Cross-Vendor Patch Advisories
Every vendor except Microsoft: CISA KEV advisories scored on the EVULNABLE Risk scale, Linux distribution advisories, and vendor security bulletins.
Browse Advisories
1,308 of 1,308 advisories match the current filters, sorted by EVULNABLE Risk.
| CVE | Vendor | Product | Vulnerability | EVRS | EPSS | Ransomware | CISA due |
|---|---|---|---|---|---|---|---|
| CVE-2026-20128 | Cisco | Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 75 Urgent | 0.069 (93.7th pctl) | Unknown/None | 2026-04-23 |
| CVE-2008-3431 | Oracle | VirtualBox | Oracle VirtualBox Insufficient Input Validation Vulnerability | 75 Urgent | 0.069 (93.6th pctl) | Unknown/None | 2022-03-24 |
| CVE-2018-0159 | Cisco | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | 75 Urgent | 0.069 (93.6th pctl) | Unknown/None | 2022-03-17 |
| CVE-2022-27518 | Citrix | Application Delivery Controller (ADC) and Gateway | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | 75 Urgent | 0.069 (93.6th pctl) | Unknown/None | 2023-01-03 |
| CVE-2013-1675 | Mozilla | Firefox | Mozilla Firefox Information Disclosure Vulnerability | 75 Urgent | 0.067 (93.4th pctl) | Unknown/None | 2022-03-24 |
| CVE-2012-0767 | Adobe | Flash Player | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | 75 Urgent | 0.067 (93.4th pctl) | Unknown/None | 2022-06-22 |
| CVE-2020-16010 | Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | 75 Urgent | 0.064 (93.2nd pctl) | Unknown/None | 2022-05-03 | |
| CVE-2021-22600 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 75 Urgent | 0.061 (92.9th pctl) | Unknown/None | 2022-05-02 |
| CVE-2017-6627 | Cisco | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability | 75 Urgent | 0.060 (92.9th pctl) | Unknown/None | 2022-03-24 |
| CVE-2019-15271 | Cisco | RV Series Routers | Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability | 75 Urgent | 0.060 (92.8th pctl) | Unknown/None | 2022-06-22 |
| CVE-2022-26500 | Veeam | Backup & Replication | Veeam Backup & Replication Remote Code Execution Vulnerability | 75 Urgent | 0.058 (92.6th pctl) | Known | 2023-01-03 |
| CVE-2022-3075 | Chromium Mojo | Google Chromium Mojo Insufficient Data Validation Vulnerability | 75 Urgent | 0.058 (92.6th pctl) | Unknown/None | 2022-09-29 | |
| CVE-2020-8468 | Trend Micro | Apex One, OfficeScan and Worry-Free Business Security Agents | Trend Micro Multiple Products Content Validation Escape Vulnerability | 75 Urgent | 0.058 (92.6th pctl) | Unknown/None | 2022-05-03 |
| CVE-2026-3502 | TrueConf | Client | TrueConf Client Download of Code Without Integrity Check Vulnerability | 75 Urgent | 0.057 (92.5th pctl) | Unknown/None | 2026-04-16 |
| CVE-2023-2136 | Chromium Skia | Google Chrome Skia Integer Overflow Vulnerability | 75 Urgent | 0.057 (92.5th pctl) | Unknown/None | 2023-05-12 | |
| CVE-2022-20700 | Cisco | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 75 Urgent | 0.057 (92.4th pctl) | Unknown/None | 2022-03-17 |
| CVE-2019-6693 | Fortinet | FortiOS | Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability | 75 Urgent | 0.056 (92.4th pctl) | Known | 2025-07-16 |
| CVE-2022-32917 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | 75 Urgent | 0.056 (92.4th pctl) | Unknown/None | 2022-10-05 |
| CVE-2010-3035 | Cisco | IOS XR | Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability | 75 Urgent | 0.056 (92.3rd pctl) | Unknown/None | 2022-04-15 |
| CVE-2022-0492 | Linux | Kernel | Linux Kernel Improper Authentication Vulnerability | 75 Urgent | 0.055 (92.3rd pctl) | Unknown/None | 2026-06-05 |
| CVE-2021-28664 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability | 75 Urgent | 0.054 (92.1st pctl) | Unknown/None | 2021-11-17 |
| CVE-2025-10585 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 75 Urgent | 0.054 (92.1st pctl) | Unknown/None | 2025-10-14 | |
| CVE-2017-12319 | Cisco | IOS XE Software | Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | 75 Urgent | 0.053 (92nd pctl) | Unknown/None | 2022-03-24 |
| CVE-2013-3993 | IBM | InfoSphere BigInsights | IBM InfoSphere BigInsights Invalid Input Vulnerability | 75 Urgent | 0.052 (92nd pctl) | Known | 2022-06-15 |
| CVE-2021-30900 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | 75 Urgent | 0.052 (91.9th pctl) | Unknown/None | 2023-04-20 |
Exactly the 1,308 advisory(ies) matching the filters above.
Advisory detail
Expand any advisory for its description, CISA's own required action, and research links.
CVE-2026-20128 — Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.069 (93.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-04-20
CISA remediation due: 2026-04-23
Known ransomware campaign use: Unknown/None
CVE-2008-3431 — Oracle VirtualBox: Oracle VirtualBox Insufficient Input Validation Vulnerability
An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.069 (93.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2018-0159 — Cisco IOS Software and Cisco IOS XE Software: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.069 (93.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-17
Known ransomware campaign use: Unknown/None
CVE-2022-27518 — Citrix Application Delivery Controller (ADC) and Gateway: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.8 (NVD)
FIRST EPSS: 0.069 (93.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-12-13
CISA remediation due: 2023-01-03
Known ransomware campaign use: Unknown/None
CVE-2013-1675 — Mozilla Firefox: Mozilla Firefox Information Disclosure Vulnerability
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 6.5 (NVD)
FIRST EPSS: 0.067 (93.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2012-0767 — Adobe Flash Player: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
CVSS: 6.1 (NVD)
FIRST EPSS: 0.067 (93.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-06-08
CISA remediation due: 2022-06-22
Known ransomware campaign use: Unknown/None
CVE-2020-16010 — Google Chrome for Android UI: Google Chrome for Android UI Heap Buffer Overflow Vulnerability
Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.6 (NVD)
FIRST EPSS: 0.064 (93.2nd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2022-05-03
Known ransomware campaign use: Unknown/None
CVE-2021-22600 — Linux Kernel: Linux Kernel Privilege Escalation Vulnerability
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.0 (NVD)
FIRST EPSS: 0.061 (92.9th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-04-11
CISA remediation due: 2022-05-02
Known ransomware campaign use: Unknown/None
CVE-2017-6627 — Cisco IOS and IOS XE Software: Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability
A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.060 (92.9th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2019-15271 — Cisco RV Series Routers: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.060 (92.8th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-06-08
CISA remediation due: 2022-06-22
Known ransomware campaign use: Unknown/None
CVE-2022-26500 — Veeam Backup & Replication: Veeam Backup & Replication Remote Code Execution Vulnerability
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.058 (92.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-12-13
CISA remediation due: 2023-01-03
Known ransomware campaign use: Known
CVE-2022-3075 — Google Chromium Mojo: Google Chromium Mojo Insufficient Data Validation Vulnerability
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.6 (NVD)
FIRST EPSS: 0.058 (92.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-08
CISA remediation due: 2022-09-29
Known ransomware campaign use: Unknown/None
CVE-2020-8468 — Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents: Trend Micro Multiple Products Content Validation Escape Vulnerability
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.058 (92.6th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2022-05-03
Known ransomware campaign use: Unknown/None
CVE-2026-3502 — TrueConf Client: TrueConf Client Download of Code Without Integrity Check Vulnerability
TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.057 (92.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-04-02
CISA remediation due: 2026-04-16
Known ransomware campaign use: Unknown/None
CVE-2023-2136 — Google Chromium Skia: Google Chrome Skia Integer Overflow Vulnerability
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.6 (NVD)
FIRST EPSS: 0.057 (92.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-04-21
CISA remediation due: 2023-05-12
Known ransomware campaign use: Unknown/None
CVE-2022-20700 — Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 9.8 (NVD)
FIRST EPSS: 0.057 (92.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-17
Known ransomware campaign use: Unknown/None
CVE-2019-6693 — Fortinet FortiOS: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 6.5 (NVD)
FIRST EPSS: 0.056 (92.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-06-25
CISA remediation due: 2025-07-16
Known ransomware campaign use: Known
CVE-2022-32917 — Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.056 (92.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-14
CISA remediation due: 2022-10-05
Known ransomware campaign use: Unknown/None
CVE-2010-3035 — Cisco IOS XR: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.5 (NVD)
FIRST EPSS: 0.056 (92.3rd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-25
CISA remediation due: 2022-04-15
Known ransomware campaign use: Unknown/None
CVE-2022-0492 — Linux Kernel: Linux Kernel Improper Authentication Vulnerability
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.055 (92.3rd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-06-02
CISA remediation due: 2026-06-05
Known ransomware campaign use: Unknown/None
CVE-2021-28664 — Arm Mali Graphics Processing Unit (GPU): Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.054 (92.1st pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-11-03
CISA remediation due: 2021-11-17
Known ransomware campaign use: Unknown/None
CVE-2025-10585 — Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 9.8 (NVD)
FIRST EPSS: 0.054 (92.1st pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-09-23
CISA remediation due: 2025-10-14
Known ransomware campaign use: Unknown/None
CVE-2017-12319 — Cisco IOS XE Software: Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 5.9 (NVD)
FIRST EPSS: 0.053 (92nd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2013-3993 — IBM InfoSphere BigInsights: IBM InfoSphere BigInsights Invalid Input Vulnerability
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
CVSS: 6.5 (NVD)
FIRST EPSS: 0.052 (92nd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-05-25
CISA remediation due: 2022-06-15
Known ransomware campaign use: Known
CVE-2021-30900 — Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.052 (91.9th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-03-30
CISA remediation due: 2023-04-20
Known ransomware campaign use: Unknown/None