CVE-2022-41048 — Microsoft Windows_10: ODBC Driver Remote Code Execution Vulnerability
Microsoft ODBC Driver Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile
8.8
CVSS v3.1
94
Edit Score
Latest intel// live feed
25 results//sorted by published//last sync 2026-10-26 16:28Z
CVE-2022-41047 — Microsoft Windows_10: ODBC Driver Remote Code Execution Vulnerability
Microsoft ODBC Driver Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2022-41044 — Microsoft Windows_7: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 59th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2022-41039 — Microsoft Windows_10: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 60th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2022-38023 — Microsoft Windows_server_2008: Netlogon RPC Elevation of Privilege Vulnerability
Netlogon RPC Elevation of Privilege Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 83th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2022-37966 — Microsoft Windows_server_2008: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 85th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2022-43945 — Linux Linux_kernel: The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to
The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the sp CVSSv3.1 7.5 (HIGH) · EPSS 98th percentile
7.5
CVSS v3.1
94
Edit Score
CVE-2022-3852 — Vr_calendar_project Vr_calendar: The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2022-3776 — Oracle Restaurant_menu_-_food_ordering_system_-_table_reservation: The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request gra CVSSv3.1 8.8 (HIGH) · EPSS 73th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2022-3786 — Openssl Openssl: This buffer overflow could result in a crash (causing a denial of service).
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile
7.5
CVSS v3.1
95
Edit Score
CVE-2022-3602 — Openssl Openssl: This buffer overflow could result in a crash (causing a denial of service) or
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile
7.5
CVSS v3.1
100
Edit Score
ICEDIDs network infrastructure is alive and well
Elastic Security Labs·elastic.co
Elastic Security Labs published a comprehensive analysis of ICEDID (Bokbot) C2 infrastructure tracking using open-source collection tools and TLS certificate pinning. The research identified 103 confirmed ICEDID C2 IP addresses by correlating Censys certificate data with Check Point's TLS validation script, revealing that ICEDID's certificate generation has remained static for 18 months. The team released open-source tools for ICEDID configuration extraction and C2 infrastructure validation, along with detection logic and YARA rules.
72
Edit Score
CVE-2022-42915 — Haxx Curl: An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/clean CVSSv3.1 8.1 (HIGH) · EPSS 87th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2022-3708 — Google Web_stories: The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVSSv3.1 9.6 (CRITICAL) · EPSS 78th percentile
9.6
CVSS v3.1
98
Edit Score
CVE-2022-43340 — Dzzoffice Dzzoffice: A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user
A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users. CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2022-38580 — Zalando Skipper: v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-46848 — Gnu Libtasn1: before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. CVSSv3.1 9.1 (CRITICAL) · EPSS 82th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2022-37454 — Extended_keccak_code_package_project Extended_keccak_code_package: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2022-41415 — Acer Altos_w2000h-w570h_f4_firmware: This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted
Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable. CVSSv3.1 9.8 (CRITICAL) · EPSS 67th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2022-40055 — Gxgroup Gpon_ont_titanium_2122a_firmware: An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page. CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2022-41674 — Linux Linux_kernel: Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. CVSSv3.1 8.1 (HIGH) · EPSS 91th percentile
8.1
CVSS v3.1
92
Edit Score
CVE-2022-42719 — Linux Linux_kernel: A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code. CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2022-33106 — Wijungle U250_firmware: NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over. CVSSv3.1 9.8 (CRITICAL) · EPSS 53th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2022-31765 — Siemens 6gk6108-4am00-2ba2_firmware: This could allow low privileged users to escalate their privileges.
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. CVSSv3.1 8.8 (HIGH) · EPSS 66th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2022-36635 — Zkteco Zkbiosecurity_v5000: ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the
ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile
8.8
CVSS v3.1
99
Edit Score