The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2021-31956 | UNKNOWN | — | Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. | Nov 3, 2021 |
| CVE-2020-1040 | UNKNOWN | — | Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system. | Nov 3, 2021 |
| CVE-2018-15811 | UNKNOWN | — | DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. | Nov 3, 2021 |
| CVE-2016-7255 | UNKNOWN | — | Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. | Nov 3, 2021 |
| CVE-2017-0143 | UNKNOWN | — | Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. | Nov 3, 2021 |
| CVE-2020-0688 | UNKNOWN | — | Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution. | Nov 3, 2021 |
| CVE-2016-0167 | UNKNOWN | — | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application | Nov 3, 2021 |
| CVE-2021-1879 | UNKNOWN | — | Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2021-21224 | UNKNOWN | — | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2020-17144 | UNKNOWN | — | Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution. | Nov 3, 2021 |
| CVE-2021-21166 | UNKNOWN | — | Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2020-3452 | UNKNOWN | — | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. | Nov 3, 2021 |
| CVE-2021-30761 | UNKNOWN | — | Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2021-30663 | UNKNOWN | — | Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2021-30666 | UNKNOWN | — | Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2021-1871 | UNKNOWN | — | Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2021-1870 | UNKNOWN | — | Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2021-1782 | UNKNOWN | — | Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges. | Nov 3, 2021 |
| CVE-2021-30762 | UNKNOWN | — | Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Nov 3, 2021 |
| CVE-2020-9819 | UNKNOWN | — | Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message. | Nov 3, 2021 |
| CVE-2020-9818 | UNKNOWN | — | Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message. | Nov 3, 2021 |
| CVE-2020-27932 | UNKNOWN | — | Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges. | Nov 3, 2021 |
| CVE-2020-27950 | UNKNOWN | — | Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory. | Nov 3, 2021 |
| CVE-2021-30807 | UNKNOWN | — | Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges. | Nov 3, 2021 |
| CVE-2020-27930 | UNKNOWN | — | Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front. | Nov 3, 2021 |