{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1105 Ingress Tool Transfer","home_page_url":"https://patchfirst.co/technique/T1105/","feed_url":"https://patchfirst.co/feed/technique/T1105.json","description":"New and newly exploited CVEs that lead to ATT&CK T1105 Ingress Tool Transfer, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-118527#kev","url":"https://patchfirst.co/cve/CVE-2026-118527/","title":"[KEV] CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. No EPSS score. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 45.0 of 100.","summary":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-30T00:00:00.000Z","tags":["kev","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":45,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":null,"cvss":null,"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-76519#kev","url":"https://patchfirst.co/cve/CVE-2026-76519/","title":"[KEV] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability","content_text":"Cisco · Secure Email Gateway. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 76.3 of 100.","summary":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:19.000Z","tags":["kev","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.02152,"percentile":0.82127},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Email Gateway","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-84869#kev","url":"https://patchfirst.co/cve/CVE-2026-84869/","title":"[KEV] CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","content_text":"ConnectWise · ScreenConnect. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 60.4% of CVEs). CVSS 9.9 CRITICAL. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 67.0 of 100.","summary":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-09-12T04:16:42.000Z","tags":["kev","T1078","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":67,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.00924,"percentile":0.60395},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"ConnectWise","product":"ScreenConnect","techniqueIds":["T1078","T1059","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-20230#kev","url":"https://patchfirst.co/cve/CVE-2026-20230/","title":"[KEV] CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Cisco · Unified Communications Manager. In CISA KEV since 2026-06-25. ENISA EUVD lists it as exploited. EPSS 88.5% (higher than 99.77% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 74.0 of 100.","summary":"Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-06-25T00:00:00.000Z","date_modified":"2026-10-07T19:17:37.000Z","tags":["kev","public-exploit","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":74,"kev":{"dateAdded":"2026-06-25","ransomware":false},"epss":{"score":0.88528,"percentile":0.99771},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Unified Communications Manager","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-7399#kev","url":"https://patchfirst.co/cve/CVE-2024-7399/","title":"[KEV] CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability","content_text":"Samsung · MagicINFO 9 Server. In CISA KEV since 2026-04-24. ENISA EUVD lists it as exploited. EPSS 91.9% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 69.8 of 100.","summary":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","date_published":"2026-04-24T00:00:00.000Z","date_modified":"2026-10-01T19:17:15.000Z","tags":["kev","public-exploit","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2026-04-24","ransomware":false},"epss":{"score":0.91941,"percentile":0.99818},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Samsung","product":"MagicINFO 9 Server","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-55177#kev","url":"https://patchfirst.co/cve/CVE-2025-55177/","title":"[KEV] CVE-2025-55177: Meta Platforms WhatsApp Incorrect Authorization Vulnerability","content_text":"Meta Platforms · WhatsApp. In CISA KEV since 2025-09-02. ENISA EUVD lists it as exploited. EPSS 13.5% (higher than 96.4% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 66.1 of 100.","summary":"Meta Platforms WhatsApp Incorrect Authorization Vulnerability","date_published":"2025-09-02T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","public-exploit","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":66.1,"kev":{"dateAdded":"2025-09-02","ransomware":false},"epss":{"score":0.13513,"percentile":0.96445},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Meta Platforms","product":"WhatsApp","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-43200#kev","url":"https://patchfirst.co/cve/CVE-2025-43200/","title":"[KEV] CVE-2025-43200: Apple Multiple Products Unspecified Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2025-06-16. ENISA EUVD lists it as exploited. EPSS 1.2% (higher than 67.9% of CVEs). CVSS 4.2 MEDIUM. ATT&CK: T1203 Exploitation for Client Execution; T1105 Ingress Tool Transfer; T1005 Data from Local System. Priority 54.5 of 100.","summary":"Apple Multiple Products Unspecified Vulnerability","date_published":"2025-06-16T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","T1203","T1105","T1005"],"_patchfirst":{"reason":"kev","priority":54.5,"kev":{"dateAdded":"2025-06-16","ransomware":false},"epss":{"score":0.01191,"percentile":0.67933},"cvss":{"score":4.2,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1203","T1105","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-31200#kev","url":"https://patchfirst.co/cve/CVE-2025-31200/","title":"[KEV] CVE-2025-31200: Apple Multiple Products Memory Corruption Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 20.9% (higher than 97.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1001 Data Obfuscation; T1059 Command and Scripting Interpreter; T1106 Native API; T1557 Adversary-in-the-Middle. Priority 69.4 of 100.","summary":"Apple Multiple Products Memory Corruption Vulnerability","date_published":"2025-04-17T00:00:00.000Z","date_modified":"2026-06-17T09:10:00.000Z","tags":["kev","public-exploit","T1105","T1001","T1059","T1106","T1557"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-04-17","ransomware":false},"epss":{"score":0.20898,"percentile":0.97554},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1105","T1001","T1059","T1106","T1557"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-31201#kev","url":"https://patchfirst.co/cve/CVE-2025-31201/","title":"[KEV] CVE-2025-31201: Apple Multiple Products Arbitrary Read and Write Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 14.0% (higher than 96.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1001 Data Obfuscation; T1059 Command and Scripting Interpreter; T1106 Native API; T1557 Adversary-in-the-Middle. Priority 69.2 of 100.","summary":"Apple Multiple Products Arbitrary Read and Write Vulnerability","date_published":"2025-04-17T00:00:00.000Z","date_modified":"2026-06-17T09:10:00.000Z","tags":["kev","public-exploit","T1105","T1001","T1059","T1106","T1557"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2025-04-17","ransomware":false},"epss":{"score":0.13973,"percentile":0.96545},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1105","T1001","T1059","T1106","T1557"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-11667#kev","url":"https://patchfirst.co/cve/CVE-2024-11667/","title":"[KEV] CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2024-12-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 2.9% (higher than 87.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1105 Ingress Tool Transfer. Priority 72.3 of 100.","summary":"Zyxel Multiple Firewalls Path Traversal Vulnerability","date_published":"2024-12-03T00:00:00.000Z","date_modified":"2026-08-05T05:16:40.000Z","tags":["kev","ransomware","T1190","T1005","T1105"],"_patchfirst":{"reason":"kev","priority":72.3,"kev":{"dateAdded":"2024-12-03","ransomware":true},"epss":{"score":0.02929,"percentile":0.8706},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1005","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-23692#kev","url":"https://patchfirst.co/cve/CVE-2024-23692/","title":"[KEV] CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","content_text":"Rejetto · HTTP File Server. In CISA KEV since 2024-07-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1082 System Information Discovery; T1005 Data from Local System; T1105 Ingress Tool Transfer; T1496 Resource Hijacking. Priority 79.8 of 100.","summary":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_published":"2024-07-09T00:00:00.000Z","date_modified":"2026-08-11T04:17:15.000Z","tags":["kev","ransomware","public-exploit","T1082","T1005","T1105","T1496"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-07-09","ransomware":true},"epss":{"score":0.99485,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Rejetto","product":"HTTP File Server","techniqueIds":["T1082","T1005","T1105","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-4978#kev","url":"https://patchfirst.co/cve/CVE-2024-4978/","title":"[KEV] CVE-2024-4978: Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability","content_text":"Justice AV Solutions · Viewer . In CISA KEV since 2024-05-29. ENISA EUVD lists it as exploited. EPSS 26.9% (higher than 98% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1105 Ingress Tool Transfer; T1005 Data from Local System; T1071.001 Web Protocols. Priority 68.5 of 100.","summary":"Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability","date_published":"2024-05-29T00:00:00.000Z","date_modified":"2026-06-17T08:03:19.000Z","tags":["kev","public-exploit","T1195.002","T1105","T1005","T1071.001"],"_patchfirst":{"reason":"kev","priority":68.5,"kev":{"dateAdded":"2024-05-29","ransomware":false},"epss":{"score":0.26937,"percentile":0.98037},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1"},"vendor":"Justice AV Solutions","product":"Viewer ","techniqueIds":["T1195.002","T1105","T1005","T1071.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-48788#kev","url":"https://patchfirst.co/cve/CVE-2023-48788/","title":"[KEV] CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability","content_text":"Fortinet · FortiClient EMS. In CISA KEV since 2024-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.4% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Named in 1 threat report. Priority 83.7 of 100.","summary":"Fortinet FortiClient EMS SQL Injection Vulnerability","date_published":"2024-03-25T00:00:00.000Z","date_modified":"2026-06-17T06:34:58.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2024-03-25","ransomware":true},"epss":{"score":0.98446,"percentile":0.99919},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiClient EMS","techniqueIds":["T1190","T1059","T1105"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-29300#kev","url":"https://patchfirst.co/cve/CVE-2023-29300/","title":"[KEV] CVE-2023-29300: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2024-01-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 79.9 of 100.","summary":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","date_published":"2024-01-08T00:00:00.000Z","date_modified":"2026-06-17T05:49:44.000Z","tags":["kev","ransomware","public-exploit","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-01-08","ransomware":true},"epss":{"score":0.99991,"percentile":0.99985},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-38203#kev","url":"https://patchfirst.co/cve/CVE-2023-38203/","title":"[KEV] CVE-2023-38203: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2024-01-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 97.1% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 79.8 of 100.","summary":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","date_published":"2024-01-08T00:00:00.000Z","date_modified":"2026-06-17T06:09:39.000Z","tags":["kev","ransomware","public-exploit","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-01-08","ransomware":true},"epss":{"score":0.97074,"percentile":0.99892},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-7101#kev","url":"https://patchfirst.co/cve/CVE-2023-7101/","title":"[KEV] CVE-2023-7101: Spreadsheet::ParseExcel Remote Code Execution Vulnerability","content_text":"Spreadsheet::ParseExcel · Spreadsheet::ParseExcel. In CISA KEV since 2024-01-02. ENISA EUVD lists it as exploited. EPSS 19.0% (higher than 97.3% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 67.9 of 100.","summary":"Spreadsheet::ParseExcel Remote Code Execution Vulnerability","date_published":"2024-01-02T00:00:00.000Z","date_modified":"2026-06-17T06:52:04.000Z","tags":["kev","public-exploit","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":67.9,"kev":{"dateAdded":"2024-01-02","ransomware":false},"epss":{"score":0.18959,"percentile":0.97298},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Spreadsheet::ParseExcel","product":"Spreadsheet::ParseExcel","techniqueIds":["T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22518#kev","url":"https://patchfirst.co/cve/CVE-2023-22518/","title":"[KEV] CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","content_text":"Atlassian · Confluence Data Center and Server. In CISA KEV since 2023-11-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1033 System Owner/User Discovery; T1105 Ingress Tool Transfer. Priority 79.9 of 100.","summary":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","date_published":"2023-11-07T00:00:00.000Z","date_modified":"2026-06-17T05:35:37.000Z","tags":["kev","ransomware","public-exploit","T1190","T1033","T1105"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-11-07","ransomware":true},"epss":{"score":0.99999,"percentile":0.99996},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence Data Center and Server","techniqueIds":["T1190","T1033","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-38831#kev","url":"https://patchfirst.co/cve/CVE-2023-38831/","title":"[KEV] CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability","content_text":"RARLAB · WinRAR. In CISA KEV since 2023-08-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204 User Execution; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel; T1053 Scheduled Task/Job; T1105 Ingress Tool Transfer; T1112 Modify Registry; +1 more. Named in 1 threat report. Priority 82.3 of 100.","summary":"RARLAB WinRAR Code Execution Vulnerability","date_published":"2023-08-24T00:00:00.000Z","date_modified":"2026-08-05T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1204","T1005","T1041","T1053","T1105","T1112","T1486"],"_patchfirst":{"reason":"kev","priority":82.3,"kev":{"dateAdded":"2023-08-24","ransomware":true},"epss":{"score":0.99815,"percentile":0.99959},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"RARLAB","product":"WinRAR","techniqueIds":["T1204","T1005","T1041","T1053","T1105","T1112","T1486"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-38035#kev","url":"https://patchfirst.co/cve/CVE-2023-38035/","title":"[KEV] CVE-2023-38035: Ivanti Sentry Authentication Bypass Vulnerability","content_text":"Ivanti · Sentry. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1018 Remote System Discovery; T1046 Network Service Discovery; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; +2 more. Priority 79.9 of 100.","summary":"Ivanti Sentry Authentication Bypass Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T06:09:16.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1018","T1046","T1071.001","T1105","T1496","T1571"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.9995,"percentile":0.99974},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Sentry","techniqueIds":["T1190","T1059","T1018","T1046","T1071.001","T1105","T1496","T1571"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-3519#kev","url":"https://patchfirst.co/cve/CVE-2023-3519/","title":"[KEV] CVE-2023-3519: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2023-07-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1105 Ingress Tool Transfer; T1087.002 Domain Account. Named in 6 threat reports. Priority 89.9 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","date_published":"2023-07-19T00:00:00.000Z","date_modified":"2026-08-05T05:16:39.000Z","tags":["kev","ransomware","public-exploit","T1190","T1574","T1105","T1087.002"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2023-07-19","ransomware":true},"epss":{"score":0.99749,"percentile":0.99954},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1190","T1574","T1105","T1087.002"],"reportCount":6,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-20867#kev","url":"https://patchfirst.co/cve/CVE-2023-20867/","title":"[KEV] CVE-2023-20867: VMware Tools Authentication Bypass Vulnerability","content_text":"VMware · Tools. In CISA KEV since 2023-06-23. ENISA EUVD lists it as exploited. EPSS 13.6% (higher than 96.5% of CVEs). CVSS 3.9 LOW. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Named in 2 threat reports. Priority 76.2 of 100.","summary":"VMware Tools Authentication Bypass Vulnerability","date_published":"2023-06-23T00:00:00.000Z","date_modified":"2026-06-17T05:31:03.000Z","tags":["kev","T1078","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":76.2,"kev":{"dateAdded":"2023-06-23","ransomware":false},"epss":{"score":0.13638,"percentile":0.96477},"cvss":{"score":3.9,"severity":"LOW","version":"3.1"},"vendor":"VMware","product":"Tools","techniqueIds":["T1078","T1059","T1105"],"reportCount":2,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-34362#kev","url":"https://patchfirst.co/cve/CVE-2023-34362/","title":"[KEV] CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability","content_text":"Progress · MOVEit Transfer. In CISA KEV since 2023-06-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1082 System Information Discovery; T1105 Ingress Tool Transfer; T1136 Create Account; +1 more. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Progress MOVEit Transfer SQL Injection Vulnerability","date_published":"2023-06-02T00:00:00.000Z","date_modified":"2026-06-17T06:03:28.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1005","T1082","T1105","T1136","T1531"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2023-06-02","ransomware":true},"epss":{"score":0.99934,"percentile":0.9997},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"MOVEit Transfer","techniqueIds":["T1190","T1059","T1005","T1082","T1105","T1136","T1531"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-2868#kev","url":"https://patchfirst.co/cve/CVE-2023-2868/","title":"[KEV] CVE-2023-2868: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","content_text":"Barracuda Networks · Email Security Gateway (ESG) Appliance. In CISA KEV since 2023-05-26. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1105 Ingress Tool Transfer. Priority 69.8 of 100.","summary":"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","date_published":"2023-05-26T00:00:00.000Z","date_modified":"2026-06-17T05:53:39.000Z","tags":["kev","public-exploit","T1566.001","T1059","T1041","T1105"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-05-26","ransomware":false},"epss":{"score":0.86841,"percentile":0.99744},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Barracuda Networks","product":"Email Security Gateway (ESG) Appliance","techniqueIds":["T1566.001","T1059","T1041","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27350#kev","url":"https://patchfirst.co/cve/CVE-2023-27350/","title":"[KEV] CVE-2023-27350: PaperCut MF/NG Improper Access Control Vulnerability","content_text":"PaperCut · MF/NG. In CISA KEV since 2023-04-21, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 79.9 of 100.","summary":"PaperCut MF/NG Improper Access Control Vulnerability","date_published":"2023-04-21T00:00:00.000Z","date_modified":"2026-06-17T05:44:50.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-04-21","ransomware":true},"epss":{"score":0.99999,"percentile":0.99994},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PaperCut","product":"MF/NG","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-26360","url":"https://patchfirst.co/cve/CVE-2023-26360/","title":"CVE-2023-26360: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2023-03-15. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1003.001 LSASS Memory; T1036.005 Match Legitimate Resource Name or Location; T1046 Network Service Discovery; T1071.001 Web Protocols; +3 more. Priority 69.0 of 100.","summary":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","date_published":"2023-03-23T00:00:00.000Z","date_modified":"2026-06-17T05:43:10.000Z","tags":["kev","public-exploit","T1190","T1059.007","T1003.001","T1036.005","T1046","T1071.001","T1105","T1484.001","T1505.003"],"_patchfirst":{"reason":"published","priority":69,"kev":{"dateAdded":"2023-03-15","ransomware":false},"epss":{"score":0.97339,"percentile":0.99897},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1059.007","T1003.001","T1036.005","T1046","T1071.001","T1105","T1484.001","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-26352#kev","url":"https://patchfirst.co/cve/CVE-2022-26352/","title":"[KEV] CVE-2022-26352: dotCMS Unrestricted Upload of File Vulnerability","content_text":"dotCMS · dotCMS. In CISA KEV since 2022-08-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 91.2% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 79.8 of 100.","summary":"dotCMS Unrestricted Upload of File Vulnerability","date_published":"2022-08-25T00:00:00.000Z","date_modified":"2026-06-17T04:35:02.000Z","tags":["kev","ransomware","public-exploit","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2022-08-25","ransomware":true},"epss":{"score":0.91248,"percentile":0.99809},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"dotCMS","product":"dotCMS","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-30190#kev","url":"https://patchfirst.co/cve/CVE-2022-30190/","title":"[KEV] CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-06-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.93% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1105 Ingress Tool Transfer. Named in 4 threat reports. Priority 87.4 of 100.","summary":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","date_published":"2022-06-14T00:00:00.000Z","date_modified":"2026-08-06T05:16:37.000Z","tags":["kev","ransomware","public-exploit","T1204.002","T1105"],"_patchfirst":{"reason":"kev","priority":87.4,"kev":{"dateAdded":"2022-06-14","ransomware":true},"epss":{"score":0.99163,"percentile":0.99933},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1105"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2010-1297#kev","url":"https://patchfirst.co/cve/CVE-2010-1297/","title":"[KEV] CVE-2010-1297: Adobe Flash Player Memory Corruption Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 82.5% (higher than 99.66% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1105 Ingress Tool Transfer. Named in 1 threat report. Priority 72.3 of 100.","summary":"Adobe Flash Player Memory Corruption Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-16T23:18:02.000Z","tags":["kev","public-exploit","T1189","T1204.002","T1105"],"_patchfirst":{"reason":"kev","priority":72.3,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.82531,"percentile":0.99664},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1189","T1204.002","T1105"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2012-0754#kev","url":"https://patchfirst.co/cve/CVE-2012-0754/","title":"[KEV] CVE-2012-0754: Adobe Flash Player Memory Corruption Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 91.1% (higher than 99.81% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer. Priority 53.6 of 100.","summary":"Adobe Flash Player Memory Corruption Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-16T23:38:11.000Z","tags":["kev","public-exploit","T1105"],"_patchfirst":{"reason":"kev","priority":53.6,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.91085,"percentile":0.99808},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-8651#kev","url":"https://patchfirst.co/cve/CVE-2015-8651/","title":"[KEV] CVE-2015-8651: Adobe Flash Player Integer Overflow Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 67.7% (higher than 99.31% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1189 Drive-by Compromise; T1105 Ingress Tool Transfer; T1486 Data Encrypted for Impact. Named in 3 threat reports. Priority 81.8 of 100.","summary":"Adobe Flash Player Integer Overflow Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-06-17T00:34:57.000Z","tags":["kev","T1189","T1105","T1486"],"_patchfirst":{"reason":"kev","priority":81.8,"kev":{"dateAdded":"2022-05-25","ransomware":false},"epss":{"score":0.67698,"percentile":0.99314},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1189","T1105","T1486"],"reportCount":3,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2016-0984#kev","url":"https://patchfirst.co/cve/CVE-2016-0984/","title":"[KEV] CVE-2016-0984: Adobe Flash Player and AIR Use-After-Free Vulnerability","content_text":"Adobe · Flash Player and AIR. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 54.5% (higher than 99.02% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1105 Ingress Tool Transfer. Priority 69.0 of 100.","summary":"Adobe Flash Player and AIR Use-After-Free Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-06-17T00:38:36.000Z","tags":["kev","public-exploit","T1204.002","T1105"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2022-05-25","ransomware":false},"epss":{"score":0.54544,"percentile":0.99015},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player and AIR","techniqueIds":["T1204.002","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-11317#kev","url":"https://patchfirst.co/cve/CVE-2017-11317/","title":"[KEV] CVE-2017-11317: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability","content_text":"Telerik · User Interface (UI) for ASP.NET AJAX. In CISA KEV since 2022-04-11. ENISA EUVD lists it as exploited. EPSS 84.2% (higher than 99.69% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 69.8 of 100.","summary":"Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability","date_published":"2022-04-11T00:00:00.000Z","date_modified":"2026-06-17T01:01:36.000Z","tags":["kev","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-04-11","ransomware":false},"epss":{"score":0.84175,"percentile":0.99695},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Telerik","product":"User Interface (UI) for ASP.NET AJAX","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2010-2861#kev","url":"https://patchfirst.co/cve/CVE-2010-2861/","title":"[KEV] CVE-2010-2861: Adobe ColdFusion Directory Traversal Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer; T1119 Automated Collection. Priority 79.9 of 100.","summary":"Adobe ColdFusion Directory Traversal Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-10-02T14:55:20.000Z","tags":["kev","ransomware","public-exploit","T1190","T1105","T1119"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-03-25","ransomware":true},"epss":{"score":0.99747,"percentile":0.99954},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1105","T1119"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2010-0188#kev","url":"https://patchfirst.co/cve/CVE-2010-0188/","title":"[KEV] CVE-2010-0188: Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability","content_text":"Adobe · Reader and Acrobat. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 88.2% (higher than 99.77% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1105 Ingress Tool Transfer. Named in 2 threat reports. Priority 84.5 of 100.","summary":"Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-08-14T05:16:49.000Z","tags":["kev","ransomware","public-exploit","T1189","T1105"],"_patchfirst":{"reason":"kev","priority":84.5,"kev":{"dateAdded":"2022-03-03","ransomware":true},"epss":{"score":0.88246,"percentile":0.99768},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Reader and Acrobat","techniqueIds":["T1189","T1105"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-1019#kev","url":"https://patchfirst.co/cve/CVE-2016-1019/","title":"[KEV] CVE-2016-1019: Adobe Flash Player Arbitrary Code Execution Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 22.3% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1105 Ingress Tool Transfer; T1486 Data Encrypted for Impact. Named in 4 threat reports. Priority 83.4 of 100.","summary":"Adobe Flash Player Arbitrary Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-10-01T20:17:16.000Z","tags":["kev","ransomware","T1105","T1486"],"_patchfirst":{"reason":"kev","priority":83.4,"kev":{"dateAdded":"2022-03-03","ransomware":true},"epss":{"score":0.22316,"percentile":0.97683},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1105","T1486"],"reportCount":4,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2011-0611#kev","url":"https://patchfirst.co/cve/CVE-2011-0611/","title":"[KEV] CVE-2011-0611: Adobe Flash Player Remote Code Execution Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1105 Ingress Tool Transfer. Named in 3 threat reports. Priority 76.9 of 100.","summary":"Adobe Flash Player Remote Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T23:27:44.000Z","tags":["kev","public-exploit","T1204.002","T1105"],"_patchfirst":{"reason":"kev","priority":76.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.9941,"percentile":0.99941},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.002","T1105"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5119#kev","url":"https://patchfirst.co/cve/CVE-2015-5119/","title":"[KEV] CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 98.6% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059.007 JavaScript; T1566.002 Spearphishing Link; T1105 Ingress Tool Transfer; T1055.001 Dynamic-link Library Injection; T1071.001 Web Protocols. Named in 5 threat reports. Priority 74.8 of 100.","summary":"Adobe Flash Player Use-After-Free Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T00:28:28.000Z","tags":["kev","public-exploit","T1059.007","T1566.002","T1105","T1055.001","T1071.001"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.98618,"percentile":0.99923},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1059.007","T1566.002","T1105","T1055.001","T1071.001"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-4117#kev","url":"https://patchfirst.co/cve/CVE-2016-4117/","title":"[KEV] CVE-2016-4117: Adobe Flash Player Arbitrary Code Execution Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.3% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer. Named in 3 threat reports. Priority 72.6 of 100.","summary":"Adobe Flash Player Arbitrary Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-09-10T04:17:30.000Z","tags":["kev","ransomware","public-exploit","T1105"],"_patchfirst":{"reason":"kev","priority":72.6,"kev":{"dateAdded":"2022-03-03","ransomware":true},"epss":{"score":0.94271,"percentile":0.9985},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1105"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2012-1535#kev","url":"https://patchfirst.co/cve/CVE-2012-1535/","title":"[KEV] CVE-2012-1535: Adobe Flash Player Arbitrary Code Execution Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 70.4% (higher than 99.39% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1105 Ingress Tool Transfer. Priority 53.3 of 100.","summary":"Adobe Flash Player Arbitrary Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T23:39:42.000Z","tags":["kev","public-exploit","T1204.002","T1105"],"_patchfirst":{"reason":"kev","priority":53.3,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.70384,"percentile":0.99385},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.002","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2013-0641#kev","url":"https://patchfirst.co/cve/CVE-2013-0641/","title":"[KEV] CVE-2013-0641: Adobe Reader Buffer Overflow Vulnerability","content_text":"Adobe · Reader. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 32.3% (higher than 98.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1105 Ingress Tool Transfer; T1048 Exfiltration Over Alternative Protocol. Named in 1 threat report. Priority 52.0 of 100.","summary":"Adobe Reader Buffer Overflow Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T23:49:49.000Z","tags":["kev","T1204.002","T1105","T1048"],"_patchfirst":{"reason":"kev","priority":52,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.32346,"percentile":0.98324},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Reader","techniqueIds":["T1204.002","T1105","T1048"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-11292#kev","url":"https://patchfirst.co/cve/CVE-2017-11292/","title":"[KEV] CVE-2017-11292: Adobe Flash Player Type Confusion Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 11.9% (higher than 96.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566.001 Spearphishing Attachment; T1105 Ingress Tool Transfer; T1005 Data from Local System. Priority 48.4 of 100.","summary":"Adobe Flash Player Type Confusion Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:01:33.000Z","tags":["kev","T1204.002","T1566.001","T1105","T1005"],"_patchfirst":{"reason":"kev","priority":48.4,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.11885,"percentile":0.96096},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.002","T1566.001","T1105","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2018-15982#kev","url":"https://patchfirst.co/cve/CVE-2018-15982/","title":"[KEV] CVE-2018-15982: Adobe Flash Player Use-After-Free Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-02-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 89.6% (higher than 99.79% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1105 Ingress Tool Transfer. Priority 63.4 of 100.","summary":"Adobe Flash Player Use-After-Free Vulnerability","date_published":"2022-02-15T00:00:00.000Z","date_modified":"2026-10-01T20:17:16.000Z","tags":["kev","ransomware","public-exploit","T1204.002","T1105"],"_patchfirst":{"reason":"kev","priority":63.4,"kev":{"dateAdded":"2022-02-15","ransomware":true},"epss":{"score":0.89581,"percentile":0.99786},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.002","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44515","url":"https://patchfirst.co/cve/CVE-2021-44515/","title":"CVE-2021-44515: Zoho Desktop Central Authentication Bypass Vulnerability","content_text":"Zoho · Desktop Central. In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer; T1003 OS Credential Dumping; T1069 Permission Groups Discovery; T1087 Account Discovery. Priority 69.9 of 100.","summary":"Zoho Desktop Central Authentication Bypass Vulnerability","date_published":"2021-12-12T00:00:00.000Z","date_modified":"2026-06-17T04:12:29.000Z","tags":["kev","public-exploit","T1190","T1105","T1003","T1069","T1087"],"_patchfirst":{"reason":"published","priority":69.9,"kev":{"dateAdded":"2021-12-10","ransomware":false},"epss":{"score":0.99871,"percentile":0.99963},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"Desktop Central","techniqueIds":["T1190","T1105","T1003","T1069","T1087"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-35394#kev","url":"https://patchfirst.co/cve/CVE-2021-35394/","title":"[KEV] CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability","content_text":"Realtek · Jungle Software Development Kit (SDK). In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1496 Resource Hijacking; T1499 Endpoint Denial of Service; +1 more. Priority 69.9 of 100.","summary":"Realtek Jungle SDK Remote Code Execution Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-06-17T03:57:29.000Z","tags":["kev","public-exploit","T1190","T1059","T1071.001","T1105","T1496","T1499","T1569.002"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-12-10","ransomware":false},"epss":{"score":0.99877,"percentile":0.99964},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Realtek","product":"Jungle Software Development Kit (SDK)","techniqueIds":["T1190","T1059","T1071.001","T1105","T1496","T1499","T1569.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-20022#kev","url":"https://patchfirst.co/cve/CVE-2021-20022/","title":"[KEV] CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability","content_text":"SonicWall · SonicWall Email Security. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 16.6% (higher than 97% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1078 Valid Accounts; T1105 Ingress Tool Transfer. Priority 72.4 of 100.","summary":"SonicWall Email Security Unrestricted Upload of File Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-10-01T21:17:15.000Z","tags":["kev","ransomware","T1078","T1105"],"_patchfirst":{"reason":"kev","priority":72.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.16639,"percentile":0.97017},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SonicWall Email Security","techniqueIds":["T1078","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-1620","url":"https://patchfirst.co/cve/CVE-2019-1620/","title":"CVE-2019-1620: Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability","content_text":"Cisco · Cisco Data Center Network Manager. Not in CISA KEV. EPSS 83.8% (higher than 99.69% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1059 Command and Scripting Interpreter. Priority 32.5 of 100.","summary":"Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability","date_published":"2019-06-27T00:00:00.000Z","date_modified":"2024-11-19T19:03:59.000Z","tags":["public-exploit","T1105","T1059"],"_patchfirst":{"reason":"published","priority":32.5,"kev":null,"epss":{"score":0.8378,"percentile":0.99688},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"Cisco","product":"Cisco Data Center Network Manager","techniqueIds":["T1105","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1689","url":"https://patchfirst.co/cve/CVE-2019-1689/","title":"CVE-2019-1689: Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability","content_text":"Cisco · Cisco Webex Teams. Not in CISA KEV. EPSS 1.6% (higher than 75.4% of CVEs). CVSS 7.3 HIGH. ATT&CK: T1105 Ingress Tool Transfer; T1531 Account Access Removal; T1565.001 Stored Data Manipulation. Priority 20.2 of 100.","summary":"Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability","date_published":"2019-02-25T00:00:00.000Z","date_modified":"2024-11-21T19:44:24.000Z","tags":["T1105","T1531","T1565.001"],"_patchfirst":{"reason":"published","priority":20.2,"kev":null,"epss":{"score":0.01574,"percentile":0.75413},"cvss":{"score":7.3,"severity":"HIGH","version":"3.0"},"vendor":"Cisco","product":"Cisco Webex Teams","techniqueIds":["T1105","T1531","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}