← Back to Radar

Vulnerability archive

The complete catalogue of actively exploited vulnerabilities (CISA KEV and EUVD/ENISA) tracked by Radar — search by CVE, vendor, or product.

50 of 1670 vulnerabilities

• CVE: CVE-2022-44877

  Vendor / product: CWP · Control Web Panel

  CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

  View source ↗

  Source: CISA KEV

  Added: 1/17/23

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-41080[watched vendor]

  Vendor / product: Microsoft · Exchange Server

  Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 1/10/23

  Severity: [Known ransomware use]

• CVE: CVE-2023-21674[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 1/10/23

  Severity: [Confirmed active exploitation]

• CVE: CVE-2018-5430

  Vendor / product: TIBCO · JasperReports

  TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

  View source ↗

  Source: CISA KEV

  Added: 12/29/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2018-18809

  Vendor / product: TIBCO · JasperReports

  TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.

  View source ↗

  Source: CISA KEV

  Added: 12/29/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-42856

  Vendor / product: Apple · iOS

  Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.

  View source ↗

  Source: CISA KEV

  Added: 12/14/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-42475[watched vendor]

  Vendor / product: Fortinet · FortiOS

  Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

  View source ↗

  Source: CISA KEV

  Added: 12/13/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-44698[watched vendor]

  Vendor / product: Microsoft · Defender

  Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

  View source ↗

  Source: CISA KEV

  Added: 12/13/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-27518

  Vendor / product: Citrix · Application Delivery Controller (ADC) and Gateway

  Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

  View source ↗

  Source: CISA KEV

  Added: 12/13/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-26500

  Vendor / product: Veeam · Backup & Replication

  The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

  View source ↗

  Source: CISA KEV

  Added: 12/13/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-26501

  Vendor / product: Veeam · Backup & Replication

  The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

  View source ↗

  Source: CISA KEV

  Added: 12/13/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-4262

  Vendor / product: Google · Chromium V8

  Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  View source ↗

  Source: CISA KEV

  Added: 12/5/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2021-35587

  Vendor / product: Oracle · Fusion Middleware

  Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

  View source ↗

  Source: CISA KEV

  Added: 11/28/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-4135

  Vendor / product: Google · Chromium GPU

  Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  View source ↗

  Source: CISA KEV

  Added: 11/28/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-41049[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

  View source ↗

  Source: CISA KEV

  Added: 11/14/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-41091[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-41073[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-41125[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-41128[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2021-25337

  Vendor / product: Samsung · Mobile Devices

  Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2021-25369

  Vendor / product: Samsung · Mobile Devices

  Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2021-25370

  Vendor / product: Samsung · Mobile Devices

  Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.

  View source ↗

  Source: CISA KEV

  Added: 11/8/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-3723

  Vendor / product: Google · Chromium V8

  Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  View source ↗

  Source: CISA KEV

  Added: 10/28/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-42827

  Vendor / product: Apple · iOS and iPadOS

  Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.

  View source ↗

  Source: CISA KEV

  Added: 10/25/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2020-3433[watched vendor]

  Vendor / product: Cisco · AnyConnect Secure

  Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

  View source ↗

  Source: CISA KEV

  Added: 10/24/22

  Severity: [Known ransomware use]

• CVE: CVE-2020-3153[watched vendor]

  Vendor / product: Cisco · AnyConnect Secure

  Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

  View source ↗

  Source: CISA KEV

  Added: 10/24/22

  Severity: [Known ransomware use]

• CVE: CVE-2018-19323

  Vendor / product: GIGABYTE · Multiple Products

  The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

  View source ↗

  Source: CISA KEV

  Added: 10/24/22

  Severity: [Known ransomware use]

• CVE: CVE-2018-19322

  Vendor / product: GIGABYTE · Multiple Products

  The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

  View source ↗

  Source: CISA KEV

  Added: 10/24/22

  Severity: [Known ransomware use]

• CVE: CVE-2018-19321

  Vendor / product: GIGABYTE · Multiple Products

  The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

  View source ↗

  Source: CISA KEV

  Added: 10/24/22

  Severity: [Known ransomware use]

• CVE: CVE-2018-19320

  Vendor / product: GIGABYTE · Multiple Products

  The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

  View source ↗

  Source: CISA KEV

  Added: 10/24/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-41352

  Vendor / product: Synacor · Zimbra Collaboration Suite (ZCS)

  Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

  View source ↗

  Source: CISA KEV

  Added: 10/20/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2021-3493

  Vendor / product: Linux · Kernel

  The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 10/20/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-40684[watched vendor]

  Vendor / product: Fortinet · Multiple Products

  Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

  View source ↗

  Source: CISA KEV

  Added: 10/11/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-41033[watched vendor]

  Vendor / product: Microsoft · Windows COM+ Event System Service

  Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 10/11/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-41082[watched vendor]

  Vendor / product: Microsoft · Exchange Server

  Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/30/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-41040[watched vendor]

  Vendor / product: Microsoft · Exchange Server

  Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/30/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-36804

  Vendor / product: Atlassian · Bitbucket Server and Data Center

  Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

  View source ↗

  Source: CISA KEV

  Added: 9/30/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-3236

  Vendor / product: Sophos · Firewall

  A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/23/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-35405

  Vendor / product: Zoho · ManageEngine

  Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/22/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-40139

  Vendor / product: Trend Micro · Apex One and Apex One as a Service

  Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/15/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2013-6282

  Vendor / product: Linux · Kernel

  The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 9/15/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2013-2597

  Vendor / product: Code Aurora · ACDB Audio Driver

  The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.

  View source ↗

  Source: CISA KEV

  Added: 9/15/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2013-2596

  Vendor / product: Linux · Kernel

  Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 9/15/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2013-2094

  Vendor / product: Linux · Kernel

  Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 9/15/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2010-2568[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.

  View source ↗

  Source: CISA KEV

  Added: 9/15/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-37969[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 9/14/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-32917

  Vendor / product: Apple · iOS, iPadOS, and macOS

  Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.

  View source ↗

  Source: CISA KEV

  Added: 9/14/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-3075

  Vendor / product: Google · Chromium Mojo

  Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  View source ↗

  Source: CISA KEV

  Added: 9/8/22

  Severity: [Confirmed active exploitation]

• CVE: CVE-2022-27593

  Vendor / product: QNAP · Photo Station

  Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

  View source ↗

  Source: CISA KEV

  Added: 9/8/22

  Severity: [Known ransomware use]

• CVE: CVE-2022-26258

  Vendor / product: D-Link · DIR-820L

  D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/8/22

  Severity: [Confirmed active exploitation]