| CVE-2020-6819 Known exploited | High 8.1 | Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. Assigned by mozilla | Apr 24, 2020 |
| CVE-2020-12271 Known exploited | Critical 10.0 | A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. Assigned by mitre | Apr 27, 2020 |
| CVE-2020-11023 Known exploited Healthcare | Medium 6.9 | Potential XSS vulnerability in jQuery Assigned by GitHub_M | Apr 29, 2020 |
| CVE-2020-11651 Known exploited | Critical 9.8 | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Assigned by mitre | Apr 30, 2020 |
| CVE-2020-11652 Known exploited | Medium 6.5 | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Assigned by mitre | Apr 30, 2020 |
| CVE-2020-1631 Known exploited | High 8.8 | Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services Assigned by juniper | May 4, 2020 |
| CVE-2020-12641 Known exploited | Critical 9.8 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. Assigned by mitre | May 4, 2020 |
| CVE-2020-3259 Known exploited | High 7.5 | Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability Assigned by cisco | May 6, 2020 |
| CVE-2020-4427 Known exploited | Critical 9.0 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. Assigned by ibm | May 7, 2020 |
| CVE-2020-4428 Known exploited | Critical 9.1 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. Assigned by ibm | May 7, 2020 |
| CVE-2020-4430 Known exploited | Medium 4.3 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. Assigned by ibm | May 7, 2020 |
| CVE-2020-5741 Known exploited | High 7.2 | Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Assigned by tenable | May 8, 2020 |
| CVE-2020-1054 Known exploited | High 7.0 | Win32k Elevation of Privilege Vulnerability Assigned by microsoft | May 21, 2020 |
| CVE-2020-1956 Known exploited | High 8.8 | Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command withou… Assigned by apache | May 22, 2020 |
| CVE-2020-8816 Known exploited | Critical 9.1 | Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. Assigned by mitre | May 29, 2020 |
| CVE-2020-5410 Known exploited | High 7.5 | Directory Traversal with spring-cloud-config-server Assigned by pivotal | Jun 2, 2020 |
| CVE-2020-9859 Known exploited | High 7.8 | A memory consumption issue was addressed with improved memory handling. Assigned by apple | Jun 5, 2020 |
| CVE-2020-13965 Known exploited | Medium 6.3 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. Assigned by mitre | Jun 9, 2020 |
| CVE-2020-9819 Known exploited | Medium 4.3 | A memory consumption issue was addressed with improved memory handling. Assigned by apple | Jun 9, 2020 |
| CVE-2020-9818 Known exploited | High 8.8 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | Jun 9, 2020 |
| CVE-2020-0986 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Assigned by microsoft | Jun 9, 2020 |
| CVE-2020-11899 Known exploited | Medium 5.4 | The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. Assigned by mitre | Jun 17, 2020 |
| CVE-2020-2021 Known exploited | Critical 10.0 | PAN-OS: Authentication Bypass in SAML Authentication Assigned by palo_alto | Jun 29, 2020 |
| CVE-2020-15069 Known exploited | Critical 9.8 | Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Assigned by mitre | Jun 29, 2020 |
| CVE-2020-15415 Known exploited | Critical 9.8 | On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-pytho… Assigned by mitre | Jun 30, 2020 |
| CVE-2020-5902 Known exploited | Critical 9.8 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility… Assigned by f5 | Jul 1, 2020 |
| CVE-2020-15505 Known exploited | Critical 9.8 | A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2… Assigned by mitre | Jul 7, 2020 |
| CVE-2020-9377 Known exploited | High 8.8 | D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. Assigned by mitre | Jul 9, 2020 |
| CVE-2020-8193 Known exploited | Medium 6.5 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.… Assigned by hackerone | Jul 10, 2020 |
| CVE-2020-8195 Known exploited | Medium 6.5 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 1… Assigned by hackerone | Jul 10, 2020 |
| CVE-2020-8196 Known exploited | Medium 4.3 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.… Assigned by hackerone | Jul 10, 2020 |
| CVE-2020-10987 Known exploited | Critical 9.8 | The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. Assigned by mitre | Jul 13, 2020 |
| CVE-2020-6287 Known exploited | Critical 10.0 | SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configura… Assigned by sap | Jul 14, 2020 |
| CVE-2020-1040 Known exploited | Critical 9.0 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX… Assigned by microsoft | Jul 14, 2020 |
| CVE-2020-1147 Known exploited | High 7.8 | A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, Shar… Assigned by microsoft | Jul 14, 2020 |
| CVE-2020-1350 Known exploited | Critical 10.0 | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. Assigned by microsoft | Jul 14, 2020 |
| CVE-2020-14644 Known exploited | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Assigned by oracle | Jul 15, 2020 |
| CVE-2020-11978 Known exploited | High 8.8 | An issue was found in Apache Airflow versions 1.10.10 and below. Assigned by apache | Jul 16, 2020 |
| CVE-2020-3452 Known exploited | High 7.5 | Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability Assigned by cisco | Jul 22, 2020 |
| CVE-2020-12812 Known exploited | High 7.5 | An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second fact… Assigned by fortinet | Jul 24, 2020 |
| CVE-2020-8218 Known exploited | High 7.2 | A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. Assigned by hackerone | Jul 30, 2020 |
| CVE-2020-17496 Known exploited | Critical 9.8 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. Assigned by mitre | Aug 12, 2020 |
| CVE-2020-17463 Known exploited | Critical 9.8 | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. Assigned by mitre | Aug 13, 2020 |
| CVE-2019-5591 Known exploited | Medium 6.5 | A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. Assigned by fortinet | Aug 14, 2020 |
| CVE-2020-3433 Known exploited | High 7.8 | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability Assigned by cisco | Aug 17, 2020 |
| CVE-2020-1380 Known exploited | High 7.8 | Scripting Engine Memory Corruption Vulnerability Assigned by microsoft | Aug 17, 2020 |
| CVE-2020-1464 Known exploited | High 7.8 | Windows Spoofing Vulnerability Assigned by microsoft | Aug 17, 2020 |
| CVE-2020-1472 Known exploited | Medium 5.5 | Netlogon Elevation of Privilege Vulnerability Assigned by microsoft | Aug 17, 2020 |
| CVE-2020-9715 Known exploited | High 7.8 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Assigned by adobe | Aug 19, 2020 |
| CVE-2020-3566 Known exploited | High 8.6 | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Assigned by cisco | Aug 29, 2020 |
