The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2019-0541 | UNKNOWN | — | Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability. | Nov 3, 2021 |
| CVE-2019-0604 | UNKNOWN | — | Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account. | Nov 3, 2021 |
| CVE-2020-0646 | UNKNOWN | — | Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution. | Nov 3, 2021 |
| CVE-2020-6820 | UNKNOWN | — | Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts. | Nov 3, 2021 |
| CVE-2019-17026 | UNKNOWN | — | Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. | Nov 3, 2021 |
| CVE-2019-15949 | UNKNOWN | — | Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root. | Nov 3, 2021 |
| CVE-2020-26919 | UNKNOWN | — | Netgear JGS516PE devices contain a missing function level access control vulnerability. | Nov 3, 2021 |
| CVE-2017-9822 | UNKNOWN | — | DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization. | Nov 3, 2021 |
| CVE-2020-29557 | UNKNOWN | — | D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution. | Nov 3, 2021 |
| CVE-2019-11634 | UNKNOWN | — | Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. | Nov 3, 2021 |
| CVE-2020-17087 | UNKNOWN | — | Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. | Nov 3, 2021 |
| CVE-2021-33742 | UNKNOWN | — | Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. | Nov 3, 2021 |
| CVE-2021-31199 | UNKNOWN | — | Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. | Nov 3, 2021 |
| CVE-2021-31207 | UNKNOWN | — | Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass. | Nov 3, 2021 |
| CVE-2019-19781 | UNKNOWN | — | Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. | Nov 3, 2021 |
| CVE-2020-8196 | UNKNOWN | — | Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. | Nov 3, 2021 |
| CVE-2020-8195 | UNKNOWN | — | Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. | Nov 3, 2021 |
| CVE-2019-13608 | UNKNOWN | — | Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information. | Nov 3, 2021 |
| CVE-2019-1653 | UNKNOWN | — | Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information. | Nov 3, 2021 |
| CVE-2020-3161 | UNKNOWN | — | Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition. | Nov 3, 2021 |
| CVE-2020-3118 | UNKNOWN | — | Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device. | Nov 3, 2021 |
| CVE-2021-22900 | UNKNOWN | — | Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. | Nov 3, 2021 |
| CVE-2021-30665 | UNKNOWN | — | Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2020-6819 | UNKNOWN | — | Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts. | Nov 3, 2021 |
| CVE-2020-11652 | UNKNOWN | — | SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. | Nov 3, 2021 |