The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2015-2419 | UNKNOWN | — | JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. | Mar 28, 2022 |
| CVE-2012-2034 | UNKNOWN | — | Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS). | Mar 28, 2022 |
| CVE-2017-0037 | UNKNOWN | — | Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution. | Mar 28, 2022 |
| CVE-2017-0059 | UNKNOWN | — | Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site. | Mar 28, 2022 |
| CVE-2017-0213 | UNKNOWN | — | Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application. | Mar 28, 2022 |
| CVE-2018-8405 | UNKNOWN | — | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. | Mar 28, 2022 |
| CVE-2021-26085 | UNKNOWN | — | Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. | Mar 28, 2022 |
| CVE-2022-1096 | UNKNOWN | — | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Mar 28, 2022 |
| CVE-2020-5410 | UNKNOWN | — | Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files. | Mar 25, 2022 |
| CVE-2017-6316 | UNKNOWN | — | A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server. | Mar 25, 2022 |
| CVE-2015-3035 | UNKNOWN | — | Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/. | Mar 25, 2022 |
| CVE-2018-6961 | UNKNOWN | — | VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution. | Mar 25, 2022 |
| CVE-2018-8373 | UNKNOWN | — | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. | Mar 25, 2022 |
| CVE-2015-1187 | UNKNOWN | — | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution. | Mar 25, 2022 |
| CVE-2016-10174 | UNKNOWN | — | The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution. | Mar 25, 2022 |
| CVE-2019-16920 | UNKNOWN | — | Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise. | Mar 25, 2022 |
| CVE-2019-12991 | UNKNOWN | — | Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. | Mar 25, 2022 |
| CVE-2019-10068 | UNKNOWN | — | Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution. | Mar 25, 2022 |
| CVE-2015-1427 | UNKNOWN | — | The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands. | Mar 25, 2022 |
| CVE-2018-8414 | UNKNOWN | — | A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. | Mar 25, 2022 |
| CVE-2014-6332 | UNKNOWN | — | OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site. | Mar 25, 2022 |
| CVE-2015-4068 | UNKNOWN | — | Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service. | Mar 25, 2022 |
| CVE-2016-1555 | UNKNOWN | — | Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution. | Mar 25, 2022 |
| CVE-2020-2506 | UNKNOWN | — | QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information. | Mar 25, 2022 |
| CVE-2022-26143 | UNKNOWN | — | A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system. | Mar 25, 2022 |