| CVE-2020-24363 Known exploited | High 8.8 | TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. Assigned by mitre | Aug 31, 2020 |
| CVE-2020-24557 Known exploited | High 7.8 | A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporar… Assigned by trendmicro | Sep 1, 2020 |
| CVE-2020-25079 Known exploited | High 8.8 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. Assigned by mitre | Sep 2, 2020 |
| CVE-2020-25078 Known exploited | High 7.5 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. Assigned by mitre | Sep 2, 2020 |
| CVE-2020-25213 Known exploited | Critical 10.0 | The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to hav… Assigned by mitre | Sep 9, 2020 |
| CVE-2020-0878 Known exploited | Medium 4.2 | Microsoft Browser Memory Corruption Vulnerability Assigned by microsoft | Sep 11, 2020 |
| CVE-2020-3569 Known exploited | High 8.6 | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities Assigned by cisco | Sep 23, 2020 |
| CVE-2020-25223 Known exploited | Critical 9.8 | A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 Assigned by mitre | Sep 25, 2020 |
| CVE-2020-8243 Known exploited | High 7.2 | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Assigned by hackerone | Sep 29, 2020 |
| CVE-2020-26919 Known exploited | Critical 9.8 | NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. Assigned by mitre | Oct 9, 2020 |
| CVE-2020-5135 Known exploited | Critical 9.8 | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. Assigned by sonicwall | Oct 12, 2020 |
| CVE-2020-9907 Known exploited | High 7.8 | A memory corruption issue was addressed by removing the vulnerable code. Assigned by apple | Oct 16, 2020 |
| CVE-2020-9934 Known exploited | Medium 5.5 | An issue existed in the handling of environment variables. Assigned by apple | Oct 16, 2020 |
| CVE-2020-3992 Known exploited | Critical 9.8 | OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. Assigned by vmware | Oct 20, 2020 |
| CVE-2020-14871 Known exploited | Critical 10.0 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Assigned by oracle | Oct 21, 2020 |
| CVE-2020-14864 Known exploited | High 7.5 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Assigned by oracle | Oct 21, 2020 |
| CVE-2020-14883 Known exploited | High 7.2 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Assigned by oracle | Oct 21, 2020 |
| CVE-2020-14882 Known exploited | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Assigned by oracle | Oct 21, 2020 |
| CVE-2020-3580 Known exploited | Medium 6.1 | Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities Assigned by cisco | Oct 21, 2020 |
| CVE-2020-8260 Known exploited | High 7.2 | A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction. Assigned by hackerone | Oct 28, 2020 |
| CVE-2018-19953 Known exploited | Medium 6.1 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. Assigned by qnap | Oct 28, 2020 |
| CVE-2018-19949 Known exploited | Critical 9.8 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Assigned by qnap | Oct 28, 2020 |
| CVE-2018-19943 Known exploited | High 8.0 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. Assigned by qnap | Oct 28, 2020 |
| CVE-2020-14750 Known exploited | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Assigned by oracle | Nov 1, 2020 |
| CVE-2020-15999 Known exploited | Critical 9.6 | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 3, 2020 |
| CVE-2020-16009 Known exploited | High 8.8 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 3, 2020 |
| CVE-2020-16010 Known exploited | Critical 9.6 | Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted… Assigned by Chrome | Nov 3, 2020 |
| CVE-2020-16846 Known exploited | Critical 9.8 | An issue was discovered in SaltStack Salt through 3002. Assigned by mitre | Nov 6, 2020 |
| CVE-2020-13927 Known exploited | Critical 9.8 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. Assigned by apache | Nov 10, 2020 |
| CVE-2020-17087 Known exploited | High 7.8 | Windows Kernel Local Elevation of Privilege Vulnerability Assigned by microsoft | Nov 11, 2020 |
| CVE-2020-28949 Known exploited | High 7.8 | Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Assigned by mitre | Nov 19, 2020 |
| CVE-2020-13671 Known exploited | High 8.8 | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP f… Assigned by drupal | Nov 20, 2020 |
| CVE-2020-4006 Known exploited | Critical 9.1 | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Assigned by vmware | Nov 23, 2020 |
| CVE-2020-27932 Known exploited | High 7.8 | A type confusion issue was addressed with improved state handling. Assigned by apple | Dec 8, 2020 |
| CVE-2020-27950 Known exploited | Medium 5.5 | A memory initialization issue was addressed. Assigned by apple | Dec 8, 2020 |
| CVE-2020-27930 Known exploited | High 7.8 | A memory corruption issue was addressed with improved input validation. Assigned by apple | Dec 8, 2020 |
| CVE-2020-17144 Known exploited | High 8.4 | Microsoft Exchange Remote Code Execution Vulnerability Assigned by microsoft | Dec 9, 2020 |
| CVE-2020-17530 Known exploited | Critical 9.8 | Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Assigned by apache | Dec 11, 2020 |
| CVE-2020-29574 Known exploited | Critical 9.8 | An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely. Assigned by mitre | Dec 11, 2020 |
| CVE-2020-29583 Known exploited | Critical 9.8 | Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. Assigned by mitre | Dec 22, 2020 |
| CVE-2020-35730 Known exploited | Medium 6.1 | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. Assigned by mitre | Dec 28, 2020 |
| CVE-2020-10148 Known exploited | Critical 9.8 | SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands Assigned by certcc | Dec 29, 2020 |
| CVE-2020-17519 Known exploited | Critical 9.1 | Apache Flink directory traversal attack: reading remote files through the REST API Assigned by apache | Jan 5, 2021 |
| CVE-2020-16013 Known exploited | High 8.8 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Jan 8, 2021 |
| CVE-2020-16017 Known exploited | Critical 9.6 | Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML… Assigned by Chrome | Jan 8, 2021 |
| CVE-2021-3129 Known exploited | Critical 9.8 | Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(… Assigned by mitre | Jan 12, 2021 |
| CVE-2021-1647 Known exploited | High 7.8 | Microsoft Defender Remote Code Execution Vulnerability Assigned by microsoft | Jan 12, 2021 |
| CVE-2020-6572 Known exploited | High 8.8 | Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Assigned by Chrome | Jan 14, 2021 |
| CVE-2020-36193 Known exploited | High 7.5 | Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. Assigned by mitre | Jan 18, 2021 |
| CVE-2021-3199 Known exploited | Critical 9.8 | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. Assigned by mitre | Jan 22, 2021 |
