Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2023-20118 |
Description: CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
CVE-2023-20118 Cisco Small Business RV Series Routers Command Injection Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
CVE-2024-4885 Progress WhatsUp Gold Path Traversal Vulnerability
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the cata...
CVSS: MEDIUM (6.5)
March 3rd, 2025 (3 months ago)
|
|
CVE-2025-1488 |
Description: The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured.
CVSS: MEDIUM (4.7) EPSS Score: 0.02%
February 24th, 2025 (3 months ago)
|
|
CVE-2025-21401 |
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS: MEDIUM (4.5) EPSS Score: 0.06%
February 15th, 2025 (4 months ago)
|
|
CVE-2025-21377 |
Description: NTLM Hash Disclosure Spoofing Vulnerability
CVSS: MEDIUM (6.5) EPSS Score: 0.09%
February 12th, 2025 (4 months ago)
|
|
CVE-2025-21352 |
Description: Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVSS: MEDIUM (6.5) EPSS Score: 0.04%
February 12th, 2025 (4 months ago)
|
|
CVE-2025-21350 |
Description: Windows Kerberos Denial of Service Vulnerability
CVSS: MEDIUM (5.9) EPSS Score: 0.06%
February 12th, 2025 (4 months ago)
|
|
CVE-2025-21349 |
Description: Windows Remote Desktop Configuration Service Tampering Vulnerability
CVSS: MEDIUM (6.8) EPSS Score: 0.18%
February 12th, 2025 (4 months ago)
|
|
CVE-2025-21347 |
Description: Windows Deployment Services Denial of Service Vulnerability
CVSS: MEDIUM (6.0) EPSS Score: 0.05%
February 12th, 2025 (4 months ago)
|
|
CVE-2025-21259 |
Description: Microsoft Outlook Spoofing Vulnerability
CVSS: MEDIUM (5.3) EPSS Score: 0.06%
February 12th, 2025 (4 months ago)
|
|
CVE-2025-21254 |
Description: Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVSS: MEDIUM (6.5) EPSS Score: 0.06%
February 12th, 2025 (4 months ago)
|