CISA KEV Catalog

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

Windows DWM Core Library Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthen

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauth

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthe

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauth

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authoriz

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote att

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticat

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject c

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Soft

Microsoft WordPad Information Disclosure Vulnerability

Skype for Business Elevation of Privilege Vulnerability

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to

The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macO

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A mal

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requ

The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClien

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vul

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary m

Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affect

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the cod

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower

Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

Microsoft Word Information Disclosure Vulnerability

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several