| CVE-2023-0669 Known exploited | High 7.2 | Fortra GoAnywhere MFT License Response Servlet Command Injection Assigned by rapid7 | Feb 6, 2023 |
| CVE-2023-0266 Known exploited | High 7.9 | Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel Assigned by Google | Jan 30, 2023 |
| CVE-2023-21608 Known exploited | High 7.8 | Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability Assigned by adobe | Jan 18, 2023 |
| CVE-2022-47966 Known exploited | Critical 9.8 | Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because th… Assigned by mitre | Jan 18, 2023 |
| CVE-2023-21839 Known exploited | High 7.5 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Assigned by oracle | Jan 17, 2023 |
| CVE-2023-22952 Known exploited | High 8.8 | In SugarCRM before 12.0. Assigned by mitre | Jan 11, 2023 |
| CVE-2023-21674 Known exploited | High 8.8 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability Assigned by microsoft | Jan 10, 2023 |
| CVE-2022-44877 Known exploited | Critical 9.8 | login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter. Assigned by mitre | Jan 5, 2023 |
| CVE-2022-42475 Known exploited | Critical 9.3 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN… Assigned by fortinet | Jan 2, 2023 |
| CVE-2022-26486 Known exploited | Critical 9.6 | An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Assigned by mozilla | Dec 22, 2022 |
| CVE-2022-26485 Known exploited | High 8.8 | Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Assigned by mozilla | Dec 22, 2022 |
| CVE-2022-42856 Known exploited | High 8.8 | A type confusion issue was addressed with improved state handling. Assigned by apple | Dec 15, 2022 |
| CVE-2022-44698 Known exploited | Medium 5.4 | Windows SmartScreen Security Feature Bypass Vulnerability Assigned by microsoft | Dec 13, 2022 |
| CVE-2022-27518 Known exploited | Critical 9.8 | Unauthenticated remote arbitrary code execution Assigned by Citrix | Dec 13, 2022 |
| CVE-2022-46169 Known exploited | Critical 9.8 | Unauthenticated Command Injection Assigned by GitHub_M | Dec 5, 2022 |
| CVE-2022-4262 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Dec 2, 2022 |
| CVE-2022-40799 Known exploited | High 8.8 | Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. Assigned by mitre | Nov 29, 2022 |
| CVE-2022-4135 Known exploited | Critical 9.6 | Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome | Nov 25, 2022 |
| CVE-2022-41223 Known exploited | Medium 6.8 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictio… Assigned by mitre | Nov 22, 2022 |
| CVE-2022-40765 Known exploited | Medium 6.8 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection at… Assigned by mitre | Nov 22, 2022 |
| CVE-2022-23748 Known exploited | High 7.8 | mDNSResponder.exe is vulnerable to DLL Sideloading attack. Assigned by checkpoint | Nov 17, 2022 |
| CVE-2022-41128 Known exploited | High 8.8 | Windows Scripting Languages Remote Code Execution Vulnerability Assigned by microsoft | Nov 9, 2022 |
| CVE-2022-41125 Known exploited | High 7.8 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability Assigned by microsoft | Nov 9, 2022 |
| CVE-2022-41091 Known exploited | Medium 5.4 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Nov 9, 2022 |
| CVE-2022-41080 Known exploited | High 8.8 | Microsoft Exchange Server Elevation of Privilege Vulnerability Assigned by microsoft | Nov 9, 2022 |
| CVE-2022-41073 Known exploited | High 7.8 | Windows Print Spooler Elevation of Privilege Vulnerability Assigned by microsoft | Nov 9, 2022 |
| CVE-2022-41049 Known exploited | Medium 5.4 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Nov 9, 2022 |
| CVE-2022-31199 Known exploited | Critical 9.8 | Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. Assigned by mitre | Nov 8, 2022 |
| CVE-2022-3723 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 1, 2022 |
| CVE-2022-42827 Known exploited | High 7.8 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | Nov 1, 2022 |
| CVE-2022-38181 Known exploited | High 8.8 | The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. Assigned by mitre | Oct 25, 2022 |
| CVE-2016-20017 Known exploited | Critical 9.8 | D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022. Assigned by mitre | Oct 19, 2022 |
| CVE-2022-21587 Known exploited | Critical 9.8 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Assigned by oracle | Oct 18, 2022 |
| CVE-2022-40684 Known exploited | Critical 9.8 | An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6… Assigned by fortinet | Oct 18, 2022 |
| CVE-2022-41033 Known exploited | High 7.8 | Windows COM+ Event System Service Elevation of Privilege Vulnerability Assigned by microsoft | Oct 11, 2022 |
| CVE-2022-38028 Known exploited | High 7.8 | Windows Print Spooler Elevation of Privilege Vulnerability Assigned by microsoft | Oct 11, 2022 |
| CVE-2022-41082 Known exploited | High 8.0 | Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft | Oct 3, 2022 |
| CVE-2022-41040 Known exploited | High 8.8 | Microsoft Exchange Server Elevation of Privilege Vulnerability Assigned by microsoft | Oct 3, 2022 |
| CVE-2022-20775 Known exploited | High 7.8 | Cisco SD-WAN Software Privilege Escalation Vulnerability Assigned by cisco | Sep 30, 2022 |
| CVE-2022-3075 Known exploited | Critical 9.6 | Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted… Assigned by Chrome | Sep 26, 2022 |
| CVE-2022-3038 Known exploited | High 8.8 | Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Sep 26, 2022 |
| CVE-2022-2856 Known exploited | Medium 6.5 | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML pag… Assigned by Chrome | Sep 26, 2022 |
| CVE-2022-41352 Known exploited | Critical 9.8 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Assigned by mitre | Sep 26, 2022 |
| CVE-2022-3236 Known exploited | Critical 9.8 | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. Assigned by Sophos | Sep 23, 2022 |
| CVE-2022-39197 Known exploited | Medium 6.1 | An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. Assigned by mitre | Sep 22, 2022 |
| CVE-2022-32917 Known exploited | High 7.8 | The issue was addressed with improved bounds checks. Assigned by apple | Sep 20, 2022 |
| CVE-2022-40139 Known exploited | High 7.2 | Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct aff… Assigned by trendmicro | Sep 19, 2022 |
| CVE-2022-35914 Known exploited | Critical 9.8 | /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Assigned by mitre | Sep 19, 2022 |
| CVE-2022-37969 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Sep 13, 2022 |
| CVE-2022-27593 Known exploited | Critical 10.0 | DeadBolt Ransomware Assigned by qnap | Sep 8, 2022 |
