The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2022-30525 | UNKNOWN | — | A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. | May 16, 2022 |
| CVE-2022-1388 | UNKNOWN | — | F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. | May 10, 2022 |
| CVE-2021-1789 | UNKNOWN | — | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | May 4, 2022 |
| CVE-2014-4113 | UNKNOWN | — | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | May 4, 2022 |
| CVE-2019-8506 | UNKNOWN | — | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | May 4, 2022 |
| CVE-2014-0322 | UNKNOWN | — | Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code. | May 4, 2022 |
| CVE-2014-0160 | UNKNOWN | — | The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information. | May 4, 2022 |
| CVE-2022-29464 | UNKNOWN | — | Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. | Apr 25, 2022 |
| CVE-2021-41357 | UNKNOWN | — | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Apr 25, 2022 |
| CVE-2021-40450 | UNKNOWN | — | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Apr 25, 2022 |
| CVE-2022-0847 | UNKNOWN | — | Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe." | Apr 25, 2022 |
| CVE-2022-26904 | UNKNOWN | — | Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | Apr 25, 2022 |
| CVE-2022-21919 | UNKNOWN | — | Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | Apr 25, 2022 |
| CVE-2019-1003029 | UNKNOWN | — | Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. | Apr 25, 2022 |
| CVE-2019-3568 | UNKNOWN | — | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. | Apr 19, 2022 |
| CVE-2022-22718 | UNKNOWN | — | Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation. | Apr 19, 2022 |
| CVE-2019-16057 | UNKNOWN | — | The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution. | Apr 15, 2022 |
| CVE-2022-22960 | UNKNOWN | — | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. | Apr 15, 2022 |
| CVE-2014-0780 | UNKNOWN | — | InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution. | Apr 15, 2022 |
| CVE-2019-3929 | UNKNOWN | — | Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. | Apr 15, 2022 |
| CVE-2010-5330 | UNKNOWN | — | Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi. | Apr 15, 2022 |
| CVE-2007-3010 | UNKNOWN | — | masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands. | Apr 15, 2022 |
| CVE-2018-7841 | UNKNOWN | — | A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered. | Apr 15, 2022 |
| CVE-2022-1364 | UNKNOWN | — | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Apr 15, 2022 |
| CVE-2016-4523 | UNKNOWN | — | The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS). | Apr 15, 2022 |