The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-21334 | UNKNOWN | — | Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. | Jan 14, 2025 |
| CVE-2025-21333 | UNKNOWN | — | Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges. | Jan 14, 2025 |
| CVE-2024-12686 | UNKNOWN | — | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user. | Jan 13, 2025 |
| CVE-2023-48365 | UNKNOWN | — | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. | Jan 13, 2025 |
| CVE-2020-2883 | UNKNOWN | — | Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. | Jan 7, 2025 |
| CVE-2024-3393 | UNKNOWN | — | Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. | Dec 30, 2024 |
| CVE-2021-44207 | UNKNOWN | — | Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel. | Dec 23, 2024 |
| CVE-2024-12356 | UNKNOWN | — | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user. | Dec 19, 2024 |
| CVE-2021-40407 | UNKNOWN | — | Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. | Dec 18, 2024 |
| CVE-2019-11001 | UNKNOWN | — | Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root. | Dec 18, 2024 |
| CVE-2022-23227 | UNKNOWN | — | NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. | Dec 18, 2024 |
| CVE-2018-14933 | UNKNOWN | — | NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. | Dec 18, 2024 |
| CVE-2024-20767 | UNKNOWN | — | Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. | Dec 16, 2024 |
| CVE-2024-49138 | UNKNOWN | — | Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges. | Dec 10, 2024 |
| CVE-2023-45727 | UNKNOWN | — | North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack. | Dec 3, 2024 |
| CVE-2024-21287 | UNKNOWN | — | Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. | Nov 21, 2024 |
| CVE-2024-44309 | UNKNOWN | — | Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. | Nov 21, 2024 |
| CVE-2024-44308 | UNKNOWN | — | Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. | Nov 21, 2024 |
| CVE-2024-38812 | UNKNOWN | — | VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. | Nov 20, 2024 |
| CVE-2024-38813 | UNKNOWN | — | VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. | Nov 20, 2024 |
| CVE-2024-9465 | UNKNOWN | — | Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. | Nov 14, 2024 |
| CVE-2024-9463 | UNKNOWN | — | Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. | Nov 14, 2024 |
| CVE-2024-43451 | UNKNOWN | — | Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. | Nov 12, 2024 |
| CVE-2014-2120 | UNKNOWN | — | Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. | Nov 12, 2024 |
| CVE-2021-26086 | UNKNOWN | — | Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. | Nov 12, 2024 |