{"schema_version":"1","data":[{"id":3669,"advisory_id":"56845987-e9c8-4179-b106-0a253fc84a84","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36955","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:27.041515+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-36955"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36955","aliases":["CVE-2021-36955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3668,"advisory_id":"cdc22995-d654-41f3-8016-1d9b2a2accbb","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0863","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:26.266188+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2019-0863"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","summary":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-0863","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-0863","aliases":["CVE-2019-0863"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-0863","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0863","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.","vulnerabilityName":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-0863","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3665,"advisory_id":"411b55d8-1b17-4ce7-a61d-18c2422134a4","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1214","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:23.981408+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2019-1214"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1214","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1214","aliases":["CVE-2019-1214"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1214","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1214","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.","vulnerabilityName":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-1214","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3660,"advisory_id":"dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0601","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:19.22435+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-0601"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows CryptoAPI Spoofing Vulnerability","summary":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0601","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0601","aliases":["CVE-2020-0601"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-295"],"cveID":"CVE-2020-0601","notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","vulnerabilityName":"Microsoft Windows CryptoAPI Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0601","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3659,"advisory_id":"1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34448","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:35.392432+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-34448"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34448","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34448","aliases":["CVE-2021-34448"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2021-34448","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34448","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.","vulnerabilityName":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-34448","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3658,"advisory_id":"6d10788d-762f-45f1-b18d-4e7285c813b5","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1675","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:34.761832+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-1675"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-1675","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-1675","aliases":["CVE-2021-1675"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-285"],"cveID":"CVE-2021-1675","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1675","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-1675","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3637,"advisory_id":"e7fb48e9-d54b-4969-8397-52d18ee3f2e9","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:22.199696+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2019-1215"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1215","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1215","aliases":["CVE-2019-1215"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1215","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2019-1215","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3635,"advisory_id":"d44eef24-e5ba-4b21-897a-6af5cb8046c6","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36942","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:21.035228+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-36942"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36942","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36942","aliases":["CVE-2021-36942"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-749"],"cveID":"CVE-2021-36942","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36942","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","vulnerabilityName":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36942","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3628,"advisory_id":"b5b9e935-13c4-4731-9d51-79ba4fe46185","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1350","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:16.623203+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-1350"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","summary":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1350","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1350","aliases":["CVE-2020-1350"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-1350","notes":"Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","vulnerabilityName":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1350","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3624,"advisory_id":"58e247be-7d55-490c-a1e5-01fe738c79c9","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34527","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:13.938908+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-34527"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34527","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34527","aliases":["CVE-2021-34527"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269"],"cveID":"CVE-2021-34527","notes":"Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-34527","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3621,"advisory_id":"3e6a8c50-4216-43bc-9716-bdb89133b8c5","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1464","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:12.202403+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-1464"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Spoofing Vulnerability","summary":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1464","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1464","aliases":["CVE-2020-1464"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-347"],"cveID":"CVE-2020-1464","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1464","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.","vulnerabilityName":"Microsoft Windows Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1464","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3620,"advisory_id":"7af1efd9-6278-4731-b6e7-023d326e5a6d","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0143","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:11.630153+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2017-0143"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","summary":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-0143","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-0143","aliases":["CVE-2017-0143"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2017-0143","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2017-0143","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3615,"advisory_id":"83f01600-c39a-40ee-8f19-2feab7c484a2","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36948","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:08.729871+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-36948"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36948","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36948","aliases":["CVE-2021-36948"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36948","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36948","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-36948","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3612,"advisory_id":"20eadac2-19f1-4604-96fe-32701517873d","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0986","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:06.999967+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-0986"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0986","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0986","aliases":["CVE-2020-0986"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0986","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0986","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0986","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3610,"advisory_id":"b924bdf9-9ac3-4cf4-b094-576a426ffac6","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1020","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:05.888191+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-1020"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1020","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1020","aliases":["CVE-2020-1020"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-1020","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1020","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1020","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3608,"advisory_id":"593aa785-6af9-4326-a456-2a6ed3589018","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0938","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:04.699184+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-0938"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0938","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0938","aliases":["CVE-2020-0938"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0938","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0938","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0938","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3607,"advisory_id":"653292e8-96e6-4752-92f2-cfb8f898ee57","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31979","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:04.122082+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-31979"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31979","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31979","aliases":["CVE-2021-31979"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-31979","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31979","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31979","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3605,"advisory_id":"fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31956","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:02.789937+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-31956"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows NTFS Privilege Escalation Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31956","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31956","aliases":["CVE-2021-31956"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-191","CWE-787"],"cveID":"CVE-2021-31956","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31956","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.","vulnerabilityName":"Microsoft Windows NTFS Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31956","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3604,"advisory_id":"0e41fa94-f010-4383-9b13-1f68684626a2","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33771","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:02.192818+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-33771"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33771","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33771","aliases":["CVE-2021-33771"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-33771","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33771","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33771","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3602,"advisory_id":"43e7d473-197f-4ed7-97ea-66105d7c02f8","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0683","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:00.874846+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-0683"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","summary":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0683","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0683","aliases":["CVE-2020-0683"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-0683","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0683","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0683","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3601,"advisory_id":"83211466-b58a-4c0b-97ba-f5d9af01c42a","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17087","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:38:00.251253+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-17087"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-17087","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17087","aliases":["CVE-2020-17087"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-131"],"cveID":"CVE-2020-17087","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17087","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-17087","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3600,"advisory_id":"9bcd6a6d-29e1-444a-ab74-7c1ab705675b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33742","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:37:59.416553+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-33742"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33742","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33742","aliases":["CVE-2021-33742"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787","CWE-823"],"cveID":"CVE-2021-33742","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33742","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33742","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3599,"advisory_id":"2cee61da-c78f-467b-a6b3-f4b2aafe5d68","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0185","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:37:58.841938+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2016-0185"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Media Center Remote Code Execution Vulnerability","summary":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-0185","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-0185","aliases":["CVE-2016-0185"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2016-0185","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0185","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.","vulnerabilityName":"Microsoft Windows Media Center Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-0185","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3597,"advisory_id":"8676ac71-c26c-467e-8400-9ae18c98ddd5","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33739","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:37:57.724452+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-33739"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","summary":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33739","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33739","aliases":["CVE-2021-33739"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-33739","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33739","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33739","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3595,"advisory_id":"7e29761b-8355-4374-ada2-1ad35a407f49","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31955","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:37:56.593551+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-31955"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Information Disclosure Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31955","aliases":["CVE-2021-31955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-497"],"cveID":"CVE-2021-31955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.","vulnerabilityName":"Microsoft Windows Kernel Information Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3593,"advisory_id":"8347a718-db8e-4766-b2e0-ac0ca5f49f19","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-1812","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:37:55.441713+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2014-1812"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","summary":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2014-1812","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2014-1812","aliases":["CVE-2014-1812"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-255"],"cveID":"CVE-2014-1812","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","vulnerabilityName":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2014-1812","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2966,"advisory_id":"b837d3d5-0b76-4241-ab7b-54ceb1f4a196","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40449","source_published_at":"2021-11-17T00:00:00+00:00","published_at":"2026-10-24T21:26:55.752621+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-40449"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Win32k Privilege Escalation Vulnerability","summary":"Unspecified vulnerability allows for an authenticated user to escalate privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-40449","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-40449","aliases":["CVE-2021-40449"],"affected":[],"modified":"2021-11-17T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-416"],"cveID":"CVE-2021-40449","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40449","dueDate":"2021-12-01","product":"Windows","dateAdded":"2021-11-17","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","vulnerabilityName":"Microsoft Windows Win32k Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-40449","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2945,"advisory_id":"4e02ca5f-8904-4fdf-bf16-b46c029fb528","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-43890","source_published_at":"2021-12-15T00:00:00+00:00","published_at":"2026-10-24T21:26:43.143855+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2021-43890"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows AppX Installer Spoofing Vulnerability","summary":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-43890","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-43890","aliases":["CVE-2021-43890"],"affected":[],"modified":"2021-12-15T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-43890","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-43890","dueDate":"2021-12-29","product":"Windows","dateAdded":"2021-12-15","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","vulnerabilityName":"Microsoft Windows AppX Installer Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-43890","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2908,"advisory_id":"9feb7ffc-705c-4f7d-912b-c2b126558d01","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0787","source_published_at":"2022-01-28T00:00:00+00:00","published_at":"2026-10-24T21:26:20.427213+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2020-0787"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","summary":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0787","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0787","aliases":["CVE-2020-0787"],"affected":[],"modified":"2022-01-28T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269","CWE-59"],"cveID":"CVE-2020-0787","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","dueDate":"2022-07-28","product":"Windows","dateAdded":"2022-01-28","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","vulnerabilityName":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2020-0787","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2893,"advisory_id":"8188810a-4742-4368-9776-f137493f9311","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-8464","source_published_at":"2022-02-10T00:00:00+00:00","published_at":"2026-10-24T21:26:12.605667+00:00","extraction_method":"structured","technologies":["core-kev","windows"],"cve_ids":["CVE-2017-8464"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability","summary":"Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-8464","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-8464","aliases":["CVE-2017-8464"],"affected":[],"modified":"2022-02-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2017-8464","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8464","dueDate":"2022-08-10","product":"Windows","dateAdded":"2022-02-10","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file","vulnerabilityName":"Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2017-8464","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}}],"next_after":3669,"next_before":2893}