Threat feed

• CVE-2013-7331CriticalCVSS6.5EPSS 50.2%KEV

  The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2014-0546CriticalCVSS9.8EPSS 22.3%KEV

  Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2014-2817CriticalCVSS8.8EPSS 26.3%KEV

  Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

  KEV added: 2022-05-25Official (NVD) →
• CVE-2014-8439CriticalCVSS8.8EPSS 20.4%KEV

  Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2016-1010CriticalCVSS8.8EPSS 19.3%KEV

  Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2012-1710CriticalCVSS9.8EPSS 7.8%KEVRansomware

  Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2015-0071CriticalCVSS6.5EPSS 33.6%KEV

  Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

  KEV added: 2022-05-25Official (NVD) →
• CVE-2015-2360CriticalCVSS8.8EPSS 14.8%KEV

  win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

  KEV added: 2022-05-25Official (NVD) →
• CVE-2019-3010CriticalCVSS8.8EPSS 13.4%KEV

  Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

  KEV added: 2022-05-25Official (NVD) →
• CVE-2015-6175CriticalCVSS7.8EPSS 5.3%KEV

  The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."

  KEV added: 2022-05-25Official (NVD) →
• CVE-2015-0310CriticalCVSS7.8EPSS 15.1%KEV

  Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2015-1769CriticalCVSS6.6EPSS 4.1%KEV

  Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Mount Manager Elevation of Privilege Vulnerability."

  KEV added: 2022-05-25Official (NVD) →
• CVE-2013-3993CriticalCVSS6.5EPSS 4.8%KEVRansomware

  IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.

  KEV added: 2022-05-25Official (NVD) →
• CVE-2016-6366CriticalCVSS8.8EPSS 87.6%KEV

  Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-18362CriticalCVSS9.8EPSS 86.8%KEVRansomware

  ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-8543CriticalCVSS9.8EPSS 74.4%KEV

  Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-0147CriticalCVSS7.5EPSS 99.7%KEVRansomware

  The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-8291CriticalCVSS7.8EPSS 97.0%KEV

  Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-4657CriticalCVSS8.8EPSS 66.8%KEV

  WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2018-19949CriticalCVSS9.8EPSS 30.2%KEVRansomware

  If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-0149CriticalCVSS8.8EPSS 29.2%KEV

  Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-6367CriticalCVSS7.8EPSS 22.6%KEV

  Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-0210CriticalCVSS8.8EPSS 22.3%KEV

  An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka "Internet Explorer Elevation of Privilege Vulnerability."

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-4656CriticalCVSS7.8EPSS 23.6%KEV

  The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-3298CriticalCVSS6.5EPSS 33.3%KEV

  Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-0005CriticalCVSS7.8EPSS 11.0%KEV

  The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2018-19953CriticalCVSS6.1EPSS 30.5%KEVRansomware

  If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-3351CriticalCVSS6.5EPSS 26.5%KEVRansomware

  Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-4655CriticalCVSS5.5EPSS 33.4%KEV

  The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2018-8611CriticalCVSS7.8EPSS 4.2%KEV

  An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

  KEV added: 2022-05-24Official (NVD) →
• CVE-2017-0022CriticalCVSS6.5EPSS 18.1%KEV

  Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."

  KEV added: 2022-05-24Official (NVD) →
• CVE-2018-19943CriticalCVSS5.4EPSS 22.7%KEVRansomware

  If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

  KEV added: 2022-05-24Official (NVD) →
• CVE-2016-0162CriticalCVSS4.3EPSS 22.0%KEV

  Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."

  KEV added: 2022-05-24Official (NVD) →
• CVE-2019-11708CriticalCVSS10.0EPSS 55.9%KEV

  Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

  KEV added: 2022-05-23Official (NVD) →
• CVE-2019-18426CriticalCVSS8.2EPSS 67.9%KEV

  A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

  KEV added: 2022-05-23Official (NVD) →
• CVE-2019-13720CriticalCVSS8.8EPSS 49.4%KEV

  Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  KEV added: 2022-05-23Official (NVD) →
• CVE-2019-5786CriticalCVSS6.5EPSS 61.1%KEV

  Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

  KEV added: 2022-05-23Official (NVD) →
• CVE-2019-11707CriticalCVSS8.8EPSS 37.7%KEV

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

  KEV added: 2022-05-23Official (NVD) →
• CVE-2018-5002CriticalCVSS7.8EPSS 25.1%KEV

  Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

  KEV added: 2022-05-23Official (NVD) →
• CVE-2019-8720CriticalCVSS8.8EPSS 1.6%KEV

  A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

  KEV added: 2022-05-23Official (NVD) →

Priority = KEV (actively exploited) + EPSS (probability of exploitation in 30 days) + CVSS (severity). A defensive feed — no exploit code or PoC. Each CVE links to the official source (NVD).