| CVE-2018-14558 Known exploited | Critical 9.8 | An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06… Assigned by mitre | Oct 30, 2018 |
| CVE-2018-14667 Known exploited | Critical 9.8 | The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. Assigned by redhat | Nov 6, 2018 |
| CVE-2018-8589 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Window… Assigned by microsoft | Nov 14, 2018 |
| CVE-2018-8581 Known exploited | High 7.4 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server. Assigned by microsoft | Nov 14, 2018 |
| CVE-2018-6065 Known exploited | High 8.8 | Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit he… Assigned by Chrome | Nov 14, 2018 |
| CVE-2018-17463 Known exploited | High 8.8 | Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome | Nov 14, 2018 |
| CVE-2018-19410 Known exploited | Critical 9.8 | PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). Assigned by mitre | Nov 21, 2018 |
| CVE-2018-1000861 Known exploited | Critical 9.8 | A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that all… Assigned by mitre | Dec 10, 2018 |
| CVE-2018-17480 Known exploited | High 8.8 | Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code i… Assigned by Chrome | Dec 11, 2018 |
| CVE-2018-20062 Known exploited | Critical 9.8 | An issue was discovered in NoneCms V1.3. Assigned by mitre | Dec 11, 2018 |
| CVE-2018-8639 Known exploited | High 8.4 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows… Assigned by microsoft | Dec 12, 2018 |
| CVE-2018-8611 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, W… Assigned by microsoft | Dec 12, 2018 |
| CVE-2018-8653 Known exploited | High 7.5 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects… Assigned by microsoft | Dec 20, 2018 |
| CVE-2018-19323 Known exploited | Critical 9.8 | The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and writ… Assigned by mitre | Dec 21, 2018 |
| CVE-2018-19322 Known exploited | High 7.8 | The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to r… Assigned by mitre | Dec 21, 2018 |
| CVE-2018-19321 Known exploited | High 7.8 | The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to r… Assigned by mitre | Dec 21, 2018 |
| CVE-2018-19320 Known exploited | High 7.8 | The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionalit… Assigned by mitre | Dec 21, 2018 |
| CVE-2019-0543 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows S… Assigned by microsoft | Jan 8, 2019 |
| CVE-2019-0541 Known exploited | High 8.8 | A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Micr… Assigned by microsoft | Jan 8, 2019 |
| CVE-2018-15982 Known exploited | High 7.8 | Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Assigned by adobe | Jan 18, 2019 |
| CVE-2018-13374 Known exploited | Medium 4.3 | A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGa… Assigned by fortinet | Jan 22, 2019 |
| CVE-2019-1653 Known exploited | High 7.5 | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability Assigned by cisco | Jan 24, 2019 |
| CVE-2019-1652 Known exploited | High 7.2 | Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability Assigned by cisco | Jan 24, 2019 |
| CVE-2018-20753 Known exploited | Critical 9.8 | Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. Assigned by mitre | Feb 5, 2019 |
| CVE-2017-18362 Known exploited | Critical 9.8 | ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. Assigned by mitre | Feb 5, 2019 |
| CVE-2018-20250 Known exploited | High 7.8 | In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). Assigned by checkpoint | Feb 5, 2019 |
| CVE-2019-8394 Known exploited | High 7.5 | Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Assigned by mitre | Feb 17, 2019 |
| CVE-2019-6340 Known exploited | High 8.1 | Drupal core - Highly critical - Remote Code Execution Assigned by drupal | Feb 21, 2019 |
| CVE-2019-9082 Known exploited | High 8.8 | ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=syste… Assigned by mitre | Feb 24, 2019 |
| CVE-2019-6223 Known exploited | High 7.5 | A logic issue existed in the handling of Group FaceTime calls. Assigned by apple | Mar 5, 2019 |
| CVE-2019-0676 Known exploited | Medium 6.5 | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of fil… Assigned by microsoft | Mar 6, 2019 |
| CVE-2019-0604 Known exploited | Critical 9.8 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vuln… Assigned by microsoft | Mar 6, 2019 |
| CVE-2018-18809 Known exploited | Critical 9.9 | TIBCO JasperReports Library Directory Traversal Vulnerability Assigned by tibco | Mar 7, 2019 |
| CVE-2019-1003030 Known exploited | Critical 9.9 | A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able t… Assigned by jenkins | Mar 8, 2019 |
| CVE-2019-1003029 Known exploited | Critical 9.9 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jen… Assigned by jenkins | Mar 8, 2019 |
| CVE-2019-7238 Known exploited | Critical 9.8 | Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. Assigned by mitre | Mar 21, 2019 |
| CVE-2019-9978 Known exploited | Medium 6.1 | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. Assigned by mitre | Mar 24, 2019 |
| CVE-2019-7609 Known exploited | Critical 9.8 | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Assigned by elastic | Mar 25, 2019 |
| CVE-2019-3396 Known exploited | Critical 9.8 | The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 bef… Assigned by atlassian | Mar 25, 2019 |
| CVE-2019-10068 Known exploited | Critical 9.8 | An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Assigned by mitre | Mar 26, 2019 |
| CVE-2019-5418 Known exploited | High 7.5 | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targ… Assigned by hackerone | Mar 27, 2019 |
| CVE-2018-4344 Known exploited | High 7.8 | A memory corruption issue was addressed with improved memory handling. Assigned by apple | Apr 3, 2019 |
| CVE-2019-11001 Known exploited | High 7.2 | On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrate… Assigned by mitre | Apr 8, 2019 |
| CVE-2019-0211 Known exploited | High 7.8 | In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip… Assigned by apache | Apr 8, 2019 |
| CVE-2019-0703 Known exploited | Medium 6.5 | An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Assigned by microsoft | Apr 8, 2019 |
| CVE-2019-0808 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft | Apr 9, 2019 |
| CVE-2019-0797 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft | Apr 9, 2019 |
| CVE-2019-0752 Known exploited | High 7.5 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft | Apr 9, 2019 |
| CVE-2019-0803 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft | Apr 9, 2019 |
| CVE-2019-0841 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Assigned by microsoft | Apr 9, 2019 |
