The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
27 Oct 2026 Adobe Commerce and Magento Malicious file upload
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe i\/o events 1.21.0
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-434
24 Sep 2026 Adobe Commerce and Magento Access control flaw
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe commerce 2.4.4, adobe commerce b2b 1.3.3
- CISA due date
- 27 Sep 2026
- Weakness
- CWE-863
8 Sep 2026 Adobe Commerce and Magento Remote code execution
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe magento 2.4.6, adobe commerce 2.4.4, adobe commerce b2b 1.3.3
- CISA due date
- 11 Sep 2026
- Weakness
- CWE-1336
7 Jul 2026 Adobe ColdFusion Path traversal
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Jul 2026
- Weakness
- CWE-22
20 May 2026 Adobe Acrobat and Reader Memory corruption
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe acrobat 9.2, adobe acrobat reader 9.2, adobe acrobat 8.1.7, adobe acrobat reader 8.1.7, adobe acrobat 7.1.4 and 1 older
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-119
13 Apr 2026 Adobe Acrobat and Reader Security flaw
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe acrobat dc 26.001.21411, adobe acrobat reader dc 26.001.21411, adobe acrobat 24.001.30362, adobe acrobat 24.001.30360
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-1321
13 Apr 2026 Adobe Acrobat Memory corruption
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-416
24 Oct 2025 Adobe Commerce and Magento Input validation flaw
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 14 Nov 2025
- Weakness
- CWE-20
15 Oct 2025 Adobe Experience Manager (AEM) Forms Access control flaw
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Nov 2025
- Weakness
- CWE-863
24 Feb 2025 Adobe ColdFusion Remote code execution
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 17 Mar 2025
- Weakness
- CWE-502
16 Dec 2024 Adobe ColdFusion Access control flaw
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 6 Jan 2025
- Weakness
- CWE-284
17 Sep 2024 Adobe Flash Player Memory corruption
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- adobe flash player 12.0.0.70, adobe flash player 11.7.700.269, adobe flash player 11.2.202.341, adobe air sdk 4.0.0.1628, adobe air 4.0.0.1628
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-399
On Hacker News
Building a Decoder for the CVE-2014-0502 Shellcode17 Sep 2024 Adobe Flash Player Memory corruption
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- google chrome 32.0.1700.107, adobe flash player 12.0.0.44, adobe flash player 11.7.700.261, adobe flash player 11.2.202.336
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-191
17 Sep 2024 Adobe Flash Player Security flaw
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- adobe flash player 11.6.602.171, adobe flash player 11.2.202.273, adobe flash player 10.3.183.67
- CISA due date
- 8 Oct 2024
17 Sep 2024 Adobe Flash Player Privilege escalation
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- adobe flash player 11.6.602.171, adobe flash player 11.2.202.273, adobe flash player 10.3.183.67
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-264
17 Jul 2024 Adobe Commerce and Magento Open Source XML external entity
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- adobe commerce webhooks 1.5.0
- CISA due date
- 7 Aug 2024
- Weakness
- CWE-611
8 Jan 2024 Adobe ColdFusion Remote code execution
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 29 Jan 2024
- Weakness
- CWE-502
8 Jan 2024 Adobe ColdFusion Remote code execution
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 29 Jan 2024
- Weakness
- CWE-502
10 Oct 2023 Adobe Acrobat and Reader Memory corruption
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 31 Oct 2023
- Weakness
- CWE-416
14 Sep 2023 Adobe Acrobat and Reader Memory corruption
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- adobe acrobat dc 23.006.20320, adobe acrobat reader dc 23.006.20320, adobe acrobat 20.005.30524, adobe acrobat reader 20.005.30524
- CISA due date
- 5 Oct 2023
- Weakness
- CWE-787
21 Aug 2023 Adobe ColdFusion Remote code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Sep 2023
- Weakness
- CWE-502
20 Jul 2023 Adobe ColdFusion Access control flaw
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 10 Aug 2023
- Weakness
- CWE-284
20 Jul 2023 Adobe ColdFusion Access control flaw
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 10 Aug 2023
- Weakness
- CWE-284
15 Mar 2023 Adobe ColdFusion Access control flaw
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2023
- Weakness
- CWE-284
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-415
8 Jun 2022 Adobe Flash Player Memory corruption
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.4.402.265
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-189
8 Jun 2022 Adobe Flash Player Cross-site scripting
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.1.115.6, adobe flash player 11.1.111.6, adobe flash player 11.1.102.62, adobe flash player 10.3.183.15
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-79
8 Jun 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.1.115.6, adobe flash player 11.1.111.6, adobe flash player 11.1.102.62, adobe flash player 10.3.183.15
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Adobe Reader and Acrobat Memory corruption
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- google chrome 10.0.648.134
- CISA due date
- 22 Jun 2022
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.4, adobe acrobat reader 9.4, adobe acrobat 8.2.5, adobe acrobat reader 8.2.5
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
On Hacker News
Critical vulnerability in Adobe Reader8 Jun 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 10.1.53.64, adobe acrobat 9.3.3, adobe flash player 9.0.277.0, adobe acrobat 8.2.3, adobe air 2.0.2.12610
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.3, adobe acrobat reader 9.3, adobe acrobat 8.2, adobe acrobat reader 8.2
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-399
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.3, adobe acrobat 8.2, adobe acrobat 7.1.4
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Adobe Acrobat and Reader, Flash Player Memory corruption
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
- What to do
- For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-94
8 Jun 2022 Adobe Acrobat and Reader Information disclosure
Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 8.1.2, adobe acrobat reader 8.1.2
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-200
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 8.1.2, adobe acrobat reader 8.1.2
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
25 May 2022 Adobe Flash Player and AIR Memory corruption
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
- What to do
- The impacted products are end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-190
25 May 2022 Adobe Flash Player and AIR Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
- What to do
- The impacted products are end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-416
25 May 2022 Adobe Flash Player Memory corruption
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 20.0.0.267, adobe air sdk 20.0.0.233, adobe air sdk & compiler 20.0.0.233, adobe air 20.0.0.233, adobe flash player 18.0.0.324 and 6 older
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-189
25 May 2022 Adobe Flash Player Information disclosure
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.287, adobe flash player 13.0.0.262, adobe flash player 11.2.202.438
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
On Hacker News
Understanding CVE-2015-0310 Flash vulnerability25 May 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe air sdk & compiler 15.0.0.302
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-119
25 May 2022 Adobe Reader and Acrobat Security flaw
Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.08, adobe acrobat reader 11.0.08, adobe acrobat 10.1.11, adobe acrobat reader 10.1.11
- CISA due date
- 15 Jun 2022
23 May 2022 Adobe Flash Player Memory corruption
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Memory corruption
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 18.0.0.194, adobe flash player 13.0.0.296, adobe flash player 11.2.202.468, hp insight orchestration 7.5.0, hp system management homepage 7.5.0 and 4 older
- CISA due date
- 4 May 2022
- Weakness
- CWE-119
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.305, adobe flash player 13.0.0.269, adobe flash player 11.2.202.442
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.287
- CISA due date
- 4 May 2022
13 Apr 2022 Adobe Flash Player Memory corruption
Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 15.0.0.246, adobe flash player 13.0.0.259, adobe flash player 11.2.202.425
- CISA due date
- 4 May 2022
- Weakness
- CWE-121
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.