Vulnerabilities (CVE) being actively exploited, according to the CISA KEV catalog, with CVSS severity and exploitation probability (EPSS).
34exploited in the last 30 days
13critical (CVSS ≥ 9)
0used in ransomware
1768in the KEV catalog
CVE-2022-27925Severity under analysisRansomwareadded on 08/11/2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS) · CWE-22
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
CVE-2022-30333Severity under analysisRansomwareadded on 08/09/2022
RARLAB UnRAR Directory Traversal Vulnerability
RARLAB · UnRAR · CWE-22, CWE-59
RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
CVE-2022-27924Severity under analysisRansomwareadded on 08/04/2022
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS) · CWE-93
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
CVE-2022-29499Severity under analysisRansomwareadded on 06/27/2022
Mitel MiVoice Connect Data Validation Vulnerability
Mitel · MiVoice Connect · CWE-20
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
CVE-2021-4034Severity under analysisRansomwareadded on 06/27/2022
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Red Hat · Polkit · CWE-787
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
CVE-2022-30190Severity under analysisRansomwareadded on 06/14/2022
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Microsoft · Windows · CWE-610
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
CVE-2019-7195Severity under analysisRansomwareadded on 06/08/2022
QNAP Photo Station Path Traversal Vulnerability
QNAP · Photo Station · CWE-22
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
CVE-2019-7194Severity under analysisRansomwareadded on 06/08/2022
QNAP Photo Station Path Traversal Vulnerability
QNAP · Photo Station · CWE-22
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
CVE-2019-7193Severity under analysisRansomwareadded on 06/08/2022
QNAP QTS Improper Input Validation Vulnerability
QNAP · QTS · CWE-20
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
CVE-2019-7192Severity under analysisRansomwareadded on 06/08/2022
QNAP Photo Station Improper Access Control Vulnerability
QNAP · Photo Station · CWE-863
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
CVE-2022-26134Severity under analysisRansomwareadded on 06/02/2022
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian · Confluence Server/Data Center · CWE-917
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
CVE-2016-0034Severity under analysisRansomwareadded on 05/25/2022
Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft · Silverlight · CWE-20
Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
CVE-2013-3993Severity under analysisRansomwareadded on 05/25/2022
IBM InfoSphere BigInsights Invalid Input Vulnerability
IBM · InfoSphere BigInsights · CWE-264
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
CVE-2013-0431Severity under analysisRansomwareadded on 05/25/2022
Oracle JRE Sandbox Bypass Vulnerability
Oracle · Java Runtime Environment (JRE)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
CVE-2013-0422Severity under analysisRansomwareadded on 05/25/2022
Oracle JRE Remote Code Execution Vulnerability
Oracle · Java Runtime Environment (JRE) · CWE-264
A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
CVE-2013-0074Severity under analysisRansomwareadded on 05/25/2022
Microsoft Silverlight Double Dereference Vulnerability
Microsoft · Silverlight
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
CVE-2012-1710Severity under analysisRansomwareadded on 05/25/2022
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
CVE-2010-1428Severity under analysisRansomwareadded on 05/25/2022
Red Hat JBoss Information Disclosure Vulnerability
Red Hat · JBoss · CWE-264
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
CVE-2010-0738Severity under analysisRansomwareadded on 05/25/2022
Red Hat JBoss Authentication Bypass Vulnerability
Red Hat · JBoss · CWE-264
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2018-19953Severity under analysisRansomwareadded on 05/24/2022
QNAP NAS File Station Cross-Site Scripting Vulnerability
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
CVE-2017-0147Severity under analysisRansomwareadded on 05/24/2022
Microsoft Windows SMBv1 Information Disclosure Vulnerability
Microsoft · SMBv1 server · CWE-200
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
Want to know if your environment is exposed?
We assess versions, access and integrations of your ERP and infrastructure and prioritize the fixes.
Bit is an AI and can make mistakes. Do not share passwords or personal data. Conversations are not stored. Learn more
Your privacy matters
We use essential cookies to make the site work and, with your permission, Google cookies to measure traffic and show ads — including personalized ones — that keep the tools free. You can change your choice at any time under “Cookie preferences” in the footer. Learn more.
