The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2016-0752 | UNKNOWN | — | Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files. | Mar 25, 2022 |
| CVE-2015-0666 | UNKNOWN | — | Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files. | Mar 25, 2022 |
| CVE-2018-0147 | UNKNOWN | — | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. | Mar 25, 2022 |
| CVE-2016-11021 | UNKNOWN | — | setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command. | Mar 25, 2022 |
| CVE-2018-1273 | UNKNOWN | — | Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution. | Mar 25, 2022 |
| CVE-2016-4171 | UNKNOWN | — | Unspecified vulnerability in Adobe Flash Player allows for remote code execution. | Mar 25, 2022 |
| CVE-2017-3881 | UNKNOWN | — | A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. | Mar 25, 2022 |
| CVE-2018-0125 | UNKNOWN | — | A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system. | Mar 25, 2022 |
| CVE-2018-14839 | UNKNOWN | — | LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability. | Mar 25, 2022 |
| CVE-2018-6961 | UNKNOWN | — | VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution. | Mar 25, 2022 |
| CVE-2018-8373 | UNKNOWN | — | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. | Mar 25, 2022 |
| CVE-2019-0903 | UNKNOWN | — | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. | Mar 25, 2022 |
| CVE-2019-1003030 | UNKNOWN | — | Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution. | Mar 25, 2022 |
| CVE-2019-6340 | UNKNOWN | — | In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. | Mar 25, 2022 |
| CVE-2020-1956 | UNKNOWN | — | Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution. | Mar 25, 2022 |
| CVE-2020-7247 | UNKNOWN | — | smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. | Mar 25, 2022 |
| CVE-2021-22941 | UNKNOWN | — | Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. | Mar 25, 2022 |
| CVE-2019-1253 | UNKNOWN | — | A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions. | Mar 15, 2022 |
| CVE-2020-5135 | UNKNOWN | — | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. | Mar 15, 2022 |
| CVE-2019-1322 | UNKNOWN | — | A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. | Mar 15, 2022 |
| CVE-2019-1132 | UNKNOWN | — | A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. | Mar 15, 2022 |
| CVE-2019-1129 | UNKNOWN | — | A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. | Mar 15, 2022 |
| CVE-2019-1069 | UNKNOWN | — | A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations. | Mar 15, 2022 |
| CVE-2019-0841 | UNKNOWN | — | A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. | Mar 15, 2022 |
| CVE-2019-0543 | UNKNOWN | — | A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. | Mar 15, 2022 |