CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1081–1090 of 1746 records

CVE Vendor Product Added Due Status
CVE-2021-0920 — Android Kernel Race Condition Vulnerability
Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.
 Android Kernel May 23, 2022 Jun 13, 2022
CVE-2021-1048 — Android Kernel Use-After-Free Vulnerability
Android kernel contains a use-after-free vulnerability that allows for privilege escalation.
 Android Kernel May 23, 2022 Jun 13, 2022
CVE-2021-30883 — Apple Multiple Products Memory Corruption Vulnerability
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
 Apple Multiple Products May 23, 2022 Jun 13, 2022
CVE-2022-20821 — Cisco IOS XR Open Port Vulnerability
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
 Cisco IOS XR May 23, 2022 Jun 13, 2022
CVE-2022-22947 — VMware Spring Cloud Gateway Code Injection Vulnerability
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
 VMware Spring Cloud Gateway May 16, 2022 Jun 6, 2022
CVE-2022-30525 — Zyxel Multiple Firewalls OS Command Injection Vulnerability
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
 Zyxel Multiple Firewalls May 16, 2022 Jun 6, 2022
CVE-2022-1388 — F5 BIG-IP Missing Authentication Vulnerability
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
 F5 BIG-IP May 10, 2022 May 31, 2022 Ransomware
CVE-2014-0160 — OpenSSL Information Disclosure Vulnerability
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
 OpenSSL OpenSSL May 4, 2022 May 25, 2022
CVE-2014-0322 — Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
 Microsoft Internet Explorer May 4, 2022 May 25, 2022
CVE-2014-4113 — Microsoft Win32k Privilege Escalation Vulnerability
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
 Microsoft Win32k May 4, 2022 May 25, 2022