect allows remote code exec | |
CVE-2024-38094 |
Microsoft | SharePoint | — | 0.5089 | 2024-10-22 | 2024-11-12 | Microsoft SharePoint contains a deserialization vulnerability that allows for re | |
CVE-2023-28252 |
Microsoft | Windows | — | 0.4889 | 2023-04-11 | 2023-05-02 | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified v | |
CVE-2023-48365 |
Qlik | Sense | — | 0.4773 | 2025-01-13 | 2025-02-03 | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to e | |
CVE-2026-12569 |
PTC | Windchill and FlexPLM | — | 0.4605 | 2026-06-25 | 2026-06-28 | PTC Windchill and FlexPLM contains an improper input validation vulnerability al | |
CVE-2026-20131 |
Cisco | Secure Firewall Management Center (FMC) | — | 0.4317 | 2026-03-19 | 2026-03-22 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud | |
CVE-2024-55550 |
Mitel | MiCollab | — | 0.3816 | 2025-01-07 | 2025-01-28 | Mitel MiCollab contains a path traversal vulnerability that could allow an authe | |
CVE-2022-31199 |
Netwrix | Auditor | — | 0.3601 | 2023-07-11 | 2023-08-01 | Netwrix Auditor User Activity Video Recording component contains an insecure obj | |
CVE-2026-20316 |
Cisco | Secure Firewall Management Center (FMC) | 5.3 | 0.3510 | 2026-07-29 | 2026-08-01 | Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Manage | |
CVE-2025-26633 |
Microsoft | Windows | — | 0.3039 | 2025-03-11 | 2025-04-01 | Microsoft Windows Management Console (MMC) contains an improper neutralization v | |
CVE-2025-14733 |
WatchGuard | Firebox | — | 0.2942 | 2025-12-19 | 2025-12-26 | WatchGuard Fireware OS iked process contains an out of bounds write vulnerabilit | |
CVE-2022-37969 |
Microsoft | Windows | — | 0.2828 | 2022-09-14 | 2022-10-05 | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified v | |
CVE-2024-1086 |
Linux | Kernel | — | 0.2806 | 2024-05-30 | 2024-06-20 | Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables | |
CVE-2024-37085 |
VMware | ESXi | — | 0.2677 | 2024-07-30 | 2024-08-20 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor w | |
CVE-2023-20269 |
Cisco | Adaptive Security Appliance and Firepower Threat Defense | — | 0.2662 | 2023-09-13 | 2023-10-04 | Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauth | |
CVE-2025-23006 |
SonicWall | SMA1000 Appliances | — | 0.2343 | 2025-01-24 | 2025-02-14 | SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Cons | |
CVE-2024-9680 |
Mozilla | Firefox | — | 0.2318 | 2024-10-15 | 2024-11-05 | Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animat | |
CVE-2025-29824 |
Microsoft | Windows | — | 0.1925 | 2025-04-08 | 2025-04-29 | Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free | |
CVE-2024-40766 |
SonicWall | SonicOS | — | 0.1838 | 2024-09-09 | 2024-09-30 | SonicWall SonicOS contains an improper access control vulnerability that could l | |
CVE-2024-49039 |
Microsoft | Windows | — | 0.1418 | 2024-11-12 | 2024-12-03 | Microsoft Windows Task Scheduler contains a privilege escalation vulnerability t | |
CVE-2025-42999 |
SAP | NetWeaver | — | 0.1285 | 2025-05-15 | 2025-06-05 | SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulne | |
CVE-2026-15410 |
SonicWall | SMA1000 Appliances | 7.2 | 0.1179 | 2026-07-14 | 2026-07-17 | SonicWall SMA1000 Appliances contain a code injection vulnerability which in spe | |
CVE-2023-23376 |
Microsoft | Windows | — | 0.1085 | 2023-02-14 | 2023-03-07 | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified v | |
CVE-2022-41223 |
Mitel | MiVoice Connect | — | 0.1066 | 2023-02-21 | 2023-03-14 | The Director component in Mitel MiVoice Connect allows an authenticated attacker | |
CVE-2022-40765 |
Mitel | MiVoice Connect | — | 0.1057 | 2023-02-21 | 2023-03-14 | The Mitel Edge Gateway component of MiVoice Connect allows an authenticated atta | |
CVE-2025-24472 |
Fortinet | FortiOS and FortiProxy | — | 0.0723 | 2025-03-18 | 2025-04-08 | Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability | |
CVE-2026-15409 |
SonicWall | SMA1000 Appliances | 10.0 | 0.0679 | 2026-07-14 | 2026-07-17 | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability | |
CVE-2026-33825 |
Microsoft | Defender | — | 0.0675 | 2026-04-22 | 2026-05-06 | Microsoft Defender contains an insufficient granularity of access control vulner | |
CVE-2022-26500 |
Veeam | Backup & Replication | — | 0.0583 | 2022-12-13 | 2023-01-03 | The Veeam Distribution Service in the Backup & Replication application allows un | |
CVE-2024-30051 |
Microsoft | DWM Core Library | — | 0.0569 | 2024-05-14 | 2024-06-04 | Microsoft DWM Core Library contains a privilege escalation vulnerability that al | |
CVE-2025-60710 |
Microsoft | Windows | — | 0.0461 | 2026-04-13 | 2026-04-27 | Microsoft Windows contains a link following vulnerability that allows for privil | |
CVE-2022-26501 |
Veeam | Backup & Replication | — | 0.0410 | 2022-12-13 | 2023-01-03 | The Veeam Distribution Service in the Backup & Replication application allows un | |
CVE-2024-26169 |
Microsoft | Windows | — | 0.0398 | 2024-06-13 | 2024-07-04 | Microsoft Windows Error Reporting Service contains an improper privilege managem | |
CVE-2026-45321 |
TanStack | TanStack | 9.6 | 0.0328 | 2026-05-27 | 2026-06-10 | TanStack contains an unspecified vulnerability that allowed malicious versions o | |
CVE-2024-11667 |
Zyxel | Multiple Firewalls | — | 0.0293 | 2024-12-03 | 2024-12-24 | Multiple Zyxel firewalls contain a path traversal vulnerability in the web manag | |
CVE-2026-59310 |
Broadcom | VMware vCenter | — | 0.0256 | 2026-08-18 | 2026-08-21 | Broadcom VMware vCenter contains a path traversal vulnerability which could allo | |
CVE-2022-41073 |
Microsoft | Windows | — | 0.0236 | 2022-11-08 | 2022-12-09 | Microsoft Windows Print Spooler contains an unspecified vulnerability that allow | |
CVE-2022-41091 |
Microsoft | Windows | — | 0.0191 | 2022-11-08 | 2022-12-09 | Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vuln | |
CVE-2026-48027 |
Nx | Nx Console | — | 0.0185 | 2026-05-27 | 2026-06-10 | Nx Console contains an embedded malicious code vulnerability that allowed a mali | |
CVE-2025-22225 |
VMware | ESXi | — | 0.0102 | 2025-03-04 | 2025-03-25 | VMware ESXi contains an arbitrary write vulnerability. Successful exploitation a | |
CVE-2021-43226 |
Microsoft | Windows | — | — | 2025-10-06 | 2025-10-27 | Microsoft Windows Common Log File System Driver contains a privilege escalation | |
CVE-2019-6693 |
Fortinet | FortiOS | — | — | 2025-06-25 | 2025-07-16 | Fortinet FortiOS contains a use of hard-coded credentials vulnerability that cou | |
CVE-2018-8639 |
Microsoft | Windows | — | — | 2025-03-03 | 2025-03-24 | Microsoft Windows Win32k contains an improper resource shutdown or release vulne | |
CVE-2020-29574 |
Sophos | CyberoamOS | — | — | 2025-02-06 | 2025-02-27 | CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that al | |
CVE-2020-0618 |
Microsoft | SQL Server | — | — | 2024-09-18 | 2024-10-09 | Microsoft SQL Server Reporting Services contains a deserialization vulnerability | |
CVE-2017-1000253 |
Linux | Kernel | — | — | 2024-09-09 | 2024-09-30 | Linux kernel contains a position-independent executable (PIE) stack buffer corru | |
CVE-2021-44529 |
Ivanti | Endpoint Manager Cloud Service Appliance (EPM CSA) | — | — | 2024-03-25 | 2024-04-15 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code inject | |
CVE-2020-3259 |
Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | — | 2024-02-15 | 2024-03-07 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta | |
CVE-2017-6884 |
Zyxel | EMG2926 Routers | — | — | 2023-09-18 | 2023-10-09 | Zyxel EMG2926 routers contain a command injection vulnerability located in the d | |
CVE-2021-3129 |
Laravel | Ignition | — | — | 2023-09-18 | 2023-10-09 | Laravel Ignition contains a file upload vulnerability that allows unauthenticate | |
CVE-2021-45046 |
Apache | Log4j2 | — | — | 2023-05-01 | 2023-05-22 | Apache Log4j2 contains a deserialization of untrusted data vulnerability due to | |
CVE-2021-27876 |
Veritas | Backup Exec Agent | — | — | 2023-04-07 | 2023-04-28 | Veritas Backup Exec (BE) Agent contains a file access vulnerability that could a | |
CVE-2021-27877 |
Veritas | Backup Exec Agent | — | — | 2023-04-07 | 2023-04-28 | Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability | |
CVE-2021-27878 |
Veritas | Backup Exec Agent | — | — | 2023-04-07 | 2023-04-28 | Veritas Backup Exec (BE) Agent contains a command execution vulnerability that c | |
CVE-2019-1388 |
Microsoft | Windows | — | — | 2023-04-07 | 2023-04-28 | Microsoft Windows Certificate Dialog contains a privilege escalation vulnerabili | |
CVE-2017-7494 |
Samba | Samba | — | — | 2023-03-30 | 2023-04-20 | Samba contains a remote code execution vulnerability, allowing a malicious clien | |
CVE-2015-2291 |
Intel | Ethernet Diagnostics Driver for Windows | — | — | 2023-02-10 | 2023-03-03 | Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain | |
CVE-2022-24990 |
TerraMaster | TerraMaster OS | — | — | 2023-02-10 | 2023-03-03 | TerraMaster OS contains a remote command execution vulnerability that allows an | |
CVE-2022-21587 |
Oracle | E-Business Suite | — | — | 2023-02-02 | 2023-02-23 | Oracle E-Business Suite contains an unspecified vulnerability that allows an una | |
CVE-2017-11357 |
Telerik | User Interface (UI) for ASP.NET AJAX | — | — | 2023-01-26 | 2023-02-16 | Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnera | |
CVE-2020-3433 |
Cisco | AnyConnect Secure | — | — | 2022-10-24 | 2022-11-14 | Cisco AnyConnect Secure Mobility Client for Windows interprocess communication ( | |
CVE-2020-3153 |
Cisco | AnyConnect Secure | — | — | 2022-10-24 | 2022-11-14 | Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handlin | |
CVE-2018-19323 |
GIGABYTE | Multiple Products | — | — | 2022-10-24 | 2022-11-14 | The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics En | |
CVE-2018-19322 |
GIGABYTE | Multiple Products | — | — | 2022-10-24 | 2022-11-14 | The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics En | |
CVE-2018-19321 |
GIGABYTE | Multiple Products | — | — | 2022-10-24 | 2022-11-14 | The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics En | |
CVE-2018-19320 |
GIGABYTE | Multiple Products | — | — | 2022-10-24 | 2022-11-14 | The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME | |
CVE-2018-6530 |
D-Link | Multiple Routers | — | — | 2022-09-08 | 2022-09-29 | Multiple D-Link routers contain an unspecified vulnerability that allows for exe | |
CVE-2018-13374 |
Fortinet | FortiOS and FortiADC | — | — | 2022-09-08 | 2022-09-29 | Fortinet FortiOS and FortiADC contain an improper access control vulnerability t | |
CVE-2022-2294 |
WebRTC | WebRTC | — | — | 2022-08-25 | 2022-09-15 | WebRTC, an open-source project providing web browsers with real-time communicati | |
CVE-2021-4034 |
Red Hat | Polkit | — | — | 2022-06-27 | 2022-07-18 | The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulne | |
CVE-2019-7195 |
QNAP | Photo Station | — | — | 2022-06-08 | 2022-06-22 | QNAP devices running Photo Station contain an external control of file name or p | |
CVE-2019-7194 |
QNAP | Photo Station | — | — | 2022-06-08 | 2022-06-22 | QNAP devices running Photo Station contain an external control of file name or p | |
CVE-2019-7193 |
QNAP | QTS | — | — | 2022-06-08 | 2022-06-22 | QNAP QTS contains an improper input validation vulnerability allowing remote att | |
CVE-2019-7192 |
QNAP | Photo Station | — | — | 2022-06-08 | 2022-06-22 | QNAP NAS devices running Photo Station contain an improper access control vulner | |
CVE-2016-0034 |
Microsoft | Silverlight | — | — | 2022-05-25 | 2022-06-15 | Microsoft Silverlight mishandles negative offsets during decoding, which allows | |
CVE-2013-3993 |
IBM | InfoSphere BigInsights | — | — | 2022-05-25 | 2022-06-15 | Certain APIs within BigInsights can take invalid input that might allow attacker | |
CVE-2013-0431 |
Oracle | Java Runtime Environment (JRE) | — | — | 2022-05-25 | 2022-06-15 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora | |
CVE-2013-0422 |
Oracle | Java Runtime Environment (JRE) | — | — | 2022-05-25 | 2022-06-15 | A vulnerability in the way Java restricts the permissions of Java applets could | |
CVE-2013-0074 |
Microsoft | Silverlight | — | — | 2022-05-25 | 2022-06-15 | Microsoft Silverlight does not properly validate pointers during HTML object ren | |
CVE-2012-1710 |
Oracle | Fusion Middleware | — | — | 2022-05-25 | 2022-06-15 | Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in | |
CVE-2010-1428 |
Red Hat | JBoss | — | — | 2022-05-25 | 2022-06-15 | Unauthenticated access to the JBoss Application Server Web Console (/web-console | |
CVE-2010-0738 |
Red Hat | JBoss | — | — | 2022-05-25 | 2022-06-15 | The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Applicati | |
CVE-2018-19953 |
QNAP | Network Attached Storage (NAS) | — | — | 2022-05-24 | 2022-06-14 | A cross-site scripting vulnerability affecting QNAP NAS File Station could allow | |
CVE-2018-19949 |
QNAP | Network Attached Storage (NAS) | — | — | 2022-05-24 | 2022-06-14 | A command injection vulnerability affecting QNAP NAS File Station could allow re | |
CVE-2018-19943 |
QNAP | Network Attached Storage (NAS) | — | — | 2022-05-24 | 2022-06-14 | A cross-site scripting vulnerability affecting QNAP NAS File Station could allow | |
CVE-2017-0147 |
Microsoft | SMBv1 server | — | — | 2022-05-24 | 2022-06-14 | The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitiv | |
CVE-2017-18362 |
Kaseya | Virtual System/Server Administrator (VSA) | — | — | 2022-05-24 | 2022-06-14 | ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenti | |
CVE-2016-3351 |
Microsoft | Internet Explorer and Edge | — | — | 2022-05-24 | 2022-06-14 | An information disclosure vulnerability exists in the way that certain functions | |
CVE-2020-0638 |
Microsoft | Update Notification Manager | — | — | 2022-05-23 | 2022-06-13 | Microsoft Update Notification Manager contains an unspecified vulnerability that | |
CVE-2019-1385 |
Microsoft | Windows | — | — | 2022-05-23 | 2022-06-13 | A privilege escalation vulnerability exists when the Windows AppX Deployment Ext | |
CVE-2019-1130 |
Microsoft | Windows | — | — | 2022-05-23 | 2022-06-13 | A privilege escalation vulnerability exists when Windows AppX Deployment Service | |
CVE-2022-1388 |
F5 | BIG-IP | — | — | 2022-05-10 | 2022-05-31 | F5 BIG-IP contains a missing authentication in critical function vulnerability w | |
CVE-2018-6882 |
Synacor | Zimbra Collaboration Suite (ZCS) | — | — | 2022-04-19 | 2022-05-10 | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnera | |
CVE-2019-16057 |
D-Link | DNS-320 Storage Device | — | — | 2022-04-15 | 2022-05-06 | The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code executio | |
CVE-2022-22954 |
VMware | Workspace ONE Access and Identity Manager | — | — | 2022-04-14 | 2022-05-05 | VMware Workspace ONE Access and Identity Manager allow for remote code execution | |
CVE-2022-24521 |
Microsoft | Windows | — | — | 2022-04-13 | 2022-05-04 | Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified v | |
CVE-2018-7602 |
Drupal | Core | — | — | 2022-04-13 | 2022-05-04 | A remote code execution vulnerability exists within multiple subsystems of Drupa | |
CVE-2018-20753 |
Kaseya | Virtual System/Server Administrator (VSA) | — | — | 2022-04-13 | 2022-05-04 | Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloa | |
CVE-2021-42287 |
Microsoft | Active Directory | — | — | 2022-04-11 | 2022-05-02 | Microsoft Active Directory Domain Services contains an unspecified vulnerability | |
CVE-2021-42278 |
Microsoft | Active Directory | — | — | 2022-04-11 | 2022-05-02 | Microsoft Active Directory Domain Services contains an unspecified vulnerability | |
CVE-2017-0148 |
Microsoft | SMBv1 server | — | — | 2022-04-06 | 2022-04-27 | The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code | |
CVE-2021-28799 |
QNAP | Network Attached Storage (NAS) | — | — | 2022-03-31 | 2022-04-21 | QNAP NAS running HBS 3 contains an improper authorization vulnerability which ca | |
CVE-2018-10562 |
Dasan | Gigabit Passive Optical Network (GPON) Routers | — | — | 2022-03-31 | 2022-04-21 | Dasan GPON Routers contain an authentication bypass vulnerability. When combined | |
CVE-2021-38646 |
Microsoft | Office | — | — | 2022-03-28 | 2022-04-18 | Microsoft Office Access Connectivity Engine contains an unspecified vulnerabilit | |
CVE-2021-26085 |
Atlassian | Confluence Server | — | — | 2022-03-28 | 2022-04-18 | Affected versions of Atlassian Confluence Server allow remote attackers to view | |
CVE-2021-20028 |
SonicWall | Secure Remote Access (SRA) | — | — | 2022-03-28 | 2022-04-18 | SonicWall Secure Remote Access (SRA) products contain an improper neutralization | |
CVE-2018-8440 |
Microsoft | Windows | — | — | 2022-03-28 | 2022-04-18 | An elevation of privilege vulnerability exists when Windows improperly handles c | |
CVE-2018-8406 |
Microsoft | DirectX Graphics Kernel (DXGKRNL) | — | — | 2022-03-28 | 2022-04-18 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel | |
CVE-2018-8405 |
Microsoft | DirectX Graphics Kernel (DXGKRNL) | — | — | 2022-03-28 | 2022-04-18 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel | |
CVE-2017-0213 |
Microsoft | Windows | — | — | 2022-03-28 | 2022-04-18 | Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when a | |
CVE-2016-0189 |
Microsoft | Internet Explorer | — | — | 2022-03-28 | 2022-04-18 | The Microsoft JScript nd VBScript engines, as used in Internet Explorer and othe | |
CVE-2016-0151 |
Microsoft | Client-Server Run-time Subsystem (CSRSS) | — | — | 2022-03-28 | 2022-04-18 | The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tok | |
CVE-2013-2551 |
Microsoft | Internet Explorer | — | — | 2022-03-28 | 2022-04-18 | Use-after-free vulnerability in Microsoft Internet Explorer allows remote attack | |
CVE-2013-2465 |
Oracle | Java SE | — | — | 2022-03-28 | 2022-04-18 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora | |
CVE-2022-21999 |
Microsoft | Windows | — | — | 2022-03-25 | 2022-04-15 | Microsoft Windows Print Spooler contains an unspecified vulnerability which can | |
CVE-2021-42237 |
Sitecore | XP | — | — | 2022-03-25 | 2022-04-15 | Sitcore XP contains an insecure deserialization vulnerability which can allow fo | |
CVE-2021-22941 |
Citrix | ShareFile | — | — | 2022-03-25 | 2022-04-15 | Improper Access Control in Citrix ShareFile storage zones controller may allow a | |
CVE-2020-2021 |
Palo Alto Networks | PAN-OS | — | — | 2022-03-25 | 2022-04-15 | Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attac | |
CVE-2019-15107 |
Webmin | Webmin | — | — | 2022-03-25 | 2022-04-15 | An issue was discovered in Webmin. The parameter old in password_change.cgi cont | |
CVE-2019-11043 |
PHP | FastCGI Process Manager (FPM) | — | — | 2022-03-25 | 2022-04-15 | In some versions of PHP in certain configurations of FPM setup, it is possible t | |
CVE-2018-1273 |
VMware Tanzu | Spring Data Commons | — | — | 2022-03-25 | 2022-04-15 | Spring Data Commons contains a property binder vulnerability which can allow an | |
CVE-2018-11138 |
Quest | KACE System Management Appliance | — | — | 2022-03-25 | 2022-04-15 | The '/common/download_agent_installer.php' script in the Quest KACE System Manag | |
CVE-2017-12615 |
Apache | Tomcat | — | — | 2022-03-25 | 2022-04-15 | When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to | |
CVE-2017-0146 |
Microsoft | Windows | — | — | 2022-03-25 | 2022-04-15 | The SMBv1 server in Microsoft Windows allows remote attackers to perform remote | |
CVE-2010-2861 |
Adobe | ColdFusion | — | — | 2022-03-25 | 2022-04-15 | A directory traversal vulnerability exists in the administrator console in Adobe | |
CVE-2020-5135 |
SonicWall | SonicOS | — | — | 2022-03-15 | 2022-04-05 | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Den | |
CVE-2019-1405 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when the Windows UPnP service improp | |
CVE-2019-1322 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when Windows improperly handles auth | |
CVE-2019-1315 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when Windows Error Reporting manager | |
CVE-2019-1253 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when the Windows AppX Deployment Ser | |
CVE-2019-1129 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when Windows AppXSVC improperly hand | |
CVE-2019-1069 |
Microsoft | Task Scheduler | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists in the way the Task Scheduler Servic | |
CVE-2019-1064 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when Windows AppXSVC improperly hand | |
CVE-2019-0841 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when Windows AppXSVC improperly hand | |
CVE-2019-0543 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when Windows improperly handles auth | |
CVE-2018-8120 |
Microsoft | Win32k | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists in Windows when the Win32k component | |
CVE-2017-0101 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when the Windows Transaction Manager | |
CVE-2016-3309 |
Microsoft | Windows | — | — | 2022-03-15 | 2022-04-05 | A privilege escalation vulnerability exists when the Windows kernel fails to pro | |
CVE-2015-2546 |
Microsoft | Win32k | — | — | 2022-03-15 | 2022-04-05 | The kernel-mode driver in Microsoft Windows OS and Server allows local users to | |
CVE-2009-3960 |
Adobe | BlazeDS | — | — | 2022-03-07 | 2022-09-07 | Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnera | |
CVE-2021-41379 |
Microsoft | Windows | — | — | 2022-03-03 | 2022-03-17 | Microsoft Windows Installer contains an unspecified vulnerability that allows fo | |
CVE-2018-8581 |
Microsoft | Exchange Server | — | — | 2022-03-03 | 2022-03-17 | A privilege escalation vulnerability exists in Microsoft Exchange Server. An att | |
CVE-2016-4117 |
Adobe | Flash Player | — | — | 2022-03-03 | 2022-03-24 | An access of resource using incompatible type vulnerability exists within Adobe | |
CVE-2016-1019 |
Adobe | Flash Player | — | — | 2022-03-03 | 2022-03-24 | Adobe Flash Player allows remote attackers to cause a denial of service or possi | |
CVE-2016-0099 |
Microsoft | Windows | — | — | 2022-03-03 | 2022-03-24 | A privilege escalation vulnerability exists in Microsoft Windows if the Windows | |
CVE-2015-7645 |
Adobe | Flash Player | — | — | 2022-03-03 | 2022-03-24 | Adobe Flash Player allows remote attackers to execute arbitrary code via a craft | |
CVE-2015-1701 |
Microsoft | Win32k | — | — | 2022-03-03 | 2022-03-24 | An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Micr | |
CVE-2012-4681 |
Oracle | Java SE | — | — | 2022-03-03 | 2022-03-24 | The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote | |
CVE-2012-1723 |
Oracle | Java SE | — | — | 2022-03-03 | 2022-03-24 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora | |
CVE-2012-0507 |
Oracle | Java SE | — | — | 2022-03-03 | 2022-03-24 | An incorrect type vulnerability exists in the Concurrency component of Oracle's | |
CVE-2010-0188 |
Adobe | Reader and Acrobat | — | — | 2022-03-03 | 2022-03-24 | Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause | |
CVE-2008-2992 |
Adobe | Acrobat and Reader | — | — | 2022-03-03 | 2022-03-24 | Adobe Acrobat and Reader contain an input validation issue in a JavaScript metho | |
CVE-2022-24682 |
Synacor | Zimbra Collaborate Suite (ZCS) | — | — | 2022-02-25 | 2022-03-11 | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) v | |
CVE-2019-0752 |
Microsoft | Internet Explorer | — | — | 2022-02-15 | 2022-08-15 | A remote code execution vulnerability exists in the way that the scripting engin | |
CVE-2018-8174 |
Microsoft | Windows | — | — | 2022-02-15 | 2022-08-15 | A remote code execution vulnerability exists in the way that the VBScript engine | |
CVE-2018-20250 |
RARLAB | WinRAR | — | — | 2022-02-15 | 2022-08-15 | WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution | |
CVE-2018-15982 |
Adobe | Flash Player | — | — | 2022-02-15 | 2022-08-15 | Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerabili | |
CVE-2020-0796 |
Microsoft | SMBv3 | — | — | 2022-02-10 | 2022-08-10 | A remote code execution vulnerability exists in the way that the Microsoft Serve | |
CVE-2017-10271 |
Oracle | WebLogic Server | — | — | 2022-02-10 | 2022-08-10 | Oracle Corporation WebLogic Server contains a vulnerability that allows for remo | |
CVE-2017-0145 |
Microsoft | SMBv1 | — | — | 2022-02-10 | 2022-08-10 | The SMBv1 server in multiple Microsoft Windows versions allows remote attackers | |
CVE-2017-0144 |
Microsoft | SMBv1 | — | — | 2022-02-10 | 2022-08-10 | The SMBv1 server in multiple Microsoft Windows versions allows remote attackers | |
CVE-2022-21882 |
Microsoft | Win32k | — | — | 2022-02-04 | 2022-02-18 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege | |
CVE-2021-20038 |
SonicWall | SMA 100 Appliances | — | — | 2022-01-28 | 2022-02-11 | SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer | |
CVE-2020-0787 |
Microsoft | Windows | — | — | 2022-01-28 | 2022-07-28 | Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability i | |
CVE-2018-8453 |
Microsoft | Win32k | — | — | 2022-01-21 | 2022-07-21 | Microsoft Windows Win32k contains a vulnerability that allows an attacker to esc | |
CVE-2021-21975 |
VMware | vRealize Operations Manager API | — | — | 2022-01-18 | 2022-02-01 | Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8 | |
CVE-2019-1458 |
Microsoft | Win32k | — | — | 2022-01-10 | 2022-07-10 | A privilege escalation vulnerability exists in Windows when the Win32k component | |
CVE-2019-2725 |
Oracle | WebLogic Server | — | — | 2022-01-10 | 2022-07-10 | Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion | |
CVE-2018-13382 |
Fortinet | FortiOS and FortiProxy | — | — | 2022-01-10 | 2022-07-10 | An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under | |
CVE-2018-13383 |
Fortinet | FortiOS and FortiProxy | — | — | 2022-01-10 | 2022-07-10 | A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN | |
CVE-2019-1579 |
Palo Alto Networks | PAN-OS | — | — | 2022-01-10 | 2022-07-10 | Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gatew | |
CVE-2021-43890 |
Microsoft | Windows | — | — | 2021-12-15 | 2021-12-29 | Microsoft Windows AppX Installer contains a spoofing vulnerability which has a h | |
CVE-2017-12149 |
Red Hat | JBoss Application Server | — | — | 2021-12-10 | 2022-06-10 | The JBoss Application Server, shipped with Red Hat Enterprise Application Platfo | |
CVE-2021-44228 |
Apache | Log4j2 | — | — | 2021-12-10 | 2021-12-24 | Apache Log4j2 contains a vulnerability where JNDI features do not protect agains | |
CVE-2021-40438 |
Apache | Apache | — | — | 2021-12-01 | 2021-12-15 | A crafted request uri-path can cause mod_proxy to forward the request to an orig | |
CVE-2021-40449 |
Microsoft | Windows | — | — | 2021-11-17 | 2021-12-01 | Unspecified vulnerability allows for an authenticated user to escalate privilege | |
CVE-2021-42321 |
Microsoft | Exchange | — | — | 2021-11-17 | 2021-12-01 | An authenticated attacker could leverage improper validation in cmdlet arguments | |
CVE-2021-27104 |
Accellion | FTA | — | — | 2021-11-03 | 2021-11-17 | Accellion FTA contains an OS command injection vulnerability exploited via a cra | |
CVE-2021-27102 |
Accellion | FTA | — | — | 2021-11-03 | 2021-11-17 | Accellion FTA contains an OS command injection vulnerability exploited via a loc | |
CVE-2021-27101 |
Accellion | FTA | — | — | 2021-11-03 | 2021-11-17 | Accellion FTA contains a SQL injection vulnerability exploited via a crafted hos | |
CVE-2021-27103 |
Accellion | FTA | — | — | 2021-11-03 | 2021-11-17 | Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploi | |
CVE-2018-4878 |
Adobe | Flash Player | — | — | 2021-11-03 | 2022-05-03 | Adobe Flash Player contains a use-after-free vulnerability that could allow for | |
CVE-2021-42013 |
Apache | HTTP Server | — | — | 2021-11-03 | 2021-11-17 | Apache HTTP Server contains a path traversal vulnerability that allows an attack | |
CVE-2021-41773 |
Apache | HTTP Server | — | — | 2021-11-03 | 2021-11-17 | Apache HTTP Server contains a path traversal vulnerability that allows an attack | |
CVE-2017-5638 |
Apache | Struts | — | — | 2021-11-03 | 2022-05-03 | Apache Struts Jakarta Multipart parser allows for malicious file upload using th | |
CVE-2021-26084 |
Atlassian | Confluence Server and Data Center | — | — | 2021-11-03 | 2021-11-17 | Atlassian Confluence Server and Data Server contain an Object-Graph Navigation L | |
CVE-2019-11580 |
Atlassian | Crowd and Crowd Data Center | — | — | 2021-11-03 | 2022-05-03 | Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerabil | |
CVE-2019-3396 |
Atlassian | Confluence Server and Data Server | — | — | 2021-11-03 | 2022-05-03 | Atlassian Confluence Server and Data Center contain a server-side template injec | |
CVE-2021-42258 |
BQE | BillQuick Web Suite | — | — | 2021-11-03 | 2021-11-17 | BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing t | |
CVE-2020-3580 |
Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | — | — | 2021-11-03 | 2022-05-03 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) conta | |
CVE-2019-13608 |
Citrix | StoreFront Server | — | — | 2021-11-03 | 2022-05-03 | Citrix StoreFront Server contains an XML External Entity (XXE) processing vulner | |
CVE-2019-19781 |
Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | — | — | 2021-11-03 | 2022-05-03 | Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models co | |
CVE-2019-11634 |
Citrix | Workspace Application and Receiver for Windows | — | — | 2021-11-03 | 2022-05-03 | Citrix Workspace Application and Receiver for Windows contains remote code execu | |
CVE-2017-9822 |
DotNetNuke (DNN) | DotNetNuke (DNN) | — | — | 2021-11-03 | 2022-05-03 | DotNetNuke (DNN) contains a vulnerability that may allow for remote code executi | |
CVE-2018-7600 |
Drupal | Drupal Core | — | — | 2021-11-03 | 2022-05-03 | Drupal Core contains a remote code execution vulnerability that could allow an a | |
CVE-2021-22205 |
GitLab | Community and Enterprise Editions | — | — | 2021-11-03 | 2021-11-17 | GitHub Community and Enterprise Editions that utilize the ability to upload imag | |
CVE-2018-6789 |
Exim | Exim | — | — | 2021-11-03 | 2022-05-03 | Exim contains a buffer overflow vulnerability in the base64d function part of th | |
CVE-2020-5902 |
F5 | BIG-IP | — | — | 2021-11-03 | 2022-05-03 | F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execut | |
CVE-2021-22986 |
F5 | BIG-IP and BIG-IQ Centralized Management | — | — | 2021-11-03 | 2021-11-17 | F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vuln | |
CVE-2021-35464 |
ForgeRock | Access Management (AM) | — | — | 2021-11-03 | 2021-11-17 | ForgeRock Access Management (AM) Core Server allows an attacker who sends a spec | |
CVE-2019-5591 |
Fortinet | FortiOS | — | — | 2021-11-03 | 2022-05-03 | Fortinet FortiOS contains a default configuration vulnerability that may allow a | |
CVE-2020-12812 |
Fortinet | FortiOS | — | — | 2021-11-03 | 2022-05-03 | Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that | |
CVE-2018-13379 |
Fortinet | FortiOS | — | — | 2021-11-03 | 2022-05-03 | Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that | |
CVE-2021-30116 |
Kaseya | Virtual System/Server Administrator (VSA) | — | — | 2021-11-03 | 2021-11-17 | Kaseya Virtual System/Server Administrator (VSA) contains an information disclos | |
CVE-2014-1812 |
Microsoft | Windows | — | — | 2021-11-03 | 2022-05-03 | Microsoft Windows Active Directory contains a privilege escalation vulnerability | |
CVE-2021-38647 |
Microsoft | Open Management Infrastructure (OMI) | — | — | 2021-11-03 | 2021-11-17 | Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extens | |
CVE-2016-0167 |
Microsoft | Win32k | — | — | 2021-11-03 | 2022-05-03 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege | |
CVE-2020-0878 |
Microsoft | Edge and Internet Explorer | — | — | 2021-11-03 | 2022-05-03 | Microsoft Edge and Internet Explorer contain a memory corruption vulnerability t | |
CVE-2021-34523 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2021-11-17 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2020-0688 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2022-05-03 | Microsoft Exchange Server Validation Key fails to properly create unique keys at | |
CVE-2017-0143 |
Microsoft | Windows | — | — | 2021-11-03 | 2022-05-03 | Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulne | |
CVE-2016-7255 |
Microsoft | Win32k | — | — | 2021-11-03 | 2022-05-03 | Microsoft Win32k kernel-mode driver fails to properly handle objects in memory w | |
CVE-2019-0708 |
Microsoft | Remote Desktop Services | — | — | 2021-11-03 | 2022-05-03 | Microsoft Remote Desktop Services, formerly known as Terminal Service, contains | |
CVE-2021-34473 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2021-11-17 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2021-1732 |
Microsoft | Win32k | — | — | 2021-11-03 | 2021-11-17 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege | |
CVE-2021-34527 |
Microsoft | Windows | — | — | 2021-11-03 | 2022-05-03 | Microsoft Windows Print Spooler contains an unspecified vulnerability due to the | |
CVE-2021-31207 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2021-11-17 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2019-0803 |
Microsoft | Win32k | — | — | 2021-11-03 | 2022-05-03 | Microsoft Win32k contains an unspecified vulnerability due to it failing to prop | |
CVE-2021-26411 |
Microsoft | Internet Explorer | — | — | 2021-11-03 | 2021-11-17 | Microsoft Internet Explorer contains an unspecified vulnerability that allows fo | |
CVE-2019-0859 |
Microsoft | Win32k | — | — | 2021-11-03 | 2022-05-03 | Microsoft Win32k fails to properly handle objects in memory causing privilege es | |
CVE-2021-40444 |
Microsoft | MSHTML | — | — | 2021-11-03 | 2021-11-17 | Microsoft MSHTML contains a unspecified vulnerability that allows for remote cod | |
CVE-2021-36942 |
Microsoft | Windows | — | — | 2021-11-03 | 2021-11-17 | Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerabili | |
CVE-2019-1215 |
Microsoft | Windows | — | — | 2021-11-03 | 2022-05-03 | Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.s | |
CVE-2018-0802 |
Microsoft | Office | — | — | 2021-11-03 | 2022-05-03 | Microsoft Office contains a memory corruption vulnerability due to the way objec | |
CVE-2012-0158 |
Microsoft | MSCOMCTL.OCX | — | — | 2021-11-03 | 2022-05-03 | Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for rem | |
CVE-2017-11882 |
Microsoft | Office | — | — | 2021-11-03 | 2022-05-03 | Microsoft Office contains a memory corruption vulnerability that allows remote c | |
CVE-2019-1367 |
Microsoft | Internet Explorer | — | — | 2021-11-03 | 2022-05-03 | Microsoft Internet Explorer contains a memory corruption vulnerability in how th | |
CVE-2017-0199 |
Microsoft | Office and WordPad | — | — | 2021-11-03 | 2022-05-03 | Microsoft Office and WordPad contain an unspecified vulnerability due to the way | |
CVE-2020-0968 |
Microsoft | Internet Explorer | — | — | 2021-11-03 | 2022-05-03 | Microsoft Internet Explorer contains a memory corruption vulnerability due to ho | |
CVE-2020-1472 |
Microsoft | Netlogon | — | — | 2021-11-03 | 2022-05-03 | Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation v | |
CVE-2021-26855 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2022-05-03 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2021-26858 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2022-05-03 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2021-27065 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2022-05-03 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2021-1675 |
Microsoft | Windows | — | — | 2021-11-03 | 2021-11-17 | Microsoft Windows Print Spooler contains an unspecified vulnerability that allow | |
CVE-2019-0604 |
Microsoft | SharePoint | — | — | 2021-11-03 | 2022-05-03 | Microsoft SharePoint fails to check the source markup of an application package. | |
CVE-2021-26857 |
Microsoft | Exchange Server | — | — | 2021-11-03 | 2022-05-03 | Microsoft Exchange Server contains an unspecified vulnerability that allows for | |
CVE-2021-36955 |
Microsoft | Windows | — | — | 2021-11-03 | 2021-11-17 | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified v | |
CVE-2019-18935 |
Progress | Telerik UI for ASP.NET AJAX | — | — | 2021-11-03 | 2022-05-03 | Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted dat | |
CVE-2021-22893 |
Ivanti | Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a | |
CVE-2019-11510 |
Ivanti | Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that a | |
CVE-2019-11539 |
Ivanti | Pulse Connect Secure and Pulse Policy Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker f | |
CVE-2018-2380 |
SAP | Customer Relationship Management (CRM) | — | — | 2021-11-03 | 2022-05-03 | SAP Customer Relationship Management (CRM) contains a path traversal vulnerabili | |
CVE-2021-35211 |
SolarWinds | Serv-U | — | — | 2021-11-03 | 2021-11-17 | SolarWinds Serv-U contains an unspecified memory escape vulnerability which can | |
CVE-2021-20021 |
SonicWall | SonicWall Email Security | — | — | 2021-11-03 | 2021-11-17 | SonicWall Email Security contains an improper privilege management vulnerability | |
CVE-2019-7481 |
SonicWall | SMA100 | — | — | 2021-11-03 | 2022-05-03 | SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthentica | |
CVE-2021-20022 |
SonicWall | SonicWall Email Security | — | — | 2021-11-03 | 2021-11-17 | SonicWall Email Security contains an unrestricted upload of file with dangerous | |
CVE-2021-20023 |
SonicWall | SonicWall Email Security | — | — | 2021-11-03 | 2021-11-17 | SonicWall Email Security contains a path traversal vulnerability that allows a p | |
CVE-2021-20016 |
SonicWall | SSLVPN SMA100 | — | — | 2021-11-03 | 2021-11-17 | SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remot | |
CVE-2020-12271 |
Sophos | SFOS | — | — | 2021-11-03 | 2022-05-03 | Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulner | |
CVE-2019-5544 |
VMware | VMware ESXi and Horizon DaaS | — | — | 2021-11-03 | 2022-05-03 | VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-base | |
CVE-2020-3992 |
VMware | ESXi | — | — | 2021-11-03 | 2022-05-03 | VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attac | |
CVE-2021-22005 |
VMware | vCenter Server | — | — | 2021-11-03 | 2021-11-17 | VMware vCenter Server contains a file upload vulnerability in the Analytics serv | |
CVE-2021-21972 |
VMware | vCenter Server | — | — | 2021-11-03 | 2021-11-17 | VMware vCenter Server vSphere Client contains a remote code execution vulnerabil | |
CVE-2021-21985 |
VMware | vCenter Server | — | — | 2021-11-03 | 2021-11-17 | VMware vSphere Client contains an improper input validation vulnerability in the | |
CVE-2021-40539 |
Zoho | ManageEngine | — | — | 2021-11-03 | 2021-11-17 | Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerabi |