CISA KEV Catalog

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabili

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbit

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By us

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms all

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges l

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privi

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attac

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated att

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. Accordi

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesse

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when findi

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Se

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 thr

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.

Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature loc

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trig

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGF

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain w

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privil

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that i

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a net

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enabl

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit,

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the le

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows Storage Elevation of Privilege Vulnerability