Cross-Vendor Patch Advisories
Every vendor except Microsoft: CISA KEV advisories scored on the EVULNABLE Risk scale, Linux distribution advisories, and vendor security bulletins.
Browse Advisories
1,308 of 1,308 advisories match the current filters, sorted by EVULNABLE Risk.
| CVE | Vendor | Product | Vulnerability | EVRS | EPSS | Ransomware | CISA due |
|---|---|---|---|---|---|---|---|
| CVE-2023-37580 | Synacor | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 75 Urgent | 0.467 (98.7th pctl) | Unknown/None | 2023-08-17 |
| CVE-2016-3976 | SAP | NetWeaver | SAP NetWeaver Directory Traversal Vulnerability | 75 Urgent | 0.466 (98.7th pctl) | Unknown/None | 2022-05-03 |
| CVE-2019-17026 | Mozilla | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Type Confusion Vulnerability | 75 Urgent | 0.466 (98.7th pctl) | Unknown/None | 2022-05-03 |
| CVE-2022-39197 | Fortra | Cobalt Strike | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | 75 Urgent | 0.464 (98.7th pctl) | Unknown/None | 2023-04-20 |
| CVE-2020-15999 | Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | 75 Urgent | 0.443 (98.7th pctl) | Unknown/None | 2021-11-17 | |
| CVE-2024-9379 | Ivanti | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | 75 Urgent | 0.438 (98.7th pctl) | Unknown/None | 2024-10-30 |
| CVE-2025-2775 | SysAid | SysAid On-Prem | SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability | 75 Urgent | 0.430 (98.6th pctl) | Unknown/None | 2025-08-12 |
| CVE-2017-6862 | NETGEAR | Multiple Devices | NETGEAR Multiple Devices Buffer Overflow Vulnerability | 75 Urgent | 0.427 (98.6th pctl) | Unknown/None | 2022-06-22 |
| CVE-2017-6737 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | 75 Urgent | 0.426 (98.6th pctl) | Unknown/None | 2022-03-24 |
| CVE-2014-100005 | D-Link | DIR-600 Router | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability | 75 Urgent | 0.424 (98.6th pctl) | Unknown/None | 2024-06-06 |
| CVE-2023-33538 | TP-Link | Multiple Routers | TP-Link Multiple Routers Command Injection Vulnerability | 75 Urgent | 0.419 (98.6th pctl) | Unknown/None | 2025-07-07 |
| CVE-2021-44026 | Roundcube | Roundcube Webmail | Roundcube Webmail SQL Injection Vulnerability | 75 Urgent | 0.419 (98.6th pctl) | Unknown/None | 2023-07-13 |
| CVE-2017-5030 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | 75 Urgent | 0.417 (98.6th pctl) | Unknown/None | 2022-06-22 | |
| CVE-2024-41710 | Mitel | SIP Phones | Mitel SIP Phones Argument Injection Vulnerability | 75 Urgent | 0.416 (98.6th pctl) | Unknown/None | 2025-03-05 |
| CVE-2019-16928 | Exim | Exim Internet Mailer | Exim Out-of-bounds Write Vulnerability | 75 Urgent | 0.416 (98.6th pctl) | Unknown/None | 2022-03-17 |
| CVE-2011-1823 | Android | Android OS | Android OS Privilege Escalation Vulnerability | 75 Urgent | 0.416 (98.6th pctl) | Unknown/None | 2022-09-29 |
| CVE-2021-22894 | Ivanti | Pulse Connect Secure | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | 75 Urgent | 0.413 (98.6th pctl) | Unknown/None | 2022-05-03 |
| CVE-2023-2033 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 75 Urgent | 0.408 (98.6th pctl) | Unknown/None | 2023-05-08 | |
| CVE-2015-0666 | Cisco | Prime Data Center Network Manager (DCNM) | Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability | 75 Urgent | 0.404 (98.5th pctl) | Unknown/None | 2022-04-15 |
| CVE-2014-0496 | Adobe | Reader and Acrobat | Adobe Reader and Acrobat Use-After-Free Vulnerability | 75 Urgent | 0.402 (98.5th pctl) | Unknown/None | 2022-03-24 |
| CVE-2026-18556 | N-able | N-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | 75 Urgent | 0.402 (98.5th pctl) | Unknown/None | 2026-08-07 |
| CVE-2026-28318 | SolarWinds | Serv-U | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | 75 Urgent | 0.400 (98.5th pctl) | Unknown/None | 2026-06-19 |
| CVE-2023-4762 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 75 Urgent | 0.399 (98.5th pctl) | Unknown/None | 2024-02-27 | |
| CVE-2021-27860 | FatPipe | WARP, IPVPN, and MPVPN software | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | 75 Urgent | 0.398 (98.5th pctl) | Unknown/None | 2022-01-24 |
| CVE-2013-6282 | Linux | Kernel | Linux Kernel Improper Input Validation Vulnerability | 75 Urgent | 0.397 (98.5th pctl) | Unknown/None | 2022-10-06 |
Exactly the 1,308 advisory(ies) matching the filters above.
Advisory detail
Expand any advisory for its description, CISA's own required action, and research links.
CVE-2023-37580 — Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS: 6.1 (NVD)
FIRST EPSS: 0.467 (98.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-07-27
CISA remediation due: 2023-08-17
Known ransomware campaign use: Unknown/None
CVE-2016-3976 — SAP NetWeaver: SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.466 (98.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2022-05-03
Known ransomware campaign use: Unknown/None
CVE-2019-17026 — Mozilla Firefox and Thunderbird: Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.466 (98.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2022-05-03
Known ransomware campaign use: Unknown/None
CVE-2022-39197 — Fortra Cobalt Strike: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 6.1 (NVD)
FIRST EPSS: 0.464 (98.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-03-30
CISA remediation due: 2023-04-20
Known ransomware campaign use: Unknown/None
CVE-2020-15999 — Google Chrome FreeType: Google Chrome FreeType Heap Buffer Overflow Vulnerability
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.6 (NVD)
FIRST EPSS: 0.443 (98.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2021-11-17
Known ransomware campaign use: Unknown/None
CVE-2024-9379 — Ivanti Cloud Services Appliance (CSA): Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
CVSS: 7.2 (NVD)
FIRST EPSS: 0.438 (98.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-10-09
CISA remediation due: 2024-10-30
Known ransomware campaign use: Unknown/None
CVE-2025-2775 — SysAid SysAid On-Prem: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.430 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-07-22
CISA remediation due: 2025-08-12
Known ransomware campaign use: Unknown/None
CVE-2017-6862 — NETGEAR Multiple Devices: NETGEAR Multiple Devices Buffer Overflow Vulnerability
Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.8 (NVD)
FIRST EPSS: 0.427 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-06-08
CISA remediation due: 2022-06-22
Known ransomware campaign use: Unknown/None
CVE-2017-6737 — Cisco IOS and IOS XE Software: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.426 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2014-100005 — D-Link DIR-600 Router: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
CVSS: 8.0 (NVD)
FIRST EPSS: 0.424 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-05-16
CISA remediation due: 2024-06-06
Known ransomware campaign use: Unknown/None
CVE-2023-33538 — TP-Link Multiple Routers: TP-Link Multiple Routers Command Injection Vulnerability
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.419 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-06-16
CISA remediation due: 2025-07-07
Known ransomware campaign use: Unknown/None
CVE-2021-44026 — Roundcube Roundcube Webmail: Roundcube Webmail SQL Injection Vulnerability
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.8 (NVD)
FIRST EPSS: 0.419 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-06-22
CISA remediation due: 2023-07-13
Known ransomware campaign use: Unknown/None
CVE-2017-5030 — Google Chromium V8: Google Chromium V8 Memory Corruption Vulnerability
Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.417 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-06-08
CISA remediation due: 2022-06-22
Known ransomware campaign use: Unknown/None
CVE-2024-41710 — Mitel SIP Phones: Mitel SIP Phones Argument Injection Vulnerability
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS: 7.2 (NVD)
FIRST EPSS: 0.416 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-02-12
CISA remediation due: 2025-03-05
Known ransomware campaign use: Unknown/None
CVE-2019-16928 — Exim Exim Internet Mailer: Exim Out-of-bounds Write Vulnerability
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.8 (NVD)
FIRST EPSS: 0.416 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-17
Known ransomware campaign use: Unknown/None
CVE-2011-1823 — Android Android OS: Android OS Privilege Escalation Vulnerability
The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.416 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-08
CISA remediation due: 2022-09-29
Known ransomware campaign use: Unknown/None
CVE-2021-22894 — Ivanti Pulse Connect Secure: Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.413 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2022-05-03
Known ransomware campaign use: Unknown/None
CVE-2023-2033 — Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.408 (98.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-04-17
CISA remediation due: 2023-05-08
Known ransomware campaign use: Unknown/None
CVE-2015-0666 — Cisco Prime Data Center Network Manager (DCNM): Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.404 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-25
CISA remediation due: 2022-04-15
Known ransomware campaign use: Unknown/None
CVE-2014-0496 — Adobe Reader and Acrobat: Adobe Reader and Acrobat Use-After-Free Vulnerability
Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.402 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2026-18556 — N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS: 8.2 (NVD)
FIRST EPSS: 0.402 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-08-04
CISA remediation due: 2026-08-07
Known ransomware campaign use: Unknown/None
CVE-2026-28318 — SolarWinds Serv-U: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.400 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-06-05
CISA remediation due: 2026-06-19
Known ransomware campaign use: Unknown/None
CVE-2023-4762 — Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.399 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-02-06
CISA remediation due: 2024-02-27
Known ransomware campaign use: Unknown/None
CVE-2021-27860 — FatPipe WARP, IPVPN, and MPVPN software: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.398 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-01-10
CISA remediation due: 2022-01-24
Known ransomware campaign use: Unknown/None
CVE-2013-6282 — Linux Kernel: Linux Kernel Improper Input Validation Vulnerability
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.397 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-15
CISA remediation due: 2022-10-06
Known ransomware campaign use: Unknown/None