| CVE-2021-45046 Known exploited | Critical 9.0 | Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack Assigned by apache | Dec 14, 2021 |
| CVE-2021-43226 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Dec 15, 2021 |
| CVE-2021-43890 Known exploited | High 7.1 | Windows AppX Installer Spoofing Vulnerability Assigned by microsoft | Dec 15, 2021 |
| CVE-2021-0920 Known exploited | Medium 6.4 | In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. Assigned by google_android | Dec 15, 2021 |
| CVE-2021-1048 Known exploited | High 7.8 | In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. Assigned by google_android | Dec 15, 2021 |
| CVE-2021-22054 Known exploited | High 7.5 | VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. Assigned by vmware | Dec 17, 2021 |
| CVE-2021-44207 Known exploited | High 8.1 | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. Assigned by mitre | Dec 21, 2021 |
| CVE-2021-44168 Known exploited | Low 3.3 | A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the d… Assigned by fortinet | Jan 4, 2022 |
| CVE-2022-22265 Known exploited | Medium 5.0 | An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. Assigned by Samsung Mobile | Jan 7, 2022 |
| CVE-2021-35247 Known exploited | Medium 4.3 | Improper Input Validation Vulnerability in Serv-U Assigned by SolarWinds | Jan 7, 2022 |
| CVE-2022-21882 Known exploited | High 7.0 | Win32k Elevation of Privilege Vulnerability Assigned by microsoft | Jan 11, 2022 |
| CVE-2022-21919 Known exploited | High 7.0 | Windows User Profile Service Elevation of Privilege Vulnerability Assigned by microsoft | Jan 11, 2022 |
| CVE-2022-23131 Known exploited | Critical 9.1 | Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML Assigned by Zabbix | Jan 13, 2022 |
| CVE-2022-23134 Known exploited | Low 3.7 | Possible view of the setup pages by unauthenticated users if config file already exists Assigned by Zabbix | Jan 13, 2022 |
| CVE-2022-23227 Known exploited | Critical 9.8 | NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authenticati… Assigned by mitre | Jan 14, 2022 |
| CVE-2021-35587 Known exploited | Critical 9.8 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Assigned by oracle | Jan 19, 2022 |
| CVE-2021-22600 Known exploited | Medium 6.6 | Double Free in net/packet/af_packet.c leading to priviledge escalation Assigned by Google | Jan 26, 2022 |
| CVE-2021-4034 Known exploited | High 7.8 | A local privilege escalation vulnerability was found on polkit's pkexec utility. Assigned by redhat | Jan 28, 2022 |
| CVE-2021-40407 Known exploited | Critical 9.1 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. Assigned by talos | Jan 28, 2022 |
| CVE-2022-24682 Known exploited | Medium 6.1 | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. Assigned by mitre | Feb 9, 2022 |
| CVE-2022-21971 Known exploited | High 7.8 | Windows Runtime Remote Code Execution Vulnerability Assigned by microsoft | Feb 9, 2022 |
| CVE-2022-21999 Known exploited | High 7.8 | Windows Print Spooler Elevation of Privilege Vulnerability Assigned by microsoft | Feb 9, 2022 |
| CVE-2022-22718 Known exploited | High 7.8 | Windows Print Spooler Elevation of Privilege Vulnerability Assigned by microsoft | Feb 9, 2022 |
| CVE-2022-22536 Known exploited | Critical 9.8 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenat… Assigned by sap | Feb 9, 2022 |
| CVE-2022-20708 Known exploited | Critical 10.0 | Cisco Small Business RV Series Routers Vulnerabilities Assigned by cisco | Feb 10, 2022 |
| CVE-2022-20703 Known exploited | Critical 10.0 | Cisco Small Business RV Series Routers Vulnerabilities Assigned by cisco | Feb 10, 2022 |
| CVE-2022-20701 Known exploited | Critical 10.0 | Cisco Small Business RV Series Routers Vulnerabilities Assigned by cisco | Feb 10, 2022 |
| CVE-2022-20700 Known exploited | Critical 10.0 | Cisco Small Business RV Series Routers Vulnerabilities Assigned by cisco | Feb 10, 2022 |
| CVE-2022-20699 Known exploited | Critical 10.0 | Cisco Small Business RV Series Routers Vulnerabilities Assigned by cisco | Feb 10, 2022 |
| CVE-2022-24112 Known exploited | Critical 9.8 | apisix/batch-requests plugin allows overwriting the X-REAL-IP header Assigned by apache | Feb 11, 2022 |
| CVE-2022-0185 Known exploited | High 8.4 | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. Assigned by redhat | Feb 11, 2022 |
| CVE-2021-4102 Known exploited | High 8.8 | Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Feb 11, 2022 |
| CVE-2021-3560 Known exploited | High 7.8 | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. Assigned by redhat | Feb 16, 2022 |
| CVE-2022-24086 Known exploited | Critical 9.8 | Adobe Commerce checkout improper input validation leads to remote code execution Assigned by adobe | Feb 16, 2022 |
| CVE-2021-45382 Known exploited | Critical 9.8 | A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Assigned by mitre | Feb 17, 2022 |
| CVE-2022-0543 Known exploited | Critical 10.0 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. Assigned by debian | Feb 18, 2022 |
| CVE-2022-23176 Known exploited | High 8.8 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. Assigned by mitre | Feb 24, 2022 |
| CVE-2022-22947 Known exploited | Critical 10.0 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. Assigned by vmware | Mar 3, 2022 |
| CVE-2022-0492 Known exploited | High 7.8 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Assigned by redhat | Mar 3, 2022 |
| CVE-2022-22706 Known exploited | High 7.8 | Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. Assigned by mitre | Mar 3, 2022 |
| CVE-2022-26318 Known exploited | Critical 9.8 | On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Assigned by mitre | Mar 4, 2022 |
| CVE-2022-0847 Known exploited | High 7.8 | A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus… Assigned by redhat | Mar 7, 2022 |
| CVE-2022-26143 Known exploited | Critical 9.8 | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service… Assigned by mitre | Mar 9, 2022 |
| CVE-2021-39793 Known exploited | High 7.8 | In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. Assigned by google_android | Mar 16, 2022 |
| CVE-2022-26501 Known exploited | Critical 9.8 | Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Assigned by mitre | Mar 17, 2022 |
| CVE-2022-26500 Known exploited | High 8.8 | Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and exec… Assigned by mitre | Mar 17, 2022 |
| CVE-2022-22587 Known exploited | Critical 9.8 | A memory corruption issue was addressed with improved input validation. Assigned by apple | Mar 18, 2022 |
| CVE-2022-22620 Known exploited | High 8.8 | A use after free issue was addressed with improved memory management. Assigned by apple | Mar 18, 2022 |
| CVE-2022-1040 Known exploited | Critical 9.8 | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. Assigned by Sophos | Mar 25, 2022 |
| CVE-2022-0995 Known exploited | High 7.8 | An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. Assigned by redhat | Mar 25, 2022 |
