| CVE-2016-0040 Known exploited | High 7.8 | The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege V… Assigned by microsoft | Feb 10, 2016 |
| CVE-2016-0984 Known exploited | High 8.8 | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR S… Assigned by adobe | Feb 10, 2016 |
| CVE-2016-0752 Known exploited | High 7.5 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read… Assigned by redhat | Feb 16, 2016 |
| CVE-2016-2388 Known exploited | Medium 5.3 | The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Assigned by mitre | Feb 16, 2016 |
| CVE-2016-2386 Known exploited | Critical 9.8 | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. Assigned by mitre | Feb 16, 2016 |
| CVE-2016-0099 Known exploited | High 7.8 | The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 15… Assigned by microsoft | Mar 9, 2016 |
| CVE-2016-1010 Known exploited | High 8.8 | Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK befor… Assigned by adobe | Mar 12, 2016 |
| CVE-2016-1646 Known exploited | High 8.8 | The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to c… Assigned by Chrome | Mar 29, 2016 |
| CVE-2016-1019 Known exploited | High 7.8 | Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild… Assigned by adobe | Apr 7, 2016 |
| CVE-2016-3976 Known exploited | High 7.5 | Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownload… Assigned by mitre | Apr 7, 2016 |
| CVE-2016-0167 Known exploited | High 7.8 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 al… Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-0165 Known exploited | High 7.8 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 al… Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-0162 Known exploited | Medium 4.3 | Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability." Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-0151 Known exploited | High 7.8 | The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local user… Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-3427 Known exploited | Critical 9.8 | Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector… Assigned by oracle | Apr 21, 2016 |
| CVE-2016-3081 Known exploited | High 8.1 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to… Assigned by redhat | Apr 26, 2016 |
| CVE-2016-3718 Known exploited | Medium 5.5 | The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Assigned by redhat | May 5, 2016 |
| CVE-2016-3715 Known exploited | Medium 5.5 | The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Assigned by redhat | May 5, 2016 |
| CVE-2016-3714 Known exploited | High 8.4 | The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code… Assigned by redhat | May 5, 2016 |
| CVE-2016-4117 Known exploited | High 7.8 | Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016. Assigned by adobe | May 11, 2016 |
| CVE-2016-0189 Known exploited | High 7.5 | The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of… Assigned by microsoft | May 11, 2016 |
| CVE-2016-0185 Known exploited | High 7.8 | Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Cente… Assigned by microsoft | May 11, 2016 |
| CVE-2010-5326 Known exploited | Critical 10.0 | The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HT… Assigned by mitre | May 13, 2016 |
| CVE-2016-3088 Known exploited | Critical 9.8 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Assigned by redhat | Jun 1, 2016 |
| CVE-2016-4437 Known exploited | Critical 9.8 | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an uns… Assigned by redhat | Jun 7, 2016 |
| CVE-2016-4523 Known exploited | High 7.5 | The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified v… Assigned by icscert | Jun 9, 2016 |
| CVE-2016-3235 Known exploited | High 7.8 | Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted… Assigned by microsoft | Jun 16, 2016 |
| CVE-2016-4171 Known exploited | High 7.8 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016. Assigned by adobe | Jun 16, 2016 |
| CVE-2016-3643 Known exploited | High 7.8 | SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd." Assigned by mitre | Jun 17, 2016 |
| CVE-2016-3309 Known exploited | High 7.8 | The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and… Assigned by microsoft | Aug 9, 2016 |
| CVE-2016-6367 Known exploited | High 7.8 | Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or… Assigned by cisco | Aug 18, 2016 |
| CVE-2016-6366 Known exploited | High 8.8 | Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM de… Assigned by cisco | Aug 18, 2016 |
| CVE-2016-4657 Known exploited | High 8.8 | WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Assigned by apple | Aug 25, 2016 |
| CVE-2016-4656 Known exploited | High 7.8 | The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Assigned by apple | Aug 25, 2016 |
| CVE-2016-4655 Known exploited | Medium 5.5 | The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. Assigned by apple | Aug 25, 2016 |
| CVE-2016-3351 Known exploited | Medium 6.5 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." Assigned by microsoft | Sep 14, 2016 |
| CVE-2016-6415 Known exploited | High 7.5 | The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain… Assigned by cisco | Sep 19, 2016 |
| CVE-2016-7193 Known exploited | High 7.8 | Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on Sha… Assigned by microsoft | Oct 14, 2016 |
| CVE-2016-3393 Known exploited | High 7.8 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Window… Assigned by microsoft | Oct 14, 2016 |
| CVE-2016-3298 Known exploited | Medium 6.5 | Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence o… Assigned by microsoft | Oct 14, 2016 |
| CVE-2016-7855 Known exploited | High 8.8 | Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as… Assigned by adobe | Nov 1, 2016 |
| CVE-2016-7256 Known exploited | High 8.8 | atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold,… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7255 Known exploited | High 7.8 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 160… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7201 Known exploited | High 8.8 | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7200 Known exploited | High 8.8 | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-5195 Known exploited | High 7.0 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-… Assigned by Chrome | Nov 10, 2016 |
| CVE-2016-8562 Known exploited | High 7.5 | A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Assigned by mitre | Nov 18, 2016 |
| CVE-2016-9563 Known exploited | Medium 6.5 | BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Se… Assigned by mitre | Nov 23, 2016 |
| CVE-2016-6277 Known exploited | High 8.8 | NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before… Assigned by mitre | Dec 14, 2016 |
| CVE-2016-7892 Known exploited | High 8.8 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Assigned by adobe | Dec 15, 2016 |
