{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1136 Create Account","home_page_url":"https://patchfirst.co/technique/T1136/","feed_url":"https://patchfirst.co/feed/technique/T1136.json","description":"New and newly exploited CVEs that lead to ATT&CK T1136 Create Account, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-31161#kev","url":"https://patchfirst.co/cve/CVE-2025-31161/","title":"[KEV] CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability","content_text":"CrushFTP · CrushFTP. In CISA KEV since 2025-04-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1136 Create Account. Priority 79.9 of 100.","summary":"CrushFTP Authentication Bypass Vulnerability","date_published":"2025-04-07T00:00:00.000Z","date_modified":"2026-06-17T09:09:56.000Z","tags":["kev","ransomware","public-exploit","T1078","T1059","T1136"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2025-04-07","ransomware":true},"epss":{"score":0.99969,"percentile":0.99977},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"CrushFTP","product":"CrushFTP","techniqueIds":["T1078","T1059","T1136"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-19410#kev","url":"https://patchfirst.co/cve/CVE-2018-19410/","title":"[KEV] CVE-2018-19410: Paessler PRTG Network Monitor Local File Inclusion Vulnerability","content_text":"Paessler · PRTG Network Monitor. In CISA KEV since 2025-02-04. ENISA EUVD lists it as exploited. EPSS 97.9% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 69.8 of 100.","summary":"Paessler PRTG Network Monitor Local File Inclusion Vulnerability","date_published":"2025-02-04T00:00:00.000Z","date_modified":"2026-06-17T01:49:15.000Z","tags":["kev","public-exploit","T1190","T1136"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-02-04","ransomware":false},"epss":{"score":0.97939,"percentile":0.99909},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Paessler","product":"PRTG Network Monitor","techniqueIds":["T1190","T1136"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-20198#kev","url":"https://patchfirst.co/cve/CVE-2023-20198/","title":"[KEV] CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation Vulnerability","content_text":"Cisco · IOS XE Web UI. In CISA KEV since 2023-10-16. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Named in 2 threat reports. Priority 86.1 of 100.","summary":"Cisco IOS XE Web UI Privilege Escalation Vulnerability","date_published":"2023-10-16T00:00:00.000Z","date_modified":"2026-06-17T05:29:47.000Z","tags":["kev","public-exploit","T1190","T1136"],"_patchfirst":{"reason":"kev","priority":86.1,"kev":{"dateAdded":"2023-10-16","ransomware":false},"epss":{"score":0.99613,"percentile":0.99948},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"IOS XE Web UI","techniqueIds":["T1190","T1136"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22515#kev","url":"https://patchfirst.co/cve/CVE-2023-22515/","title":"[KEV] CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","content_text":"Atlassian · Confluence Data Center and Server. In CISA KEV since 2023-10-05, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1136 Create Account; T1059 Command and Scripting Interpreter; T1078 Valid Accounts. Priority 79.8 of 100.","summary":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","date_published":"2023-10-05T00:00:00.000Z","date_modified":"2026-06-17T05:35:37.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059.007","T1136","T1059","T1078"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2023-10-05","ransomware":true},"epss":{"score":0.99223,"percentile":0.99935},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence Data Center and Server","techniqueIds":["T1190","T1059.007","T1136","T1059","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-35078#kev","url":"https://patchfirst.co/cve/CVE-2023-35078/","title":"[KEV] CVE-2023-35078: Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2023-07-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account; T1213 Data from Information Repositories. Priority 79.9 of 100.","summary":"Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability","date_published":"2023-07-25T00:00:00.000Z","date_modified":"2026-08-05T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1190","T1136","T1213"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-07-25","ransomware":true},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1136","T1213"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27997#kev","url":"https://patchfirst.co/cve/CVE-2023-27997/","title":"[KEV] CVE-2023-27997: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","content_text":"Fortinet · FortiOS and FortiProxy SSL-VPN. In CISA KEV since 2023-06-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.7% (higher than 99.72% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1136 Create Account. Named in 1 threat report. Priority 83.7 of 100.","summary":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","date_published":"2023-06-13T00:00:00.000Z","date_modified":"2026-07-31T04:16:43.000Z","tags":["kev","ransomware","public-exploit","T1190","T1574","T1136"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2023-06-13","ransomware":true},"epss":{"score":0.85689,"percentile":0.99725},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiOS and FortiProxy SSL-VPN","techniqueIds":["T1190","T1574","T1136"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-34362#kev","url":"https://patchfirst.co/cve/CVE-2023-34362/","title":"[KEV] CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability","content_text":"Progress · MOVEit Transfer. In CISA KEV since 2023-06-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1082 System Information Discovery; T1105 Ingress Tool Transfer; T1136 Create Account; +1 more. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Progress MOVEit Transfer SQL Injection Vulnerability","date_published":"2023-06-02T00:00:00.000Z","date_modified":"2026-06-17T06:03:28.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1005","T1082","T1105","T1136","T1531"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2023-06-02","ransomware":true},"epss":{"score":0.99934,"percentile":0.9997},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"MOVEit Transfer","techniqueIds":["T1190","T1059","T1005","T1082","T1105","T1136","T1531"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28252#kev","url":"https://patchfirst.co/cve/CVE-2023-28252/","title":"[KEV] CVE-2023-28252: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-04-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1021 Remote Services; T1059 Command and Scripting Interpreter; T1136 Create Account; +1 more. Priority 78.2 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","date_published":"2023-04-11T00:00:00.000Z","date_modified":"2026-06-17T05:47:14.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068","T1003","T1021","T1059","T1136","T1486"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-04-11","ransomware":true},"epss":{"score":0.48892,"percentile":0.98877},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1068","T1003","T1021","T1059","T1136","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-45467","url":"https://patchfirst.co/cve/CVE-2021-45467/","title":"CVE-2021-45467: In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to…","content_text":"Not in CISA KEV. EPSS 70.7% (higher than 99.4% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Named in 1 threat report. Priority 70.6 of 100.","summary":"In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to…","date_published":"2022-12-26T00:00:00.000Z","date_modified":"2025-04-12T00:06:13.000Z","tags":["public-exploit","T1190","T1136"],"_patchfirst":{"reason":"published","priority":70.6,"kev":null,"epss":{"score":0.70745,"percentile":0.99396},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":null,"product":null,"techniqueIds":["T1190","T1136"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-44077#kev","url":"https://patchfirst.co/cve/CVE-2021-44077/","title":"[KEV] CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Priority 69.8 of 100.","summary":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T04:11:52.000Z","tags":["kev","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.93298,"percentile":0.99836},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-34473#kev","url":"https://patchfirst.co/cve/CVE-2021-34473/","title":"[KEV] CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1053.005 Scheduled Task; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1136 Create Account; T1486 Data Encrypted for Impact. Named in 9 threat reports. Priority 89.4 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-10T19:58:52.000Z","tags":["kev","ransomware","public-exploit","T1190","T1053.005","T1048.003","T1136","T1486"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99996},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1190","T1053.005","T1048.003","T1136","T1486"],"reportCount":9,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40539#kev","url":"https://patchfirst.co/cve/CVE-2021-40539/","title":"[KEV] CVE-2021-40539: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Named in 1 threat report. Priority 83.7 of 100.","summary":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:07:06.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.9896,"percentile":0.99929},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-20021#kev","url":"https://patchfirst.co/cve/CVE-2021-20021/","title":"[KEV] CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability","content_text":"SonicWall · SonicWall Email Security. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 88.8% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 79.8 of 100.","summary":"SonicWall Email Security Improper Privilege Management Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:33.000Z","tags":["kev","ransomware","public-exploit","T1190","T1136"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.8878,"percentile":0.99775},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SonicWall Email Security","techniqueIds":["T1190","T1136"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-10181#kev","url":"https://patchfirst.co/cve/CVE-2020-10181/","title":"[KEV] CVE-2020-10181: Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability","content_text":"Sumavision · Enhanced Multimedia Router (EMR). In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 14.9% (higher than 96.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 69.2 of 100.","summary":"Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:47:27.000Z","tags":["kev","public-exploit","T1190","T1136"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.14938,"percentile":0.96702},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sumavision","product":"Enhanced Multimedia Router (EMR)","techniqueIds":["T1190","T1136"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-16874","url":"https://patchfirst.co/cve/CVE-2020-16874/","title":"CVE-2020-16874: Visual Studio Remote Code Execution Vulnerability","content_text":"Microsoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6). Not in CISA KEV. EPSS 4.3% (higher than 91.1% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 24.4 of 100.","summary":"Visual Studio Remote Code Execution Vulnerability","date_published":"2020-09-11T00:00:00.000Z","date_modified":"2024-08-04T13:45:34.000Z","tags":["T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.4,"kev":null,"epss":{"score":0.04285,"percentile":0.91102},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)","techniqueIds":["T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1569","url":"https://patchfirst.co/cve/CVE-2020-1569/","title":"CVE-2020-1569: Microsoft Edge Memory Corruption Vulnerability","content_text":"Microsoft · Microsoft Edge (EdgeHTML-based). Not in CISA KEV. EPSS 3.0% (higher than 87.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 23.6 of 100.","summary":"Microsoft Edge Memory Corruption Vulnerability","date_published":"2020-08-17T00:00:00.000Z","date_modified":"2024-08-04T06:39:10.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":23.6,"kev":null,"epss":{"score":0.02984,"percentile":0.87281},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Microsoft Edge (EdgeHTML-based)","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1495","url":"https://patchfirst.co/cve/CVE-2020-1495/","title":"CVE-2020-1495: Microsoft Excel Remote Code Execution Vulnerability","content_text":"Microsoft · Microsoft SharePoint Server 2010 Service Pack 2. Not in CISA KEV. EPSS 4.2% (higher than 91% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 18.9 of 100.","summary":"Microsoft Excel Remote Code Execution Vulnerability","date_published":"2020-08-17T00:00:00.000Z","date_modified":"2024-08-04T06:39:10.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.04212,"percentile":0.90969},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Server 2010 Service Pack 2","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1109","url":"https://patchfirst.co/cve/CVE-2020-1109/","title":"CVE-2020-1109: Windows Update Stack Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1709. Not in CISA KEV. EPSS 1.0% (higher than 62.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 18.0 of 100.","summary":"Windows Update Stack Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:34:05.000Z","tags":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":18,"kev":null,"epss":{"score":0.00994,"percentile":0.6259},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1709","techniqueIds":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1111","url":"https://patchfirst.co/cve/CVE-2020-1111/","title":"CVE-2020-1111: Windows Clipboard Service Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1809. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 17.7 of 100.","summary":"Windows Clipboard Service Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:34:05.000Z","tags":["T1068","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":17.7,"kev":null,"epss":{"score":0.00952,"percentile":0.61289},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1809","techniqueIds":["T1068","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-11010","url":"https://patchfirst.co/cve/CVE-2020-11010/","title":"CVE-2020-11010: SQL injection in Tortoise ORM","content_text":"tortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.","summary":"SQL injection in Tortoise ORM","date_published":"2020-04-20T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.01047,"percentile":0.64169},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"tortoise","product":"tortoise-orm","techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-0671","url":"https://patchfirst.co/cve/CVE-2020-0671/","title":"CVE-2020-0671: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 1.4% (higher than 71.8% of CVEs). ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.0 of 100.","summary":"An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…","date_published":"2020-02-11T00:00:00.000Z","date_modified":"2024-08-04T06:11:04.000Z","tags":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15,"kev":null,"epss":{"score":0.01367,"percentile":0.7182},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5231","url":"https://patchfirst.co/cve/CVE-2020-5231/","title":"CVE-2020-5231: Opencast users with ROLE_COURSE_ADMIN can create new users","content_text":"opencast · opencast. Not in CISA KEV. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 4.8 MEDIUM. ATT&CK: T1078.001 Default Accounts; T1136 Create Account. Priority 13.3 of 100.","summary":"Opencast users with ROLE_COURSE_ADMIN can create new users","date_published":"2020-01-30T00:00:00.000Z","date_modified":"2024-08-04T08:22:08.000Z","tags":["T1078.001","T1136"],"_patchfirst":{"reason":"published","priority":13.3,"kev":null,"epss":{"score":0.00625,"percentile":0.49945},"cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1"},"vendor":"opencast","product":"opencast","techniqueIds":["T1078.001","T1136"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-18234","url":"https://patchfirst.co/cve/CVE-2019-18234/","title":"CVE-2019-18234: Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","content_text":"Not in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.","summary":"Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","date_published":"2019-12-23T00:00:00.000Z","date_modified":"2024-08-05T01:47:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":15.9,"kev":null,"epss":{"score":0.01889,"percentile":0.79525},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3758","url":"https://patchfirst.co/cve/CVE-2019-3758/","title":"CVE-2019-3758: RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability","content_text":"Dell · RSA Archer. Not in CISA KEV. EPSS 1.5% (higher than 73.6% of CVEs). CVSS 8.1 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 20.4 of 100.","summary":"RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability","date_published":"2019-09-18T00:00:00.000Z","date_modified":"2024-09-16T17:08:48.000Z","tags":["T1190","T1136"],"_patchfirst":{"reason":"published","priority":20.4,"kev":null,"epss":{"score":0.01462,"percentile":0.73575},"cvss":{"score":8.1,"severity":"HIGH","version":"3.0"},"vendor":"Dell","product":"RSA Archer","techniqueIds":["T1190","T1136"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1118","url":"https://patchfirst.co/cve/CVE-2019-1118/","title":"CVE-2019-1118: A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 23.6% (higher than 97.8% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.6 of 100.","summary":"A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…","date_published":"2019-07-29T00:00:00.000Z","date_modified":"2024-08-04T18:06:31.000Z","tags":["public-exploit","T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.6,"kev":null,"epss":{"score":0.2357,"percentile":0.97801},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-3798","url":"https://patchfirst.co/cve/CVE-2019-3798/","title":"CVE-2019-3798: Escalation of Privileges in Cloud Controller","content_text":"Cloud Foundry · CAPI-release. Not in CISA KEV. EPSS 1.3% (higher than 71.3% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1136 Create Account; T1068 Exploitation for Privilege Escalation. Priority 18.5 of 100.","summary":"Escalation of Privileges in Cloud Controller","date_published":"2019-04-17T00:00:00.000Z","date_modified":"2024-09-17T04:09:11.000Z","tags":["T1136","T1068"],"_patchfirst":{"reason":"published","priority":18.5,"kev":null,"epss":{"score":0.01339,"percentile":0.71266},"cvss":{"score":6,"severity":"MEDIUM","version":"3.0"},"vendor":"Cloud Foundry","product":"CAPI-release","techniqueIds":["T1136","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-0609","url":"https://patchfirst.co/cve/CVE-2019-0609/","title":"CVE-2019-0609: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","content_text":"Microsoft · Internet Explorer 11. Not in CISA KEV. EPSS 9.8% (higher than 95.6% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.8 of 100.","summary":"A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","date_published":"2019-04-08T00:00:00.000Z","date_modified":"2024-08-04T17:51:26.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.8,"kev":null,"epss":{"score":0.09846,"percentile":0.95554},"cvss":null,"vendor":"Microsoft","product":"Internet Explorer 11","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8575","url":"https://patchfirst.co/cve/CVE-2018-8575/","title":"CVE-2018-8575: A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…","content_text":"Microsoft · Microsoft Project. Not in CISA KEV. EPSS 19.5% (higher than 97.4% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 19.5 of 100.","summary":"A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…","date_published":"2018-11-14T00:00:00.000Z","date_modified":"2024-08-05T07:02:25.000Z","tags":["T1204.002","T1566","T1068","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.5,"kev":null,"epss":{"score":0.19546,"percentile":0.97377},"cvss":null,"vendor":"Microsoft","product":"Microsoft Project","techniqueIds":["T1204.002","T1566","T1068","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8353","url":"https://patchfirst.co/cve/CVE-2018-8353/","title":"CVE-2018-8353: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…","content_text":"Not in CISA KEV. EPSS 67.3% (higher than 99.3% of CVEs). Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…","date_published":"2018-08-15T00:00:00.000Z","date_modified":"2024-08-05T06:54:35.000Z","tags":["public-exploit","T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.67339,"percentile":0.99304},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8355","url":"https://patchfirst.co/cve/CVE-2018-8355/","title":"CVE-2018-8355: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","content_text":"Microsoft · ChakraCore. Not in CISA KEV. EPSS 67.9% (higher than 99.32% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.","summary":"A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","date_published":"2018-08-15T00:00:00.000Z","date_modified":"2024-08-05T06:54:35.000Z","tags":["public-exploit","T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.67896,"percentile":0.9932},"cvss":null,"vendor":"Microsoft","product":"ChakraCore","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8248","url":"https://patchfirst.co/cve/CVE-2018-8248/","title":"CVE-2018-8248: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…","content_text":"Microsoft · Microsoft Office. Not in CISA KEV. EPSS 21.4% (higher than 97.6% of CVEs). ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.5 of 100.","summary":"A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.5,"kev":null,"epss":{"score":0.21421,"percentile":0.97607},"cvss":null,"vendor":"Microsoft","product":"Microsoft Office","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8110","url":"https://patchfirst.co/cve/CVE-2018-8110/","title":"CVE-2018-8110: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","content_text":"Microsoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97.1% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.","summary":"A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.16906,"percentile":0.97051},"cvss":null,"vendor":"Microsoft","product":"Microsoft Edge","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8111","url":"https://patchfirst.co/cve/CVE-2018-8111/","title":"CVE-2018-8111: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","content_text":"Microsoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.","summary":"A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.16906,"percentile":0.9705},"cvss":null,"vendor":"Microsoft","product":"Microsoft Edge","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}