2022-2023 CISA Announced Key Known Exploited Vulnerabilities

Stay up to date with a selection of CISA announced known exploited vulnerabilities. This list will continue to grow in order to keep you and your team informed.

Ongoing Vulnerability List

Navigate to the major company vulnerabilities using the anchor links below. You can see the full lists with all known vulnerabilities on the CISA website catalogue.

Company List

Adobe - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-21608

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Acrobat and Reader	Adobe Acrobat and Reader Use-After-Free Vulnerability	2023-10-10	Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-31	CVE-2023-21608

CVE-2023-26369

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Acrobat and Reader	Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability	2023-09-14	Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-05	CVE-2023-26369

CVE-2023-26359

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
ColdFusion	Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	2023-08-21	Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-09-11	CVE-2023-26359

CVE-2023-29298

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
ColdFusion	Adobe ColdFusion Improper Access Control Vulnerability	2023-07-20	Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-08-10	CVE-2023-29298

CVE-2023-38205

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
ColdFusion	Adobe ColdFusion Improper Access Control Vulnerability	2023-07-20	Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-08-10	CVE-2023-38205

Android - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-35674

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Framework	Android Framework Privilege Escalation Vulnerability	2023-09-13	Android Framework contains an unspecified vulnerability that allows for privilege escalation.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-04	CVE-2023-35674

CVE-2023-21492

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Mobile Devices	Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability	2023-05-19	Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.	Apply updates per vendor instructions.	2023-06-09	CVE-2023-21492

CVE-2021-45046

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Log4j2	Apache Log4j2 Deserialization of Untrusted Data Vulnerability	2023-05-01	Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.	Apply updates per vendor instructions.	2023-05-22	CVE-2021-45046

CVE-2023-2136

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Chrome	Google Chrome Skia Integer Overflow Vulnerability	2023-04-21	Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products.	Apply updates per vendor instructions.	2023-05-12	CVE-2023-2136

CVE-2023-20963

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Framework	Android Framework Privilege Escalation Vulnerability	2023-04-13	Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.	Apply updates per vendor instructions.	2023-05-04	CVE-2023-20963

Apache - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-46604

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
ACTIVEMQ	Apache ActiveMQ Deserialization of Untrusted Data Vulnerability	2023-11-02	Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.	2023-11-23	CVE-2023-46604

CVE-2023-33246

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
RocketMQ	Apache RocketMQ Command Execution Vulnerability	2023-09-06	Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.	2023-09-27	CVE-2023-33246

CVE-2016-8735

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Tomcat	Apache Tomcat Remote Code Execution Vulnerability	2023-05-12	Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.	2023-06-02	CVE-2016-8735

CVE-2021-45046

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Log4j2	Apache Log4j2 Deserialization of Untrusted Data Vulnerability	2023-05-01	Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.	2023-05-22	CVE-2021-45046

CVE-2022-33891

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Spark	Apache Spark Command Injection Vulnerability	2023-03-07	Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.	2023-03-28	CVE-2022-33891

Return To Top | Go To Full CISA Catalogue

Apple - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-42824

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
iOS and iPadOS	Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability	2023-10-05	Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-26	CVE-2023-42824

CVE-2023-41991

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Multiple Products	Apple Multiple Products Improper Certificate Validation Vulnerability	2023-09-25	Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-16	CVE-2023-41991

CVE-2023-41992

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Multiple Products	Apple Multiple Products Kernel Privilege Escalation Vulnerability	2023-09-25	Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-16	CVE-2023-41992

CVE-2023-41993

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Multiple Products	Apple Multiple Products WebKit Code Execution Vulnerability	2023-09-25	Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that can allow an attacker to execute code when processing web content.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-16	CVE-2023-41993

CVE-2023-41064

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
iOS, iPadOS, and macOS	Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability	2023-09-11	Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-02	CVE-2023-41064

Cisco - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-20273

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
CISCO IOS XE WEB UI	Cisco IOS XE Web UI Command Injection Vulnerability	2023-10-23	Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.	Apply updates per vendor instructions.	2023-10-27	CVE-2023-20273

CVE-2021-1435

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Cisco IOS XE Web UI	Cisco IOS XE Web UI Command Injection Vulnerability	2023-10-19	Cisco IOS XE contains a command injection vulnerability in the web user interface that could allow a remote, authenticated attacker to inject commands that can be executed as the root user.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-11-09	CVE-2021-1435

CVE-2023-20198

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
IOS XE Web UI	Cisco IOS XE Web UI Privilege Escalation Vulnerability	2023-10-16	Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.	Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.	2023-10-20	CVE-2023-20198

CVE-2023-20109

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
IOS and IOS XE	Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability	2023-10-10	Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-31	CVE-2023-20109

CVE-2023-20269

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Adaptive Security Appliance and Firepower Threat Defense	Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability	2023-09-13	Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.	Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.	2023-10-04	CVE-2023-20269

Citrix - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-4966

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
NetScaler ADC and NetScaler Gateway	Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability	2023-10-18	Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-11-08	CVE-2023-4966

CVE-2023-24489

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Content Collaboration	Citrix Content Collaboration ShareFile Improper Access Control Vulnerability	2023-08-16	Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-09-06	CVE-2023-24489

CVE-2023-3519

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
NetScaler ADC and NetScaler Gateway	Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability	2023-07-19	Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-08-09	CVE-2023-3519

CVE-2022-27518

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Application Delivery Controller (ADC) and Gateway	Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability	2022-12-13	Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability which allows an attacker to execute code as administrator.	Apply updates per vendor instructions.	2023-01-03	CVE-2022-27518

CVE-2019-11634

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Workspace (for Windows)	Citrix Workspace (for Windows) Prior to 1904 Improper Access Control	2022-11-03	Citrix Workspace app and Receiver for Windows prior to version 1904 contains an incorrect access control vulnerability which allows for code execution.	Apply updates per vendor instructions.	2022-05-03	CVE-2019-11634

Return To Top | Go To Full CISA Catalogue

Google - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-5217

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Chrome libvpx	Google Chrome libvpx Heap Buffer Overflow Vulnerability	2023-10-02	Google Chrome libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-23	CVE-2023-5217

CVE-2023-4863

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Chromium WebP	Google Chromium WebP Heap-Based Buffer Overflow Vulnerability	2023-09-13	Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-04	CVE-2023-4863

CVE-2023-3079

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Chromium V8 Engine	Google Chromium V8 Type Confusion Vulnerability	2023-06-07	Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.	Apply updates per vendor instructions.	2023-06-28	CVE-2023-3079

CVE-2023-2136

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Chrome	Google Chrome Skia Integer Overflow Vulnerability	2023-04-21	Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products.	Apply updates per vendor instructions.	2023-05-12	CVE-2023-2136

CVE-2023-2033

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Chromium V8 Engine	Google Chromium V8 Engine Type Confusion Vulnerability	2023-04-17	Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time.	Apply updates per vendor instructions.	2023-05-08	CVE-2023-2033

IBM - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2022-47986

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Aspera Faspex	IBM Aspera Faspex Code Execution Vulnerability	2023-02-21	IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.	Apply updates per vendor instructions.	2023-03-14	CVE-2022-47986

CVE-2013-3993

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
InfoSphere BigInsights	IBM InfoSphere BigInsights Invalid Input Vulnerability	2022-05-25	Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.	The impacted product is end-of-life and should be disconnected if still in use.	2022-06-15	CVE-2013-3993

CVE-2015-7450

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
WebSphere Application Server and Server Hypervisor Edition	IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.	2022-01-10	Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands.	Apply updates per vendor instructions.	2022-07-10	CVE-2015-7450

CVE-2019-4716

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
IBM Planning Analytics	IBM Planning Analytics configuration overwrite vulnerability	2021-11-03	IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.	Apply updates per vendor instructions.	2022-05-03	CVE-2019-4716

CVE-2020-4428

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
IBM Data Risk Manager	IBM Data Risk Manager Command Injection	2021-11-03	IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.	Apply updates per vendor instructions.	2022-05-03	CVE-2020-4428

Microsoft - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2023-36584

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Windows	Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability	2023-11-16	Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-12-07	CVE-2023-36584

CVE-2023-36036

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Windows	Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability	2023-11-14	Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-12-05	CVE-2023-36036

CVE-2023-36033

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Windows	Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability	2023-11-14	Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-12-05	CVE-2023-36033

CVE-2023-36025

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
WINDOWS	Microsoft Windows SmartScreen Security Feature Bypass Vulnerability	2023-11-14	Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-12-05	CVE-2023-36025

CVE-2023-41763

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Skype for Business	Microsoft Skype for Business Privilege Escalation Vulnerability	2023-10-10	Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	2023-10-31	CVE-2023-41763

Return To Top | Go To Full CISA Catalogue

Oracle - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2020-2551

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Fusion Middleware	Oracle Fusion Middleware Unspecified Vulnerability	2023-11-16	Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.	Apply updates per vendor instructions.	2023-12-07	CVE-2020-2551

CVE-2016-3427

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Java SE and JRockit	Oracle WebLogic Server Unspecified Vulnerability	2023-05-12	Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.	Apply updates per vendor instructions.	2023-06-02	CVE-2016-3427

CVE-2016-8735

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Tomcat	Apache Tomcat Remote Code Execution Vulnerability	2023-05-12	Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.	Apply updates per vendor instructions.	2023-06-02	CVE-2016-8735

CVE-2023-21839

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
WebLogic Server	Oracle WebLogic Server Unspecified Vulnerability	2023-05-01	Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.	Apply updates per vendor instructions.	2023-05-22	CVE-2023-21839

CVE-2022-21587

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
E-Business Suite	Oracle E-Business Suite Unspecified Vulnerability	2023-02-02	Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.	Apply updates per vendor instructions.	2023-02-23	CVE-2022-21587

Palo Alto Networks - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2022-0028

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
PAN-OS	Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability	2022-08-22	A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.	Apply updates per vendor instructions.	2022-09-12	CVE-2022-0028

CVE-2017-15944

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
PAN-OS	Palo Alto Networks PAN-OS Remote Code Execution Vulnerability	2022-08-18	Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.	Apply updates per vendor instructions.	2022-09-08	CVE-2017-15944

CVE-2020-2021

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
PAN-OS	Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	2022-03-25	Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.	Apply updates per vendor instructions.	2022-04-15	CVE-2020-2021

CVE-2019-1579

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
PAN-OS	Palo Alto Networks PAN-OS Remote Code Execution Vulnerability	2022-01-10	Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.	Apply updates per vendor instructions.	2022-07-10	CVE-2019-1579

SAP - 2022-2023 Latest Known Exploited Vulnerabilities

CVE-2022-22536

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
Multiple Products	SAP Multiple Products HTTP Request Smuggling Vulnerability	2022-08-18	SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.	Apply updates per vendor instructions.	2022-09-08	CVE-2022-22536

CVE-2016-2388

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
NetWeaver	SAP NetWeaver Information Disclosure Vulnerability	2022-06-09	The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.	Apply updates per vendor instructions.	2022-06-30	CVE-2016-2388

CVE-2016-2386

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
NetWeaver	SAP NetWeaver SQL Injection Vulnerability	2022-06-09	SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.	Apply updates per vendor instructions.	2022-06-30	CVE-2016-2386

CVE-2021-38163

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
NetWeaver	SAP NetWeaver Unrestricted File Upload Vulnerability	2022-06-09	SAP NetWeaver contains a vulnerability that allows unrestricted file upload.	Apply updates per vendor instructions.	2022-06-30	CVE-2021-38163

CVE-2016-3976

Product	Vulnerability Name	Date Added to Catalogue	Short Description	Action	Due Date	Detailed Info Link
SAP NetWeaver AS Java	SAP NetWeaver AS Java 7.1 - 7.5 Directory Traversal Vulnerability	2022-11-03	Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.	Apply updates per vendor instructions.	2022-05-03	CVE-2016-3976

Return To Top | Go To Full CISA Catalogue