The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2022-22954 | UNKNOWN | — | VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. | Apr 14, 2022 |
| CVE-2015-0313 | UNKNOWN | — | Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code. | Apr 13, 2022 |
| CVE-2015-2502 | UNKNOWN | — | Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS). | Apr 13, 2022 |
| CVE-2015-3113 | UNKNOWN | — | Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code. | Apr 13, 2022 |
| CVE-2015-5122 | UNKNOWN | — | Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). | Apr 13, 2022 |
| CVE-2015-5123 | UNKNOWN | — | Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). | Apr 13, 2022 |
| CVE-2022-24521 | UNKNOWN | — | Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation. | Apr 13, 2022 |
| CVE-2015-0311 | UNKNOWN | — | Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code. | Apr 13, 2022 |
| CVE-2014-9163 | UNKNOWN | — | Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely. | Apr 13, 2022 |
| CVE-2021-22600 | UNKNOWN | — | Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation. | Apr 11, 2022 |
| CVE-2022-23176 | UNKNOWN | — | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. | Apr 11, 2022 |
| CVE-2020-2509 | UNKNOWN | — | QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. | Apr 11, 2022 |
| CVE-2021-27852 | UNKNOWN | — | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. | Apr 11, 2022 |
| CVE-2017-11317 | UNKNOWN | — | Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code. | Apr 11, 2022 |
| CVE-2021-39793 | UNKNOWN | — | Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. | Apr 11, 2022 |
| CVE-2021-3156 | UNKNOWN | — | Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. | Apr 6, 2022 |
| CVE-2017-0148 | UNKNOWN | — | The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. | Apr 6, 2022 |
| CVE-2021-31166 | UNKNOWN | — | Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. | Apr 6, 2022 |
| CVE-2021-45382 | UNKNOWN | — | A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. | Apr 4, 2022 |
| CVE-2022-22674 | UNKNOWN | — | macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. | Apr 4, 2022 |
| CVE-2022-22675 | UNKNOWN | — | macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. | Apr 4, 2022 |
| CVE-2022-22965 | UNKNOWN | — | Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. | Apr 4, 2022 |
| CVE-2022-1040 | UNKNOWN | — | An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. | Mar 31, 2022 |
| CVE-2021-28799 | UNKNOWN | — | QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. | Mar 31, 2022 |
| CVE-2018-10562 | UNKNOWN | — | Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution. | Mar 31, 2022 |