The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2022-22536 | UNKNOWN | — | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches. | Aug 18, 2022 |
| CVE-2022-34713 | UNKNOWN | — | A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application. | Aug 9, 2022 |
| CVE-2022-26138 | UNKNOWN | — | Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group. | Jul 29, 2022 |
| CVE-2022-22047 | UNKNOWN | — | Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges. | Jul 12, 2022 |
| CVE-2022-26925 | UNKNOWN | — | Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM. | Jul 1, 2022 |
| CVE-2019-8605 | UNKNOWN | — | A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges. | Jun 27, 2022 |
| CVE-2020-9907 | UNKNOWN | — | Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. | Jun 27, 2022 |
| CVE-2020-3837 | UNKNOWN | — | Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. | Jun 27, 2022 |
| CVE-2021-30983 | UNKNOWN | — | Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges. | Jun 27, 2022 |
| CVE-2021-30533 | UNKNOWN | — | Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Jun 27, 2022 |
| CVE-2018-4344 | UNKNOWN | — | Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution. | Jun 27, 2022 |
| CVE-2022-29499 | UNKNOWN | — | The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. | Jun 27, 2022 |
| CVE-2021-38163 | UNKNOWN | — | SAP NetWeaver contains a vulnerability that allows unrestricted file upload. | Jun 9, 2022 |
| CVE-2016-2388 | UNKNOWN | — | The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. | Jun 9, 2022 |
| CVE-2016-2386 | UNKNOWN | — | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | Jun 9, 2022 |
| CVE-2019-7193 | UNKNOWN | — | QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system. | Jun 8, 2022 |
| CVE-2019-7195 | UNKNOWN | — | QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. | Jun 8, 2022 |
| CVE-2012-0767 | UNKNOWN | — | Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML. | Jun 8, 2022 |
| CVE-2019-15271 | UNKNOWN | — | A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges. | Jun 8, 2022 |
| CVE-2018-4990 | UNKNOWN | — | Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution. | Jun 8, 2022 |
| CVE-2018-17463 | UNKNOWN | — | Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Jun 8, 2022 |
| CVE-2017-6862 | UNKNOWN | — | Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution. | Jun 8, 2022 |
| CVE-2017-5070 | UNKNOWN | — | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Jun 8, 2022 |
| CVE-2017-5030 | UNKNOWN | — | Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Jun 8, 2022 |
| CVE-2013-1331 | UNKNOWN | — | Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document. | Jun 8, 2022 |