Critical · CVSS 9 · CISA KEV
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Published Dec 14, 2021 · Updated Oct 21, 2025
Medium · CVSS 6.4 · CISA KEV
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
Published Dec 15, 2021 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel
Published Dec 15, 2021 · Updated Oct 21, 2025
High · CVSS 8.1 · CISA KEV
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
Published Dec 21, 2021 · Updated Oct 21, 2025
Low · CVSS 3.3 · CISA KEV
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Published Jan 4, 2022 · Updated Oct 21, 2025
Medium · CVSS 5 · CISA KEV
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Published Jan 7, 2022 · Updated Oct 21, 2025
Medium · CVSS 4.3 · CISA KEV
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Published Jan 7, 2022 · Updated Oct 21, 2025
High · CVSS 7 · CISA KEV
Windows User Profile Service Elevation of Privilege Vulnerability
Published Jan 11, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.1 · CISA KEV
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
Published Jan 13, 2022 · Updated Oct 21, 2025
Low · CVSS 3.7 · CISA KEV
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Published Jan 13, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Published Jan 14, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published Jan 19, 2022 · Updated Oct 21, 2025
Medium · CVSS 6.6 · CISA KEV
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
Published Jan 26, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.1 · CISA KEV
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
Published Jan 28, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
Windows Runtime Remote Code Execution Vulnerability
Published Feb 9, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
Windows Print Spooler Elevation of Privilege Vulnerability
Published Feb 9, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
Windows Print Spooler Elevation of Privilege Vulnerability
Published Feb 9, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Published Feb 9, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Published Feb 10, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Published Feb 10, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Published Feb 10, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Published Feb 10, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
Published Feb 10, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Published Feb 11, 2022 · Updated Oct 21, 2025
High · CVSS 8.4 · CISA KEV
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Published Feb 11, 2022 · Updated Oct 21, 2025
High · CVSS 8.8 · CISA KEV
Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Published Feb 11, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Published Feb 16, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Published Feb 16, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
Published Feb 17, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Published Feb 18, 2022 · Updated Oct 21, 2025
High · CVSS 8.8 · CISA KEV
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
Published Feb 24, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Published Mar 3, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.
Published Mar 3, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Published Mar 4, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Published Mar 7, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
Published Mar 9, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A
Published Mar 16, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
Published Mar 17, 2022 · Updated Oct 21, 2025
High · CVSS 8.8 · CISA KEV
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Published Mar 17, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
Published Mar 18, 2022 · Updated Oct 21, 2025
High · CVSS 8.8 · CISA KEV
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
Published Mar 18, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Published Mar 25, 2022 · Updated Oct 21, 2025
Medium · CVSS 6.5 · CISA KEV
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
Published Mar 29, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
Published Mar 29, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Published Apr 1, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Published Apr 1, 2022 · Updated Oct 21, 2025
High · CVSS 8.8 · CISA KEV
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Published Apr 4, 2022 · Updated Oct 21, 2025
Critical · CVSS 9.8 · CISA KEV
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
Published Apr 11, 2022 · Updated Oct 21, 2025
High · CVSS 7.8 · CISA KEV
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
Published Apr 13, 2022 · Updated Oct 21, 2025
Critical · CVSS 10 · CISA KEV
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
Published Apr 13, 2022 · Updated Oct 21, 2025
