{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1499.004 Application or System Exploitation","home_page_url":"https://patchfirst.co/technique/T1499.004/","feed_url":"https://patchfirst.co/feed/technique/T1499.004.json","description":"New and newly exploited CVEs that lead to ATT&CK T1499.004 Application or System Exploitation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-76418#kev","url":"https://patchfirst.co/cve/CVE-2026-76418/","title":"[KEV] CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","content_text":"Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 59.9% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 64.4 of 100.","summary":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T10:36:01.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.4,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.0091,"percentile":0.59949},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall ASA Software and Cisco Secure FTD Software","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-111497#kev","url":"https://patchfirst.co/cve/CVE-2026-111497/","title":"[KEV] CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability","content_text":"Google · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.","summary":"Google Brotli Unchecked Return Value Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-30T20:30:11.000Z","tags":["kev","public-exploit","T1190","T1005","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.82641,"percentile":0.99666},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Google","product":"Brotli","techniqueIds":["T1190","T1005","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5477#kev","url":"https://patchfirst.co/cve/CVE-2015-5477/","title":"[KEV] CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability","content_text":"ISC · BIND. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 68.2 of 100.","summary":"ISC BIND Data Processing Errors Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T19:12:37.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.99584,"percentile":0.99947},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"ISC","product":"BIND","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-39964#kev","url":"https://patchfirst.co/cve/CVE-2025-39964/","title":"[KEV] CVE-2025-39964: Linux Kernel Race Condition Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-09-18. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.3% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 71.9 of 100.","summary":"Linux Kernel Race Condition Vulnerability","date_published":"2026-09-18T00:00:00.000Z","date_modified":"2026-10-19T21:10:00.000Z","tags":["kev","public-exploit","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":71.9,"kev":{"dateAdded":"2026-09-18","ransomware":false},"epss":{"score":0.0157,"percentile":0.75345},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67277#kev","url":"https://patchfirst.co/cve/CVE-2026-67277/","title":"[KEV] CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 73.8 of 100.","summary":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:29.000Z","tags":["kev","public-exploit","T1190","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":73.8,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.0156,"percentile":0.75209},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-8452#kev","url":"https://patchfirst.co/cve/CVE-2026-8452/","title":"[KEV] CVE-2026-8452: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer…","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 72.5 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer…","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:18:00.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.01011,"percentile":0.63147},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20349#kev","url":"https://patchfirst.co/cve/CVE-2026-20349/","title":"[KEV] CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection…","content_text":"Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) . In CISA KEV since 2026-08-11. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.1% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 71.6 of 100.","summary":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection…","date_published":"2026-08-11T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":71.6,"kev":{"dateAdded":"2026-08-11","ransomware":false},"epss":{"score":0.0101,"percentile":0.63113},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-4346#kev","url":"https://patchfirst.co/cve/CVE-2023-4346/","title":"[KEV] CVE-2023-4346: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism…","content_text":"KNX Association · KNX Protocol Connection Authorization Option 1. In CISA KEV since 2026-07-15. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 71.8% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 62.6 of 100.","summary":"KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism…","date_published":"2026-07-15T00:00:00.000Z","date_modified":"2026-07-16T05:16:16.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":62.6,"kev":{"dateAdded":"2026-07-15","ransomware":false},"epss":{"score":0.01363,"percentile":0.71755},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"KNX Association","product":"KNX Protocol Connection Authorization Option 1","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-43520#kev","url":"https://patchfirst.co/cve/CVE-2025-43520/","title":"[KEV] CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-03-20. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 59.2 of 100.","summary":"Apple Multiple Products Classic Buffer Overflow Vulnerability","date_published":"2026-03-20T00:00:00.000Z","date_modified":"2026-10-07T11:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":59.2,"kev":{"dateAdded":"2026-03-20","ransomware":false},"epss":{"score":0.00425,"percentile":0.36797},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1068","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21525#kev","url":"https://patchfirst.co/cve/CVE-2026-21525/","title":"[KEV] CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 4.9% (higher than 92% of CVEs). CVSS 6.2 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 65.7 of 100.","summary":"Microsoft Windows NULL Pointer Dereference Vulnerability","date_published":"2026-02-10T00:00:00.000Z","date_modified":"2026-06-17T10:18:46.000Z","tags":["kev","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":65.7,"kev":{"dateAdded":"2026-02-10","ransomware":false},"epss":{"score":0.04865,"percentile":0.92031},"cvss":{"score":6.2,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-22555#kev","url":"https://patchfirst.co/cve/CVE-2021-22555/","title":"[KEV] CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2025-10-06. ENISA EUVD lists it as exploited. EPSS 78.7% (higher than 99.59% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 68.4 of 100.","summary":"Linux Kernel Heap Out-of-Bounds Write Vulnerability","date_published":"2025-10-06T00:00:00.000Z","date_modified":"2026-10-13T18:25:34.000Z","tags":["kev","public-exploit","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.4,"kev":{"dateAdded":"2025-10-06","ransomware":false},"epss":{"score":0.78684,"percentile":0.99588},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-20362#kev","url":"https://patchfirst.co/cve/CVE-2025-20362/","title":"[KEV] CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…","content_text":"Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. In CISA KEV since 2025-09-25. ENISA EUVD lists it as exploited. EPSS 87.1% (higher than 99.75% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Named in 5 threat reports. Priority 79.0 of 100.","summary":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…","date_published":"2025-09-25T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2025-09-25","ransomware":false},"epss":{"score":0.87085,"percentile":0.99749},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","techniqueIds":["T1190","T1499.004"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-3931#kev","url":"https://patchfirst.co/cve/CVE-2014-3931/","title":"[KEV] CVE-2014-3931: Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability","content_text":"Looking Glass · Multi-Router Looking Glass (MRLG). In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 29.0% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 69.5 of 100.","summary":"Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability","date_published":"2025-07-07T00:00:00.000Z","date_modified":"2026-06-17T00:09:09.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":69.5,"kev":{"dateAdded":"2025-07-07","ransomware":false},"epss":{"score":0.28978,"percentile":0.98154},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Looking Glass","product":"Multi-Router Looking Glass (MRLG)","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-27363#kev","url":"https://patchfirst.co/cve/CVE-2025-27363/","title":"[KEV] CVE-2025-27363: FreeType Out-of-Bounds Write Vulnerability","content_text":"FreeType · FreeType. In CISA KEV since 2025-05-06. ENISA EUVD lists it as exploited. EPSS 27.8% (higher than 98.1% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1574 Hijack Execution Flow; T1499.004 Application or System Exploitation. Priority 68.3 of 100.","summary":"FreeType Out-of-Bounds Write Vulnerability","date_published":"2025-05-06T00:00:00.000Z","date_modified":"2026-06-17T09:03:27.000Z","tags":["kev","public-exploit","T1574","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2025-05-06","ransomware":false},"epss":{"score":0.27775,"percentile":0.98089},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"FreeType","product":"FreeType","techniqueIds":["T1574","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-3393#kev","url":"https://patchfirst.co/cve/CVE-2024-3393/","title":"[KEV] CVE-2024-3393: Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2024-12-30. ENISA EUVD lists it as exploited. EPSS 29.1% (higher than 98.2% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 62.9 of 100.","summary":"Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability","date_published":"2024-12-30T00:00:00.000Z","date_modified":"2026-06-17T07:44:11.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2024-12-30","ransomware":false},"epss":{"score":0.2912,"percentile":0.98164},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-20481#kev","url":"https://patchfirst.co/cve/CVE-2024-20481/","title":"[KEV] CVE-2024-20481: Cisco ASA and FTD Denial-of-Service Vulnerability","content_text":"Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). In CISA KEV since 2024-10-24. ENISA EUVD lists it as exploited. EPSS 15.9% (higher than 96.9% of CVEs). CVSS 5.8 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 61.4 of 100.","summary":"Cisco ASA and FTD Denial-of-Service Vulnerability","date_published":"2024-10-24T00:00:00.000Z","date_modified":"2026-08-11T19:40:47.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":61.4,"kev":{"dateAdded":"2024-10-24","ransomware":false},"epss":{"score":0.15874,"percentile":0.96883},"cvss":{"score":5.8,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-40766#kev","url":"https://patchfirst.co/cve/CVE-2024-40766/","title":"[KEV] CVE-2024-40766: SonicWall SonicOS Improper Access Control Vulnerability","content_text":"SonicWall · SonicOS. In CISA KEV since 2024-09-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 18.4% (higher than 97.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 74.3 of 100.","summary":"SonicWall SonicOS Improper Access Control Vulnerability","date_published":"2024-09-09T00:00:00.000Z","date_modified":"2026-09-21T21:17:02.000Z","tags":["kev","ransomware","T1190","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":74.3,"kev":{"dateAdded":"2024-09-09","ransomware":true},"epss":{"score":0.18379,"percentile":0.97226},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SonicOS","techniqueIds":["T1190","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-29552#kev","url":"https://patchfirst.co/cve/CVE-2023-29552/","title":"[KEV] CVE-2023-29552: Service Location Protocol (SLP) Denial-of-Service Vulnerability","content_text":"IETF · Service Location Protocol (SLP). In CISA KEV since 2023-11-08. ENISA EUVD lists it as exploited. EPSS 64.0% (higher than 99.22% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 78.1 of 100.","summary":"Service Location Protocol (SLP) Denial-of-Service Vulnerability","date_published":"2023-11-08T00:00:00.000Z","date_modified":"2026-06-17T05:50:32.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2023-11-08","ransomware":false},"epss":{"score":0.63975,"percentile":0.99223},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"IETF","product":"Service Location Protocol (SLP)","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-25489#kev","url":"https://patchfirst.co/cve/CVE-2021-25489/","title":"[KEV] CVE-2021-25489: Samsung Mobile Devices Improper Input Validation Vulnerability","content_text":"Samsung · Mobile Devices. In CISA KEV since 2023-06-29. ENISA EUVD lists it as exploited. EPSS 0.5% (higher than 44.8% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 50.8 of 100.","summary":"Samsung Mobile Devices Improper Input Validation Vulnerability","date_published":"2023-06-29T00:00:00.000Z","date_modified":"2026-06-17T03:42:10.000Z","tags":["kev","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":50.8,"kev":{"dateAdded":"2023-06-29","ransomware":false},"epss":{"score":0.00531,"percentile":0.44843},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Samsung","product":"Mobile Devices","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-33009#kev","url":"https://patchfirst.co/cve/CVE-2023-33009/","title":"[KEV] CVE-2023-33009: Zyxel Multiple Firewalls Buffer Overflow Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2023-06-05. ENISA EUVD lists it as exploited. EPSS 28.1% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.5 of 100.","summary":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","date_published":"2023-06-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:16.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.5,"kev":{"dateAdded":"2023-06-05","ransomware":false},"epss":{"score":0.28144,"percentile":0.98108},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-33010#kev","url":"https://patchfirst.co/cve/CVE-2023-33010/","title":"[KEV] CVE-2023-33010: Zyxel Multiple Firewalls Buffer Overflow Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2023-06-05. ENISA EUVD lists it as exploited. EPSS 29.0% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.5 of 100.","summary":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","date_published":"2023-06-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:17.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.5,"kev":{"dateAdded":"2023-06-05","ransomware":false},"epss":{"score":0.29024,"percentile":0.98157},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2015-2291#kev","url":"https://patchfirst.co/cve/CVE-2015-2291/","title":"[KEV] CVE-2015-2291: Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability","content_text":"Intel · Ethernet Diagnostics Driver for Windows. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 15.7% (higher than 96.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Named in 1 threat report. Priority 81.7 of 100.","summary":"Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability","date_published":"2023-02-10T00:00:00.000Z","date_modified":"2026-10-01T19:17:11.000Z","tags":["kev","ransomware","public-exploit","T1068","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":81.7,"kev":{"dateAdded":"2023-02-10","ransomware":true},"epss":{"score":0.15685,"percentile":0.96854},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Intel","product":"Ethernet Diagnostics Driver for Windows","techniqueIds":["T1068","T1059","T1499.004"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-25370#kev","url":"https://patchfirst.co/cve/CVE-2021-25370/","title":"[KEV] CVE-2021-25370: Samsung Mobile Devices Memory Corruption Vulnerability","content_text":"Samsung · Mobile Devices. In CISA KEV since 2022-11-08. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 52.9 of 100.","summary":"Samsung Mobile Devices Memory Corruption Vulnerability","date_published":"2022-11-08T00:00:00.000Z","date_modified":"2026-06-17T03:41:57.000Z","tags":["kev","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":52.9,"kev":{"dateAdded":"2022-11-08","ransomware":false},"epss":{"score":0.0089,"percentile":0.59326},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Samsung","product":"Mobile Devices","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2012-1889#kev","url":"https://patchfirst.co/cve/CVE-2012-1889/","title":"[KEV] CVE-2012-1889: Microsoft XML Core Services Memory Corruption Vulnerability","content_text":"Microsoft · XML Core Services. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 83.5% (higher than 99.68% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Named in 3 threat reports. Priority 76.8 of 100.","summary":"Microsoft XML Core Services Memory Corruption Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-16T23:40:29.000Z","tags":["kev","public-exploit","T1189","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":76.8,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.83516,"percentile":0.99684},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"XML Core Services","techniqueIds":["T1189","T1059","T1499.004"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-1646#kev","url":"https://patchfirst.co/cve/CVE-2016-1646/","title":"[KEV] CVE-2016-1646: Google Chromium V8 Out-of-Bounds Read Vulnerability","content_text":"Google · Chromium V8. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 48.1% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1499.004 Application or System Exploitation. Priority 68.9 of 100.","summary":"Google Chromium V8 Out-of-Bounds Read Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-17T00:42:19.000Z","tags":["kev","public-exploit","T1189","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.4811,"percentile":0.98857},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Google","product":"Chromium V8","techniqueIds":["T1189","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2011-0609#kev","url":"https://patchfirst.co/cve/CVE-2011-0609/","title":"[KEV] CVE-2011-0609: Adobe Flash Player Unspecified Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 63.5% (higher than 99.21% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution; T1499.004 Application or System Exploitation. Priority 68.3 of 100.","summary":"Adobe Flash Player Unspecified Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-16T23:27:44.000Z","tags":["kev","public-exploit","T1189","T1203","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.63507,"percentile":0.9921},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1189","T1203","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-5825#kev","url":"https://patchfirst.co/cve/CVE-2019-5825/","title":"[KEV] CVE-2019-5825: Google Chromium V8 Out-of-Bounds Write Vulnerability","content_text":"Google · Chromium V8. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 55.9% (higher than 99.05% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1499.004 Application or System Exploitation. Priority 67.4 of 100.","summary":"Google Chromium V8 Out-of-Bounds Write Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-17T02:38:16.000Z","tags":["kev","public-exploit","T1189","T1499.004"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.55925,"percentile":0.99045},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Google","product":"Chromium V8","techniqueIds":["T1189","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-0034#kev","url":"https://patchfirst.co/cve/CVE-2016-0034/","title":"[KEV] CVE-2016-0034: Microsoft Silverlight Runtime Remote Code Execution Vulnerability","content_text":"Microsoft · Silverlight. In CISA KEV since 2022-05-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 69.4% (higher than 99.36% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1189 Drive-by Compromise; T1499.004 Application or System Exploitation. Named in 3 threat reports. Priority 66.8 of 100.","summary":"Microsoft Silverlight Runtime Remote Code Execution Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-08-14T05:16:53.000Z","tags":["kev","ransomware","T1059","T1189","T1499.004"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2022-05-25","ransomware":true},"epss":{"score":0.69397,"percentile":0.99358},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Silverlight","techniqueIds":["T1059","T1189","T1499.004"],"reportCount":3,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-0149#kev","url":"https://patchfirst.co/cve/CVE-2017-0149/","title":"[KEV] CVE-2017-0149: Microsoft Internet Explorer Memory Corruption Vulnerability","content_text":"Microsoft · Internet Explorer. In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 29.2% (higher than 98.2% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1499.004 Application or System Exploitation; T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 48.8 of 100.","summary":"Microsoft Internet Explorer Memory Corruption Vulnerability","date_published":"2022-05-24T00:00:00.000Z","date_modified":"2026-06-17T00:57:10.000Z","tags":["kev","T1499.004","T1189","T1203"],"_patchfirst":{"reason":"kev","priority":48.8,"kev":{"dateAdded":"2022-05-24","ransomware":false},"epss":{"score":0.29178,"percentile":0.98167},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Internet Explorer","techniqueIds":["T1499.004","T1189","T1203"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-5786#kev","url":"https://patchfirst.co/cve/CVE-2019-5786/","title":"[KEV] CVE-2019-5786: Google Chrome Blink Use-After-Free Vulnerability","content_text":"Google · Chrome Blink. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 61.1% (higher than 99.16% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1499.004 Application or System Exploitation. Priority 67.4 of 100.","summary":"Google Chrome Blink Use-After-Free Vulnerability","date_published":"2022-05-23T00:00:00.000Z","date_modified":"2026-06-17T02:38:12.000Z","tags":["kev","public-exploit","T1189","T1499.004"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2022-05-23","ransomware":false},"epss":{"score":0.61085,"percentile":0.99157},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Google","product":"Chrome Blink","techniqueIds":["T1189","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-4523#kev","url":"https://patchfirst.co/cve/CVE-2016-4523/","title":"[KEV] CVE-2016-4523: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability","content_text":"Trihedral · VTScada (formerly VTS). In CISA KEV since 2022-04-15. ENISA EUVD lists it as exploited. EPSS 31.2% (higher than 98.3% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 62.9 of 100.","summary":"Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability","date_published":"2022-04-15T00:00:00.000Z","date_modified":"2026-06-17T00:47:42.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2022-04-15","ransomware":false},"epss":{"score":0.31167,"percentile":0.98267},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Trihedral","product":"VTScada (formerly VTS)","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2015-5122#kev","url":"https://patchfirst.co/cve/CVE-2015-5122/","title":"[KEV] CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-04-13. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Named in 1 threat report. Priority 68.7 of 100.","summary":"Adobe Flash Player Use-After-Free Vulnerability","date_published":"2022-04-13T00:00:00.000Z","date_modified":"2026-06-17T00:28:30.000Z","tags":["kev","public-exploit","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.7,"kev":{"dateAdded":"2022-04-13","ransomware":false},"epss":{"score":0.87033,"percentile":0.99747},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1059","T1499.004"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-2502#kev","url":"https://patchfirst.co/cve/CVE-2015-2502/","title":"[KEV] CVE-2015-2502: Microsoft Internet Explorer Memory Corruption Vulnerability","content_text":"Microsoft · Internet Explorer. In CISA KEV since 2022-04-13. ENISA EUVD lists it as exploited. EPSS 51.0% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1499.004 Application or System Exploitation; T1203 Exploitation for Client Execution. Priority 53.9 of 100.","summary":"Microsoft Internet Explorer Memory Corruption Vulnerability","date_published":"2022-04-13T00:00:00.000Z","date_modified":"2026-06-17T00:24:12.000Z","tags":["kev","public-exploit","T1499.004","T1203"],"_patchfirst":{"reason":"kev","priority":53.9,"kev":{"dateAdded":"2022-04-13","ransomware":false},"epss":{"score":0.51001,"percentile":0.98927},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Internet Explorer","techniqueIds":["T1499.004","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5123#kev","url":"https://patchfirst.co/cve/CVE-2015-5123/","title":"[KEV] CVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-04-13. ENISA EUVD lists it as exploited. EPSS 18.8% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 49.3 of 100.","summary":"Adobe Flash Player Use-After-Free Vulnerability","date_published":"2022-04-13T00:00:00.000Z","date_modified":"2026-06-17T00:28:31.000Z","tags":["kev","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":49.3,"kev":{"dateAdded":"2022-04-13","ransomware":false},"epss":{"score":0.1883,"percentile":0.9728},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-21551#kev","url":"https://patchfirst.co/cve/CVE-2021-21551/","title":"[KEV] CVE-2021-21551: Dell dbutil Driver Insufficient Access Control Vulnerability","content_text":"Dell · dbutil Driver. In CISA KEV since 2022-03-31. ENISA EUVD lists it as exploited. EPSS 79.6% (higher than 99.61% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 68.4 of 100.","summary":"Dell dbutil Driver Insufficient Access Control Vulnerability","date_published":"2022-03-31T00:00:00.000Z","date_modified":"2026-06-17T03:35:45.000Z","tags":["kev","public-exploit","T1068","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.4,"kev":{"dateAdded":"2022-03-31","ransomware":false},"epss":{"score":0.79628,"percentile":0.99605},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Dell","product":"dbutil Driver","techniqueIds":["T1068","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-7200#kev","url":"https://patchfirst.co/cve/CVE-2016-7200/","title":"[KEV] CVE-2016-7200: Microsoft Edge Memory Corruption Vulnerability","content_text":"Microsoft · Edge. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 82.8% (higher than 99.67% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.1 of 100.","summary":"Microsoft Edge Memory Corruption Vulnerability","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2026-06-17T00:52:46.000Z","tags":["kev","public-exploit","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2022-03-28","ransomware":false},"epss":{"score":0.82779,"percentile":0.99669},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Edge","techniqueIds":["T1059","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-7201#kev","url":"https://patchfirst.co/cve/CVE-2016-7201/","title":"[KEV] CVE-2016-7201: Microsoft Edge Memory Corruption Vulnerability","content_text":"Microsoft · Edge. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution; T1499.004 Application or System Exploitation. Priority 79.1 of 100.","summary":"Microsoft Edge Memory Corruption Vulnerability","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2026-06-17T00:52:46.000Z","tags":["kev","public-exploit","T1189","T1203","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2022-03-28","ransomware":false},"epss":{"score":0.80004,"percentile":0.99613},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Edge","techniqueIds":["T1189","T1203","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-3881#kev","url":"https://patchfirst.co/cve/CVE-2017-3881/","title":"[KEV] CVE-2017-3881: Cisco IOS and IOS XE Remote Code Execution Vulnerability","content_text":"Cisco · IOS and IOS XE. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation; T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 73.7 of 100.","summary":"Cisco IOS and IOS XE Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T01:19:06.000Z","tags":["kev","public-exploit","T1059","T1499.004","T1190"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.9895,"percentile":0.99929},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"IOS and IOS XE","techniqueIds":["T1059","T1499.004","T1190"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-0125#kev","url":"https://patchfirst.co/cve/CVE-2018-0125/","title":"[KEV] CVE-2018-0125: Cisco VPN Routers Remote Code Execution Vulnerability","content_text":"Cisco · VPN Routers. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 55.2% (higher than 99.03% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.7 of 100.","summary":"Cisco VPN Routers Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T01:29:37.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.7,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.55186,"percentile":0.99027},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"VPN Routers","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2015-4068#kev","url":"https://patchfirst.co/cve/CVE-2015-4068/","title":"[KEV] CVE-2015-4068: Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability","content_text":"Arcserve · Unified Data Protection (UDP). In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 63.6% (higher than 99.22% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 64.2 of 100.","summary":"Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:26:43.000Z","tags":["kev","T1190","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.2,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.63643,"percentile":0.99215},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Arcserve","product":"Unified Data Protection (UDP)","techniqueIds":["T1190","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2010-3035#kev","url":"https://patchfirst.co/cve/CVE-2010-3035/","title":"[KEV] CVE-2010-3035: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","content_text":"Cisco · IOS XR. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 5.7% (higher than 93% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 61.8 of 100.","summary":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-16T23:22:00.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":61.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.05668,"percentile":0.92971},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"IOS XR","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2009-2055#kev","url":"https://patchfirst.co/cve/CVE-2009-2055/","title":"[KEV] CVE-2009-2055: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","content_text":"Cisco · IOS XR. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 3.3% (higher than 88.6% of CVEs). CVSS 5.9 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 59.8 of 100.","summary":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-16T23:08:40.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":59.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.03314,"percentile":0.88556},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"IOS XR","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-5135#kev","url":"https://patchfirst.co/cve/CVE-2020-5135/","title":"[KEV] CVE-2020-5135: SonicWall SonicOS Buffer Overflow Vulnerability","content_text":"SonicWall · SonicOS. In CISA KEV since 2022-03-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 26.9% (higher than 98% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 74.5 of 100.","summary":"SonicWall SonicOS Buffer Overflow Vulnerability","date_published":"2022-03-15T00:00:00.000Z","date_modified":"2026-06-17T03:20:57.000Z","tags":["kev","ransomware","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":74.5,"kev":{"dateAdded":"2022-03-15","ransomware":true},"epss":{"score":0.26869,"percentile":0.98033},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SonicOS","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-22719","url":"https://patchfirst.co/cve/CVE-2022-22719/","title":"CVE-2022-22719: mod_lua Use of uninitialized value of in r:parsebody","content_text":"Apache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 69.1% (higher than 99.35% of CVEs). ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Named in 1 threat report. Priority 24.8 of 100.","summary":"mod_lua Use of uninitialized value of in r:parsebody","date_published":"2022-03-14T00:00:00.000Z","date_modified":"2024-08-03T03:21:49.000Z","tags":["T1190","T1499.004"],"_patchfirst":{"reason":"published","priority":24.8,"kev":null,"epss":{"score":0.69097,"percentile":0.99353},"cvss":null,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","techniqueIds":["T1190","T1499.004"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2012-0507#kev","url":"https://patchfirst.co/cve/CVE-2012-0507/","title":"[KEV] CVE-2012-0507: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","content_text":"Oracle · Java SE. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.2% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1211 Exploitation for Stealth; T1499.004 Application or System Exploitation. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-08-14T05:16:51.000Z","tags":["kev","ransomware","public-exploit","T1190","T1211","T1499.004"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2022-03-03","ransomware":true},"epss":{"score":0.98189,"percentile":0.99914},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Oracle","product":"Java SE","techniqueIds":["T1190","T1211","T1499.004"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-6736#kev","url":"https://patchfirst.co/cve/CVE-2017-6736/","title":"[KEV] CVE-2017-6736: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","content_text":"Cisco · IOS and IOS XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 70.4% (higher than 99.38% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Named in 1 threat report. Priority 72.9 of 100.","summary":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:22:53.000Z","tags":["kev","public-exploit","T1078","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":72.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.70354,"percentile":0.99384},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"IOS and IOS XE Software","techniqueIds":["T1078","T1059","T1499.004"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-2424#kev","url":"https://patchfirst.co/cve/CVE-2015-2424/","title":"[KEV] CVE-2015-2424: Microsoft PowerPoint Memory Corruption Vulnerability","content_text":"Microsoft · PowerPoint. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 40.1% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution; T1499.004 Application or System Exploitation. Named in 1 threat report. Priority 67.8 of 100.","summary":"Microsoft PowerPoint Memory Corruption Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T00:24:04.000Z","tags":["kev","T1204.002","T1203","T1499.004"],"_patchfirst":{"reason":"kev","priority":67.8,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.40124,"percentile":0.98634},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"PowerPoint","techniqueIds":["T1204.002","T1203","T1499.004"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-11899#kev","url":"https://patchfirst.co/cve/CVE-2020-11899/","title":"[KEV] CVE-2020-11899: Treck TCP/IP stack Out-of-Bounds Read Vulnerability","content_text":"Treck TCP/IP stack · IPv6. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 18.4% (higher than 97.2% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 66.2 of 100.","summary":"Treck TCP/IP stack Out-of-Bounds Read Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T02:51:00.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":66.2,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.1842,"percentile":0.97231},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Treck TCP/IP stack","product":"IPv6","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-12240#kev","url":"https://patchfirst.co/cve/CVE-2017-12240/","title":"[KEV] CVE-2017-12240: Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability","content_text":"Cisco · IOS and IOS XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 13.8% (higher than 96.5% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.2 of 100.","summary":"Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:02:57.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.2,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.13773,"percentile":0.9651},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"IOS and IOS XE Software","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-6737#kev","url":"https://patchfirst.co/cve/CVE-2017-6737/","title":"[KEV] CVE-2017-6737: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","content_text":"Cisco · IOS and IOS XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 45.0% (higher than 98.8% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 63.9 of 100.","summary":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:22:54.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":63.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.44964,"percentile":0.98779},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"IOS and IOS XE Software","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}}]}