The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2010-0840 | UNKNOWN | — | Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors. | May 25, 2022 |
| CVE-2013-3896 | UNKNOWN | — | Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application. | May 25, 2022 |
| CVE-2013-3993 | UNKNOWN | — | Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data. | May 25, 2022 |
| CVE-2013-7331 | UNKNOWN | — | An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications. | May 25, 2022 |
| CVE-2014-3153 | UNKNOWN | — | The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges. | May 25, 2022 |
| CVE-2014-2817 | UNKNOWN | — | Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. | May 25, 2022 |
| CVE-2014-0546 | UNKNOWN | — | Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context. | May 25, 2022 |
| CVE-2014-4123 | UNKNOWN | — | Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. | May 25, 2022 |
| CVE-2014-8439 | UNKNOWN | — | Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution. | May 25, 2022 |
| CVE-2014-4148 | UNKNOWN | — | A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts. | May 25, 2022 |
| CVE-2015-2360 | UNKNOWN | — | Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS). | May 25, 2022 |
| CVE-2019-3010 | UNKNOWN | — | Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation. | May 25, 2022 |
| CVE-2013-2423 | UNKNOWN | — | Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity. | May 25, 2022 |
| CVE-2015-0310 | UNKNOWN | — | Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism. | May 25, 2022 |
| CVE-2017-0149 | UNKNOWN | — | Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website. | May 24, 2022 |
| CVE-2017-0210 | UNKNOWN | — | A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information. | May 24, 2022 |
| CVE-2017-8291 | UNKNOWN | — | Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile. | May 24, 2022 |
| CVE-2017-0022 | UNKNOWN | — | Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site. | May 24, 2022 |
| CVE-2017-8543 | UNKNOWN | — | Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory. | May 24, 2022 |
| CVE-2016-0162 | UNKNOWN | — | An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer. | May 24, 2022 |
| CVE-2017-0147 | UNKNOWN | — | The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet. | May 24, 2022 |
| CVE-2016-4657 | UNKNOWN | — | Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | May 24, 2022 |
| CVE-2018-8611 | UNKNOWN | — | A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. | May 24, 2022 |
| CVE-2016-4656 | UNKNOWN | — | A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application. | May 24, 2022 |
| CVE-2016-4655 | UNKNOWN | — | The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application. | May 24, 2022 |