| CVE-2022-26258 Known exploited | Critical 9.8 | D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. Assigned by mitre | Mar 27, 2022 |
| CVE-2022-22948 Known exploited | Medium 6.5 | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. Assigned by vmware | Mar 29, 2022 |
| CVE-2022-26871 Known exploited | Critical 9.8 | An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution. Assigned by trendmicro | Mar 29, 2022 |
| CVE-2022-22963 Known exploited | Critical 9.8 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression t… Assigned by vmware | Apr 1, 2022 |
| CVE-2022-22965 Known exploited | Critical 9.8 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Assigned by vmware | Apr 1, 2022 |
| CVE-2022-0609 Known exploited | High 8.8 | Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Apr 4, 2022 |
| CVE-2022-22954 Known exploited | Critical 9.8 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. Assigned by vmware | Apr 11, 2022 |
| CVE-2022-22960 Known exploited | High 7.8 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. Assigned by vmware | Apr 13, 2022 |
| CVE-2022-24816 Known exploited | Critical 10.0 | Improper Control of Generation of Code in jai-ext Assigned by GitHub_M | Apr 13, 2022 |
| CVE-2022-24521 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Apr 15, 2022 |
| CVE-2022-26904 Known exploited | High 7.0 | Windows User Profile Service Elevation of Privilege Vulnerability Assigned by microsoft | Apr 15, 2022 |
| CVE-2022-29464 Known exploited | Critical 9.8 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. Assigned by mitre | Apr 18, 2022 |
| CVE-2022-28810 Known exploited | Medium 6.8 | Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Assigned by mitre | Apr 18, 2022 |
| CVE-2022-21445 Known exploited | Critical 9.8 | Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Assigned by oracle | Apr 19, 2022 |
| CVE-2022-27924 Known exploited | Critical 9.8 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. Assigned by mitre | Apr 20, 2022 |
| CVE-2022-27925 Known exploited | High 7.2 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. Assigned by mitre | Apr 20, 2022 |
| CVE-2022-27926 Known exploited | Medium 6.1 | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web scrip… Assigned by mitre | Apr 20, 2022 |
| CVE-2022-24706 Known exploited | Critical 9.8 | Remote Code Execution Vulnerability in Packaging Assigned by apache | Apr 26, 2022 |
| CVE-2022-29499 Known exploited | Critical 9.8 | The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. Assigned by mitre | Apr 26, 2022 |
| CVE-2022-1388 Known exploited | Critical 9.8 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed… Assigned by f5 | May 5, 2022 |
| CVE-2022-30333 Known exploited | Critical 9.8 | RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. Assigned by mitre | May 9, 2022 |
| CVE-2022-26923 Known exploited | High 8.8 | Active Directory Domain Services Elevation of Privilege Vulnerability Assigned by microsoft | May 10, 2022 |
| CVE-2022-26925 Known exploited | High 8.1 | Windows LSA Spoofing Vulnerability Assigned by microsoft | May 10, 2022 |
| CVE-2022-30525 Known exploited | Critical 9.8 | A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 fi… Assigned by Zyxel | May 12, 2022 |
| CVE-2022-29303 Known exploited | Critical 9.8 | SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. Assigned by mitre | May 12, 2022 |
| CVE-2022-20821 Known exploited | Medium 6.5 | Cisco IOS XR Software Health Check Open Port Vulnerability Assigned by cisco | May 26, 2022 |
| CVE-2022-22674 Known exploited | Medium 5.5 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. Assigned by apple | May 26, 2022 |
| CVE-2022-22675 Known exploited | High 7.8 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | May 26, 2022 |
| CVE-2022-30190 Known exploited | High 7.8 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Assigned by microsoft | Jun 1, 2022 |
| CVE-2022-26134 Known exploited | Critical 9.8 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data… Assigned by atlassian | Jun 3, 2022 |
| CVE-2022-22071 Known exploited | High 8.4 | Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… Assigned by qualcomm | Jun 14, 2022 |
| CVE-2022-22047 Known exploited | High 7.8 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability Assigned by microsoft | Jul 12, 2022 |
| CVE-2022-26352 Known exploited | Critical 9.8 | An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Assigned by mitre | Jul 17, 2022 |
| CVE-2022-33891 Known exploited | High 8.8 | Apache Spark shell command injection vulnerability via Spark UI Assigned by apache | Jul 18, 2022 |
| CVE-2022-35405 Known exploited | Critical 9.8 | Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. Assigned by mitre | Jul 19, 2022 |
| CVE-2022-26138 Known exploited | Critical 9.8 | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded p… Assigned by atlassian | Jul 20, 2022 |
| CVE-2022-1096 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Jul 22, 2022 |
| CVE-2022-1364 Known exploited | High 8.8 | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Jul 26, 2022 |
| CVE-2022-2294 Known exploited | High 8.8 | Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Jul 28, 2022 |
| CVE-2022-34713 Known exploited | High 7.8 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Assigned by microsoft | Aug 9, 2022 |
| CVE-2022-0028 Known exploited | High 8.6 | PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering Assigned by palo_alto | Aug 10, 2022 |
| CVE-2022-37042 Known exploited | Critical 9.8 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. Assigned by mitre | Aug 11, 2022 |
| CVE-2022-32894 Known exploited | High 7.8 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | Aug 24, 2022 |
| CVE-2022-32893 Known exploited | High 8.8 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | Aug 24, 2022 |
| CVE-2022-36804 Known exploited | High 8.8 | Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.… Assigned by atlassian | Aug 25, 2022 |
| CVE-2022-36537 Known exploited | High 7.5 | ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader. Assigned by mitre | Aug 26, 2022 |
| CVE-2022-37055 Known exploited | Critical 9.8 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main, Assigned by mitre | Aug 28, 2022 |
| CVE-2022-27593 Known exploited | Critical 10.0 | DeadBolt Ransomware Assigned by qnap | Sep 8, 2022 |
| CVE-2022-37969 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Sep 13, 2022 |
| CVE-2022-35914 Known exploited | Critical 9.8 | /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Assigned by mitre | Sep 19, 2022 |
