Security feed

24 October 2026

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe ColdFusion Authentication Bypass Vulnerability

An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

ColdFusion CVE-2013-0632

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0632

ColdFusion

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0632
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2855 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:47 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Reader and Acrobat Memory Corruption Vulnerability

An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Reader and Acrobat CVE-2013-0640

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0640

Reader and Acrobat

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0640
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2854 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:46 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Reader Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Reader CVE-2013-0641

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-0641

Reader

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-0641
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2853 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:46 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Internet Explorer Remote Code Execution Vulnerability

This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Internet Explorer CVE-2013-1347

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-1347

Internet Explorer

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-1347
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2852 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:44 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Internet Explorer Use-After-Free Vulnerability

A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Internet Explorer CVE-2013-3897

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-3897

Internet Explorer

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-3897
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2851 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:44 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Mozilla Firefox Information Disclosure Vulnerability

Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Firefox CVE-2013-1675

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-1675

Firefox

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-1675
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2850 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:43 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Reader and Acrobat Memory Corruption Vulnerability

Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Reader and Acrobat CVE-2013-3346

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-3346

Reader and Acrobat

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-3346
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2849 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:43 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Windows CVE-2013-5065

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-5065

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-5065
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2848 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:42 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Reader and Acrobat Use-After-Free Vulnerability

Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Reader and Acrobat CVE-2014-0496

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2014-0496

Reader and Acrobat

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2014-0496
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2847 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:42 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Windows CVE-2014-4114

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2014-4114

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2014-4114
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2846 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:41 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Win32k Privilege Escalation Vulnerability

An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Win32k CVE-2015-1701

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-1701

Win32k

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-1701
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2845 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:40 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Office CVE-2015-1642

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-1642

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-1642
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2844 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:39 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft ATM Font Driver Privilege Escalation Vulnerability

ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

ATM Font Driver CVE-2015-2387

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-2387

ATM Font Driver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-2387
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2843 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:39 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Java SE CVE-2015-2590

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-2590

Java SE

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-2590
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2842 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:38 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft PowerPoint Memory Corruption Vulnerability

Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

PowerPoint CVE-2015-2424

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-2424

PowerPoint

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-2424
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2841 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:37 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Malformed EPS File Vulnerability

Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Office CVE-2015-2545

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-2545

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-2545
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2840 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:36 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Oracle Java SE Integrity Check Vulnerability

Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Java SE CVE-2015-4902

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-4902

Java SE

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-4902
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2839 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:36 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Flash Player Memory Corruption Vulnerability

A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

Announced 3 Mar 2022

Flash Player CVE-2015-3043

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-3043

Flash Player

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-3043
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2838 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:34 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Flash Player Use-After-Free Vulnerability

A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

Announced 3 Mar 2022

Flash Player CVE-2015-5119

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-5119

Flash Player

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-5119
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2837 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:33 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. CISA required action: Apply updates per vendor instructions.

Announced 3 Mar 2022

Windows CVE-2016-0099

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-0099

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-0099
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2836 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:32 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

Older events