Security feed

24 October 2026

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory. CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

Win32k CVE-2017-0263

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-0263

Win32k

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-0263
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2895 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:13 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

WebLogic Server CVE-2017-10271

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-10271

WebLogic Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-10271
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2894 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:13 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

Windows CVE-2017-8464

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-8464

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-8464
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2893 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:12 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Apache Struts 1 Improper Input Validation Vulnerability

The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

Struts 1 CVE-2017-9791

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-9791

Struts 1

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-9791
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2892 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:11 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

A code execution vulnerability exists in the Stapler web framework used by Jenkins CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

Jenkins Stapler Web Framework CVE-2018-1000861

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-1000861

Jenkins Stapler Web Framework

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-1000861
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2891 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:11 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft SMBv3 Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

SMBv3 CVE-2020-0796

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-0796

SMBv3

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-0796
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2890 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:10 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Graphics Component Memory Corruption Vulnerability

Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

Graphics Component CVE-2013-3906

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-3906

Graphics Component

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2013-3906
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2889 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:09 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows SAM Local Privilege Escalation Vulnerability

If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level. CISA required action: Apply updates per vendor instructions.

Announced 10 Feb 2022

Windows CVE-2021-36934

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-36934

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-36934
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2888 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:08 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA required action: Apply updates per vendor instructions.

Announced 11 Feb 2022

iOS, iPadOS, and macOS CVE-2022-22620

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-22620

iOS, iPadOS, and macOS

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-22620
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2887 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:07 GMT
Publisher date: Fri, 11 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Word Memory Corruption Vulnerability

Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

Word CVE-2014-1761

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2014-1761

Word

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2014-1761
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2886 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:07 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Flash Player Use-After-Free Vulnerability

Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

Announced 15 Feb 2022

Flash Player CVE-2018-15982

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-15982

Flash Player

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-15982
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2885 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:06 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

PHPUnit Command Injection Vulnerability

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "

Announced 15 Feb 2022

PHPUnit CVE-2017-9841

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-9841

PHPUnit

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-9841
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2884 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:05 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution" CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

Windows CVE-2018-8174

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-8174

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-8174
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2883 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:05 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

WinRAR Absolute Path Traversal Vulnerability

WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

WinRAR CVE-2018-20250

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-20250

WinRAR

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-20250
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2882 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:04 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Internet Explorer Type Confusion Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

Internet Explorer CVE-2019-0752

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2019-0752

Internet Explorer

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2019-0752
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2881 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:04 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Google Chromium Animation Use-After-Free Vulnerability

Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

Chromium Animation CVE-2022-0609

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-0609

Chromium Animation

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-0609
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2880 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:03 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. CISA required action: Apply updates per vendor instructions.

Announced 15 Feb 2022

Commerce and Magento Open Source CVE-2022-24086

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-24086

Commerce and Magento Open Source

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-24086
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2879 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:02 GMT
Publisher date: Tue, 15 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Zabbix Frontend Improper Access Control Vulnerability

Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. CISA required action: Apply updates per vendor instructions.

Announced 22 Feb 2022

Frontend CVE-2022-23134

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-23134

Frontend

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-23134
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2878 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:02 GMT
Publisher date: Tue, 22 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Zabbix Frontend Authentication Bypass Vulnerability

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. CISA required action: Apply updates per vendor instructions.

Announced 22 Feb 2022

Frontend CVE-2022-23131

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-23131

Frontend

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-23131
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2877 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:01 GMT
Publisher date: Tue, 22 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryKnown exploited CVECISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Windows Code Injection Vulnerability

Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object. CISA required action: Apply updates per vendor instructions.

Announced 25 Feb 2022

Windows CVE-2014-6352

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2014-6352

Windows

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2014-6352
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2876 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:01 GMT
Publisher date: Fri, 25 Feb 2022 00:00:00 GMT

Read the original announcement

Older events