The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2021-27562 | UNKNOWN | — | Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers. | Nov 3, 2021 |
| CVE-2021-20090 | UNKNOWN | — | Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors. | Nov 3, 2021 |
| CVE-2020-9859 | UNKNOWN | — | Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges. | Nov 3, 2021 |
| CVE-2021-30869 | UNKNOWN | — | Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges. | Nov 3, 2021 |
| CVE-2021-30713 | UNKNOWN | — | Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. | Nov 3, 2021 |
| CVE-2020-10987 | UNKNOWN | — | Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter. | Nov 3, 2021 |
| CVE-2017-16651 | UNKNOWN | — | Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. | Nov 3, 2021 |
| CVE-2020-3992 | UNKNOWN | — | VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution. | Nov 3, 2021 |
| CVE-2020-5849 | UNKNOWN | — | Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution. | Nov 3, 2021 |
| CVE-2020-24557 | UNKNOWN | — | Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation. | Nov 3, 2021 |
| CVE-2021-20016 | UNKNOWN | — | SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. | Nov 3, 2021 |
| CVE-2020-29583 | UNKNOWN | — | Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password. | Nov 3, 2021 |
| CVE-2019-8394 | UNKNOWN | — | Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization. | Nov 3, 2021 |
| CVE-2017-7269 | UNKNOWN | — | Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request. | Nov 3, 2021 |
| CVE-2020-5735 | UNKNOWN | — | Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code. | Nov 3, 2021 |
| CVE-2016-3718 | UNKNOWN | — | ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image. | Nov 3, 2021 |
| CVE-2020-15505 | UNKNOWN | — | Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution. | Nov 3, 2021 |
| CVE-2020-7961 | UNKNOWN | — | Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services. | Nov 3, 2021 |
| CVE-2021-31201 | UNKNOWN | — | Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. | Nov 3, 2021 |
| CVE-2020-17496 | UNKNOWN | — | The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759. | Nov 3, 2021 |
| CVE-2016-9563 | UNKNOWN | — | SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. | Nov 3, 2021 |
| CVE-2019-1367 | UNKNOWN | — | Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user. | Nov 3, 2021 |
| CVE-2019-1429 | UNKNOWN | — | Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. | Nov 3, 2021 |
| CVE-2017-11774 | UNKNOWN | — | Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands. | Nov 3, 2021 |
| CVE-2020-0968 | UNKNOWN | — | Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. | Nov 3, 2021 |