The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2017-8570 | UNKNOWN | — | A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. | Feb 25, 2022 |
| CVE-2014-6352 | UNKNOWN | — | Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object. | Feb 25, 2022 |
| CVE-2017-0222 | UNKNOWN | — | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. | Feb 25, 2022 |
| CVE-2022-23134 | UNKNOWN | — | Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. | Feb 22, 2022 |
| CVE-2022-23131 | UNKNOWN | — | Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. | Feb 22, 2022 |
| CVE-2013-3906 | UNKNOWN | — | Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. | Feb 15, 2022 |
| CVE-2019-0752 | UNKNOWN | — | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer | Feb 15, 2022 |
| CVE-2022-0609 | UNKNOWN | — | Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Feb 15, 2022 |
| CVE-2017-9841 | UNKNOWN | — | PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. | Feb 15, 2022 |
| CVE-2022-24086 | UNKNOWN | — | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. | Feb 15, 2022 |
| CVE-2014-1761 | UNKNOWN | — | Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. | Feb 15, 2022 |
| CVE-2022-22620 | UNKNOWN | — | Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Feb 11, 2022 |
| CVE-2017-9791 | UNKNOWN | — | The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. | Feb 10, 2022 |
| CVE-2017-0263 | UNKNOWN | — | Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory. | Feb 10, 2022 |
| CVE-2017-0262 | UNKNOWN | — | A remote code execution vulnerability exists in Microsoft Office. | Feb 10, 2022 |
| CVE-2020-0796 | UNKNOWN | — | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. | Feb 10, 2022 |
| CVE-2015-1130 | UNKNOWN | — | The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges. | Feb 10, 2022 |
| CVE-2018-1000861 | UNKNOWN | — | A code execution vulnerability exists in the Stapler web framework used by Jenkins | Feb 10, 2022 |
| CVE-2014-4404 | UNKNOWN | — | Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context. | Feb 10, 2022 |
| CVE-2016-3088 | UNKNOWN | — | The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request | Feb 10, 2022 |
| CVE-2015-2051 | UNKNOWN | — | D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface. | Feb 10, 2022 |
| CVE-2015-1635 | UNKNOWN | — | Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution. | Feb 10, 2022 |
| CVE-2017-8464 | UNKNOWN | — | Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file | Feb 10, 2022 |
| CVE-2020-5722 | UNKNOWN | — | Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root. | Jan 28, 2022 |
| CVE-2014-6271 | UNKNOWN | — | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. | Jan 28, 2022 |