KEV / Archive / 2021
KEV additions in 2021
Every vulnerability CISA added to the Known Exploited Vulnerabilities catalog in 2021, with monthly counts, vendors and weaknesses.
Answer CISA added 311 vulnerabilities to the KEV catalog in 2021. The busiest month was November 2021, with 291. 84 were flagged as used by ransomware (27%), and the most-listed vendor was Microsoft with 83.
- Added
- 311in 2021
- Ransomware: known
- 27%84 entries
- Vendors
- 73distinct
- Median days to due
- 181dateAdded to dueDate
- Share of catalog
- 18.1%of 1,721
MAdditions per month
Table view
| Month | Added |
|---|---|
| Nov 21 | 291 |
| Dec 21 | 20 |
VTop vendors in 2021
WTop weaknesses in 2021
| CWE | Entries | Share of year |
|---|---|---|
| CWE-20 Improper input validation | 34 | 10.9% |
| CWE-787 Out-of-bounds write | 34 | 10.9% |
| CWE-416 Use after free | 24 | 7.7% |
| CWE-22 Path traversal | 20 | 6.4% |
| CWE-78 OS command injection | 19 | 6.1% |
| CWE-502 Unsafe deserialization | 13 | 4.2% |
| CWE-122 Heap-based buffer overflow | 10 | 3.2% |
| CWE-94 Code injection | 9 | 2.9% |
EAll 311 entries added in 2021
| CVE | Vendor | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|---|
| CVE-2021-43890 | Microsoft | Windows | Microsoft Windows AppX Installer Spoofing Vulnerability | Known | none listed | ||
| CVE-2021-4102 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-44515 | Zoho | Desktop Central | Zoho Desktop Central Authentication Bypass Vulnerability | Unknown | none listed | ||
| CVE-2021-44228 | Apache | Log4j2 | Apache Log4j2 Remote Code Execution Vulnerability | Known | CWE-20, CWE-400, CWE-502 | ||
| CVE-2021-44168 | Fortinet | FortiOS | Fortinet FortiOS Arbitrary File Download | Unknown | CWE-494 | ||
| CVE-2021-35394 | Realtek | Jungle Software Development Kit (SDK) | Realtek Jungle SDK Remote Code Execution Vulnerability | Unknown | CWE-78, CWE-138 | ||
| CVE-2020-8816 | Pi-hole | AdminLTE | Pi-Hole AdminLTE Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-17463 | Fuel CMS | Fuel CMS | Fuel CMS SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2019-7238 | Sonatype | Nexus Repository Manager | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | Unknown | none listed | ||
| CVE-2019-13272 | Linux | Kernel | Linux Kernel Improper Privilege Management Vulnerability | Unknown | CWE-269 | ||
| CVE-2019-10758 | MongoDB | mongo-express | MongoDB mongo-express Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2019-0193 | Apache | Solr | Apache Solr DataImportHandler Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2017-17562 | Embedthis | GoAhead | Embedthis GoAhead Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2017-12149 | Red Hat | JBoss Application Server | Red Hat JBoss Application Server Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2010-1871 | Red Hat | JBoss Seam 2 | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-44077 | Zoho | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | Unknown | CWE-306 | ||
| CVE-2021-40438 | Apache | Apache | Apache HTTP Server-Side Request Forgery (SSRF) | Known | CWE-918 | ||
| CVE-2021-37415 | Zoho | ManageEngine ServiceDesk Plus (SDP) | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | Unknown | CWE-306 | ||
| CVE-2020-11261 | Qualcomm | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2018-14847 | MikroTik | RouterOS | MikroTik Router OS Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-42321 | Microsoft | Exchange | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-184, CWE-502 | ||
| CVE-2021-42292 | Microsoft | Office | Microsoft Excel Security Feature Bypass | Unknown | CWE-357 | ||
| CVE-2021-40449 | Microsoft | Windows | Microsoft Windows Win32k Privilege Escalation Vulnerability | Known | CWE-416 | ||
| CVE-2021-22204 | Perl | Exiftool | ExifTool Remote Code Execution Vulnerability | Unknown | CWE-95 | ||
| CVE-2021-42258 | BQE | BillQuick Web Suite | BQE BillQuick Web Suite SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2021-42013 | Apache | HTTP Server | Apache HTTP Server Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2021-41773 | Apache | HTTP Server | Apache HTTP Server Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2021-40539 | Zoho | ManageEngine | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | Known | CWE-55 | ||
| CVE-2021-40444 | Microsoft | MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | Known | CWE-22 | ||
| CVE-2021-38649 | Microsoft | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-38648 | Microsoft | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Unknown | CWE-1390 | ||
| CVE-2021-38647 | Microsoft | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Known | CWE-1390 | ||
| CVE-2021-38645 | Microsoft | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-38003 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | Unknown | CWE-122, CWE-755 | |||
| CVE-2021-38000 | Chromium Intents | Google Chromium Intents Improper Input Validation Vulnerability | Unknown | CWE-20 | |||
| CVE-2021-37976 | Chromium | Google Chromium Information Disclosure Vulnerability | Unknown | CWE-862 | |||
| CVE-2021-37975 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-37973 | Chromium Portals | Google Chromium Portals Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-36955 | Microsoft | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2021-36948 | Microsoft | Windows | Microsoft Windows Update Medic Service Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-36942 | Microsoft | Windows | Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability | Known | CWE-749 | ||
| CVE-2021-36742 | Trend Micro | Apex One, Apex One as a Service, and Worry-Free Business Security | Trend Micro Multiple Products Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-36741 | Trend Micro | Apex One, Apex One as a Service, and Worry-Free Business Security | Trend Micro Multiple Products Improper Input Validation Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-35464 | ForgeRock | Access Management (AM) | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2021-35395 | Realtek | AP-Router SDK | Realtek AP-Router SDK Buffer Overflow Vulnerability | Unknown | CWE-20, CWE-122 | ||
| CVE-2021-35211 | SolarWinds | Serv-U | SolarWinds Serv-U Remote Code Execution Vulnerability | Known | CWE-787 | ||
| CVE-2021-34527 | Microsoft | Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | Known | CWE-269 | ||
| CVE-2021-34523 | Microsoft | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Known | CWE-287 | ||
| CVE-2021-34473 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-918 | ||
| CVE-2021-34448 | Microsoft | Windows | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-33771 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-33742 | Microsoft | Windows | Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability | Unknown | CWE-787, CWE-823 | ||
| CVE-2021-33739 | Microsoft | Windows | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-31979 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-31956 | Microsoft | Windows | Microsoft Windows NTFS Privilege Escalation Vulnerability | Unknown | CWE-191, CWE-787 | ||
| CVE-2021-31955 | Microsoft | Windows | Microsoft Windows Kernel Information Disclosure Vulnerability | Unknown | CWE-497 | ||
| CVE-2021-31755 | Tenda | AC11 Router | Tenda AC11 Router Stack Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-31207 | Microsoft | Exchange Server | Microsoft Exchange Server Security Feature Bypass Vulnerability | Known | CWE-20, CWE-434 | ||
| CVE-2021-31201 | Microsoft | Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-31199 | Microsoft | Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-30869 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2021-30860 | Apple | Multiple Products | Apple Multiple Products Integer Overflow Vulnerability | Unknown | CWE-20, CWE-190 | ||
| CVE-2021-30858 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, macOS Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-30807 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-30762 | Apple | iOS | Apple iOS WebKit Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-30761 | Apple | iOS | Apple iOS WebKit Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-30713 | Apple | macOS | Apple macOS Unspecified Vulnerability | Unknown | CWE-862 | ||
| CVE-2021-30666 | Apple | iOS | Apple iOS WebKit Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-30665 | Apple | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-30663 | Apple | Multiple Products | Apple Multiple Products WebKit Integer Overflow Vulnerability | Unknown | CWE-20, CWE-190 | ||
| CVE-2021-30661 | Apple | Multiple Products | Apple Multiple Products WebKit Storage Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-30657 | Apple | macOS | Apple macOS Unspecified Vulnerability | Unknown | CWE-862 | ||
| CVE-2021-30633 | Chromium Indexed DB API | Google Chromium Indexed DB API Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-30632 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | Unknown | CWE-122 | |||
| CVE-2021-30563 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-122, CWE-843 | |||
| CVE-2021-30554 | Chromium WebGL | Google Chromium WebGL Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-30551 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-122, CWE-843 | |||
| CVE-2021-30116 | Kaseya | Virtual System/Server Administrator (VSA) | Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability | Known | CWE-522 | ||
| CVE-2021-28664 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-28663 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-28550 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-28310 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-27562 | Arm | Trusted Firmware | Arm Trusted Firmware Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-27561 | Yealink | Device Management | Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability | Unknown | CWE-78 | ||
| CVE-2021-27104 | Accellion | FTA | Accellion FTA OS Command Injection Vulnerability | Known | CWE-20, CWE-78 | ||
| CVE-2021-27103 | Accellion | FTA | Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability | Known | CWE-918 | ||
| CVE-2021-27102 | Accellion | FTA | Accellion FTA OS Command Injection Vulnerability | Known | CWE-20, CWE-78 | ||
| CVE-2021-27101 | Accellion | FTA | Accellion FTA SQL Injection Vulnerability | Known | CWE-89, CWE-138 | ||
| CVE-2021-27085 | Microsoft | Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2021-27065 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-39 | ||
| CVE-2021-27059 | Microsoft | Office | Microsoft Office Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2021-26858 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2021-26857 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2021-26855 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-918 | ||
| CVE-2021-26411 | Microsoft | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Known | CWE-416 | ||
| CVE-2021-26084 | Atlassian | Confluence Server and Data Center | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | Known | CWE-917 | ||
| CVE-2021-23874 | McAfee | McAfee Total Protection (MTP) | McAfee Total Protection (MTP) Improper Privilege Management Vulnerability | Unknown | CWE-284 | ||
| CVE-2021-22986 | F5 | BIG-IP and BIG-IQ Centralized Management | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | Known | CWE-863 | ||
| CVE-2021-22900 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | Unknown | CWE-94 | ||
| CVE-2021-22899 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2021-22894 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | Unknown | CWE-94 | ||
| CVE-2021-22893 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | Known | CWE-287 | ||
| CVE-2021-22506 | Micro Focus | Micro Focus Access Manager | Micro Focus Access Manager Information Leakage Vulnerability | Unknown | none listed | ||
| CVE-2021-22502 | Micro Focus | Operation Bridge Reporter (OBR) | Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability | Unknown | CWE-20, CWE-78 | ||
| CVE-2021-22205 | GitLab | Community and Enterprise Editions | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | Known | CWE-20, CWE-95 | ||
| CVE-2021-22005 | VMware | vCenter Server | VMware vCenter Server File Upload Vulnerability | Known | CWE-23 | ||
| CVE-2021-21985 | VMware | vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | Known | CWE-20, CWE-470, CWE-918 | ||
| CVE-2021-21972 | VMware | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | Known | CWE-23 | ||
| CVE-2021-21224 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2021-21220 | Chromium V8 | Google Chromium V8 Improper Input Validation Vulnerability | Unknown | CWE-20, CWE-122 | |||
| CVE-2021-21206 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-21193 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2021-21166 | Chromium | Google Chromium Race Condition Vulnerability | Unknown | CWE-122, CWE-362 | |||
| CVE-2021-21148 | Chromium V8 | Google Chromium V8 Heap Buffer Overflow Vulnerability | Unknown | CWE-122 | |||
| CVE-2021-21017 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2021-20090 | Arcadyan | Buffalo Firmware | Arcadyan Buffalo Firmware Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-20023 | SonicWall | SonicWall Email Security | SonicWall Email Security Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2021-20022 | SonicWall | SonicWall Email Security | SonicWall Email Security Unrestricted Upload of File Vulnerability | Known | CWE-434 | ||
| CVE-2021-20021 | SonicWall | SonicWall Email Security | SonicWall Email Security Improper Privilege Management Vulnerability | Known | CWE-306 | ||
| CVE-2021-20016 | SonicWall | SSLVPN SMA100 | SonicWall SSLVPN SMA100 SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2021-1906 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability | Unknown | CWE-390 | ||
| CVE-2021-1905 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-1879 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2021-1871 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | Unknown | CWE-1173 | ||
| CVE-2021-1870 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | Unknown | CWE-1173 | ||
| CVE-2021-1782 | Apple | Multiple Products | Apple Multiple Products Race Condition Vulnerability | Unknown | CWE-362, CWE-667 | ||
| CVE-2021-1732 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-787 | ||
| CVE-2021-1675 | Microsoft | Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | Known | CWE-285 | ||
| CVE-2021-1647 | Microsoft | Defender | Microsoft Defender Remote Code Execution Vulnerability | Unknown | CWE-122, CWE-1285 | ||
| CVE-2021-1498 | Cisco | HyperFlex HX | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2021-1497 | Cisco | HyperFlex HX | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-9859 | Apple | Multiple Products | Apple Multiple Products Code Execution Vulnerability | Unknown | CWE-415 | ||
| CVE-2020-9819 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-9818 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-8657 | EyesOfNetwork | EyesOfNetwork | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability | Unknown | CWE-798 | ||
| CVE-2020-8655 | EyesOfNetwork | EyesOfNetwork | EyesOfNetwork Improper Privilege Management Vulnerability | Unknown | CWE-269 | ||
| CVE-2020-8644 | PlaySMS | PlaySMS | PlaySMS Server-Side Template Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2020-8599 | Trend Micro | Apex One and OfficeScan | Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability | Unknown | none listed | ||
| CVE-2020-8515 | DrayTek | Multiple Vigor Routers | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-8468 | Trend Micro | Apex One, OfficeScan and Worry-Free Business Security Agents | Trend Micro Multiple Products Content Validation Escape Vulnerability | Unknown | CWE-74 | ||
| CVE-2020-8467 | Trend Micro | Apex One and OfficeScan | Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-8260 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | Unknown | CWE-434 | ||
| CVE-2020-8243 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2020-8196 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | Unknown | CWE-284 | ||
| CVE-2020-8195 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | Unknown | CWE-20 | ||
| CVE-2020-8193 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | Unknown | CWE-284 | ||
| CVE-2020-7961 | Liferay | Liferay Portal | Liferay Portal Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2020-6820 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | Unknown | CWE-362 | ||
| CVE-2020-6819 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | Unknown | CWE-362, CWE-416 | ||
| CVE-2020-6418 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2020-6287 | SAP | NetWeaver | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2020-6207 | SAP | Solution Manager | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2020-5902 | F5 | BIG-IP | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | Known | CWE-22 | ||
| CVE-2020-5849 | Unraid | Unraid | Unraid Authentication Bypass Vulnerability | Unknown | CWE-287, CWE-697 | ||
| CVE-2020-5847 | Unraid | Unraid | Unraid Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-5735 | Amcrest | Cameras and Network Video Recorder (NVR) | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability | Unknown | CWE-121 | ||
| CVE-2020-4430 | IBM | Data Risk Manager | IBM Data Risk Manager Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2020-4428 | IBM | Data Risk Manager | IBM Data Risk Manager Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-4427 | IBM | Data Risk Manager | IBM Data Risk Manager Security Bypass Vulnerability | Unknown | none listed | ||
| CVE-2020-4006 | VMware | Multiple Products | Multiple VMware Products Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-3992 | VMware | ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2020-3952 | VMware | vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | Unknown | CWE-306 | ||
| CVE-2020-3950 | VMware | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | Unknown | CWE-269 | ||
| CVE-2020-3580 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | Known | CWE-79 | ||
| CVE-2020-3569 | Cisco | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | Unknown | CWE-400 | ||
| CVE-2020-3566 | Cisco | IOS XR | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | Unknown | CWE-400 | ||
| CVE-2020-3452 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | Unknown | CWE-20 | ||
| CVE-2020-3161 | Cisco | Cisco IP Phones | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | Unknown | CWE-20 | ||
| CVE-2020-3118 | Cisco | IOS XR | Cisco IOS XR Software Discovery Protocol Format String Vulnerability | Unknown | CWE-134 | ||
| CVE-2020-29583 | Zyxel | Multiple Products | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | Unknown | CWE-522 | ||
| CVE-2020-29557 | D-Link | DIR-825 R1 Devices | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2020-27950 | Apple | Multiple Products | Apple Multiple Products Memory Initialization Vulnerability | Unknown | CWE-665 | ||
| CVE-2020-27932 | Apple | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2020-27930 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-26919 | NETGEAR | JGS516PE Devices | Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability | Unknown | none listed | ||
| CVE-2020-2555 | Oracle | Multiple Products | Oracle Multiple Products Remote Code Execution Vulnerability | Unknown | CWE-502 | ||
| CVE-2020-25506 | D-Link | DNS-320 Device | D-Link DNS-320 Device Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-25213 | WordPress | File Manager Plugin | WordPress File Manager Plugin Remote Code Execution Vulnerability | Unknown | CWE-434 | ||
| CVE-2020-24557 | Trend Micro | Apex One, OfficeScan, and Worry-Free Business Security | Trend Micro Multiple Products Improper Access Control Vulnerability | Unknown | none listed | ||
| CVE-2020-17530 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability | Unknown | CWE-917 | ||
| CVE-2020-17496 | vBulletin | vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | Unknown | CWE-74 | ||
| CVE-2020-17144 | Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Unknown | CWE-502 | ||
| CVE-2020-17087 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-131 | ||
| CVE-2020-16846 | SaltStack | Salt | SaltStack Salt Shell Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-16017 | Chrome | Google Chrome Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2020-16013 | Chromium V8 | Google Chromium V8 Incorrect Implementation Vulnerabililty | Unknown | CWE-787 | |||
| CVE-2020-16010 | Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | |||
| CVE-2020-16009 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-787, CWE-843 | |||
| CVE-2020-15999 | Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | |||
| CVE-2020-15505 | Ivanti | MobileIron Multiple Products | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | Unknown | CWE-706 | ||
| CVE-2020-14883 | Oracle | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2020-14882 | Oracle | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-14871 | Oracle | Solaris and Zettabyte File System (ZFS) | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-14750 | Oracle | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-1472 | Microsoft | Netlogon | Microsoft Netlogon Privilege Escalation Vulnerability | Known | CWE-330 | ||
| CVE-2020-1464 | Microsoft | Windows | Microsoft Windows Spoofing Vulnerability | Unknown | CWE-347 | ||
| CVE-2020-1380 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-1350 | Microsoft | Windows | Microsoft Windows DNS Server Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-12812 | Fortinet | FortiOS | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | Known | CWE-178, CWE-287 | ||
| CVE-2020-12271 | Sophos | SFOS | Sophos SFOS SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2020-11738 | WordPress | Snap Creek Duplicator Plugin | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | Unknown | CWE-22 | ||
| CVE-2020-11652 | SaltStack | Salt | SaltStack Salt Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2020-11651 | SaltStack | Salt | SaltStack Salt Authentication Bypass Vulnerability | Unknown | none listed | ||
| CVE-2020-1147 | Microsoft | .NET Framework, SharePoint, Visual Studio | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-10987 | Tenda | AC1900 Router AC15 Model | Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-1054 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-1040 | Microsoft | Hyper-V RemoteFX | Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2020-10221 | rConfig | rConfig | rConfig OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-1020 | Microsoft | Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-10199 | Sonatype | Nexus Repository | Sonatype Nexus Repository Remote Code Execution Vulnerability | Unknown | CWE-917 | ||
| CVE-2020-10189 | Zoho | ManageEngine | Zoho ManageEngine Desktop Central File Upload Vulnerability | Unknown | CWE-502 | ||
| CVE-2020-10181 | Sumavision | Enhanced Multimedia Router (EMR) | Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability | Unknown | CWE-352 | ||
| CVE-2020-10148 | SolarWinds | Orion | SolarWinds Orion Authentication Bypass Vulnerability | Unknown | CWE-288 | ||
| CVE-2020-0986 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0968 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2020-0938 | Microsoft | Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0878 | Microsoft | Edge and Internet Explorer | Microsoft Edge and Internet Explorer Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2020-0688 | Microsoft | Exchange Server | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | Known | CWE-287 | ||
| CVE-2020-0683 | Microsoft | Windows | Microsoft Windows Installer Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2020-0674 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-416 | ||
| CVE-2020-0646 | Microsoft | .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | Unknown | CWE-91 | ||
| CVE-2020-0601 | Microsoft | Windows | Microsoft Windows CryptoAPI Spoofing Vulnerability | Unknown | CWE-295 | ||
| CVE-2020-0069 | MediaTek | Multiple Chipsets | Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0041 | Android | Android Kernel | Android Kernel Out-of-Bounds Write Vulnerability | Unknown | CWE-20 | ||
| CVE-2019-9978 | WordPress | Social Warfare Plugin | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2019-9082 | ThinkPHP | ThinkPHP | ThinkPHP Remote Code Execution Vulnerability | Unknown | CWE-306, CWE-94 | ||
| CVE-2019-8394 | Zoho | ManageEngine | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability | Unknown | CWE-434 | ||
| CVE-2019-7481 | SonicWall | SMA100 | SonicWall SMA100 SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2019-6223 | Apple | iOS and macOS | Apple iOS and macOS Group Facetime Vulnerability | Unknown | none listed | ||
| CVE-2019-5591 | Fortinet | FortiOS | Fortinet FortiOS Default Configuration Vulnerability | Known | CWE-306 | ||
| CVE-2019-5544 | VMware | VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | Known | CWE-787 | ||
| CVE-2019-4716 | IBM | Planning Analytics | IBM Planning Analytics Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2019-3398 | Atlassian | Confluence Server and Data Center | Atlassian Confluence Server and Data Center Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2019-3396 | Atlassian | Confluence Server and Data Server | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | Known | CWE-22 | ||
| CVE-2019-2215 | Android | Android Kernel | Android Kernel Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2019-20085 | TVT | NVMS-1000 | TVT NVMS-1000 Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2019-19781 | Citrix | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | Known | CWE-22 | ||
| CVE-2019-19356 | Netis | WF2419 Devices | Netis WF2419 Devices Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2019-18988 | TeamViewer | Desktop | TeamViewer Desktop Bypass Remote Login Vulnerability | Unknown | CWE-521 | ||
| CVE-2019-18935 | Progress | Telerik UI for ASP.NET AJAX | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2019-18187 | Trend Micro | OfficeScan | Trend Micro OfficeScan Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2019-17558 | Apache | Solr | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | Unknown | CWE-74 | ||
| CVE-2019-17026 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2019-16759 | vBulletin | vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2019-1653 | Cisco | Small Business RV320 and RV325 Routers | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | Unknown | CWE-284 | ||
| CVE-2019-16256 | SIMalliance | Toolbox Browser | SIMalliance Toolbox Browser Command Injection Vulnerability | Unknown | none listed | ||
| CVE-2019-15949 | Nagios | Nagios XI | Nagios XI Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2019-15752 | Docker | Desktop Community Edition | Docker Desktop Community Edition Privilege Escalation Vulnerability | Unknown | CWE-732 | ||
| CVE-2019-1429 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-416, CWE-787 | ||
| CVE-2019-1367 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2019-13608 | Citrix | StoreFront Server | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | Known | CWE-611 | ||
| CVE-2019-1215 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-1214 | Microsoft | Windows | Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-11634 | Citrix | Workspace Application and Receiver for Windows | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2019-11580 | Atlassian | Crowd and Crowd Data Center | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2019-11539 | Ivanti | Pulse Connect Secure and Pulse Policy Secure | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability | Known | CWE-78 | ||
| CVE-2019-11510 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | Known | CWE-22 | ||
| CVE-2019-0863 | Microsoft | Windows | Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0859 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-0808 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0803 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-0797 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0708 | Microsoft | Remote Desktop Services | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | Known | CWE-416 | ||
| CVE-2019-0604 | Microsoft | SharePoint | Microsoft SharePoint Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2019-0541 | Microsoft | MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | Unknown | CWE-77 | ||
| CVE-2019-0211 | Apache | HTTP Server | Apache HTTP Server Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2018-8653 | Microsoft | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2018-7600 | Drupal | Drupal Core | Drupal Core Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2018-6789 | Exim | Exim | Exim Buffer Overflow Vulnerability | Known | CWE-119 | ||
| CVE-2018-4939 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2018-4878 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2018-2380 | SAP | Customer Relationship Management (CRM) | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2018-20062 | ThinkPHP | noneCms | ThinkPHP "noneCms" Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2018-18325 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | Unknown | CWE-326 | ||
| CVE-2018-15961 | Adobe | ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | Unknown | CWE-434 | ||
| CVE-2018-15811 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | Unknown | CWE-326 | ||
| CVE-2018-14558 | Tenda | AC7, AC9, and AC10 Routers | Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2018-13379 | Fortinet | FortiOS | Fortinet FortiOS SSL VPN Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2018-11776 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2018-0802 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2018-0798 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2018-0296 | Cisco | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability | Unknown | CWE-20 | ||
| CVE-2018-0171 | Cisco | IOS and IOS XE | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2017-9822 | DotNetNuke (DNN) | DotNetNuke (DNN) | DotNetNuke (DNN) Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2017-9805 | Apache | Struts | Apache Struts Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2017-9248 | Progress | ASP.NET AJAX and Sitefinity | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability | Unknown | CWE-522 | ||
| CVE-2017-8759 | Microsoft | .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2017-7269 | Microsoft | Internet Information Services (IIS) | Microsoft Windows Server Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-6327 | Symantec | Symantec Messaging Gateway | Symantec Messaging Gateway Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2017-5638 | Apache | Struts | Apache Struts Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2017-16651 | Roundcube | Roundcube Webmail | Roundcube Webmail File Disclosure Vulnerability | Unknown | CWE-552 | ||
| CVE-2017-11882 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | Known | CWE-119 | ||
| CVE-2017-11774 | Microsoft | Office | Microsoft Office Outlook Security Feature Bypass Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-0199 | Microsoft | Office and WordPad | Microsoft Office and WordPad Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2017-0143 | Microsoft | Windows | Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2016-9563 | SAP | NetWeaver | SAP NetWeaver XML External Entity (XXE) Vulnerability | Unknown | CWE-611 | ||
| CVE-2016-7255 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2016-4437 | Apache | Shiro | Apache Shiro Code Execution Vulnerability | Unknown | CWE-284 | ||
| CVE-2016-3976 | SAP | NetWeaver | SAP NetWeaver Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2016-3718 | ImageMagick | ImageMagick | ImageMagick Server-Side Request Forgery (SSRF) Vulnerability | Unknown | CWE-20 | ||
| CVE-2016-3715 | ImageMagick | ImageMagick | ImageMagick Arbitrary File Deletion Vulnerability | Unknown | CWE-284 | ||
| CVE-2016-3643 | SolarWinds | Virtualization Manager | SolarWinds Virtualization Manager Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2016-3235 | Microsoft | Office | Microsoft Office OLE DLL Side Loading Vulnerability | Unknown | CWE-264 | ||
| CVE-2016-0185 | Microsoft | Windows | Microsoft Windows Media Center Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2016-0167 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2015-4852 | Oracle | WebLogic Server | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2015-1641 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | Unknown | CWE-399 | ||
| CVE-2014-1812 | Microsoft | Windows | Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability | Known | CWE-255 | ||
| CVE-2012-3152 | Oracle | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2012-0158 | Microsoft | MSCOMCTL.OCX | Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability | Known | CWE-94 | ||
| CVE-2010-5326 | SAP | NetWeaver | SAP NetWeaver Remote Code Execution Vulnerability | Unknown | none listed |
Cite this
CISA added 311 vulnerabilities to its KEV catalog in 2021. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/kev/2021/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.