Authoritative signal

Known exploited

The current CISA KEV catalog, bound to the current snapshot and ordered by catalog date and CASCA priority.

Evidence through Oct 22, 2026, 6:07 PM UTC

CISA KEV catalog boundaryCatalog silence leaves exploitation status unassessed. Alternate serialization never counts as a second source.1,754 catalog members · showing 1051–1100

1051

CVE-2013-3993CISA KEVKnown ransomwareSource-reported scopeEvidence supported

IBM InfoSphere BigInsights Invalid Input Vulnerability

Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.

IBMInfoSphere BigInsights

Required actionThe impacted product is end-of-life and should be disconnected if still in use.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-25
Due: 2022-06-15
Priority interval: 55.8–57.3
Coverage: 93%

↗

1052

CVE-2017-8543CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Search Remote Code Execution Vulnerability

Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 88.1–88.9
Coverage: 99%

↗

1053

CVE-2017-0147CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows SMBv1 Information Disclosure Vulnerability

The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.

MicrosoftSMBv1 server

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 86.9–87.5
Coverage: 99%

↗

1054

CVE-2017-18362CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Kaseya VSA SQL Injection Vulnerability

ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.

KaseyaVirtual System/Server Administrator (VSA)

Required actionThe impacted product is end-of-life and should be disconnected if still in use.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 83.1–87.3
Coverage: 85%

↗

1055

CVE-2017-8291CISA KEVSource-reported scopeEvidence supported

Artifex Ghostscript Type Confusion Vulnerability

Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.

ArtifexGhostscript

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 86.2–86.8
Coverage: 99%

↗

1056

CVE-2018-19949CISA KEVKnown ransomwareSource-reported scopeEvidence supported

QNAP NAS File Station Command Injection Vulnerability

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

QNAPNetwork Attached Storage (NAS)

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 75.5–86.5
Coverage: 85%

↗

1057

CVE-2016-6366CISA KEVSource-reported scopeEvidence supported

Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.

CiscoAdaptive Security Appliance (ASA)

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 84.9–86.0
Coverage: 99%

↗

1058

CVE-2016-4657CISA KEVSource-reported scopeEvidence supported

Apple iOS Webkit Memory Corruption Vulnerability

Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

AppleiOS

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 81.0–82.5
Coverage: 93%

↗

1059

CVE-2018-19943CISA KEVKnown ransomwareAssessments differAssessments differSource-reported scope

QNAP NAS File Station Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

QNAPNetwork Attached Storage (NAS)

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 63.0–81.2
Coverage: 73%

↗

1060

CVE-2018-19953CISA KEVKnown ransomwareSource-reported scopeEvidence supported

QNAP NAS File Station Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

QNAPNetwork Attached Storage (NAS)

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 66.3–77.3
Coverage: 85%

↗

1061

CVE-2017-0149CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.

MicrosoftInternet Explorer

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 75.4–77.0
Coverage: 96%

↗

1062

CVE-2017-0210CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.

MicrosoftInternet Explorer

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 74.1–75.6
Coverage: 95%

↗

1063

CVE-2018-8611CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Kernel Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 70.3–74.7
Coverage: 94%

↗

1064

CVE-2016-3298CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.

MicrosoftInternet Explorer

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 72.4–73.5
Coverage: 98%

↗

1065

CVE-2016-4656CISA KEVSource-reported scopeEvidence supported

Apple iOS Memory Corruption Vulnerability

A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.

AppleiOS

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 71.9–73.4
Coverage: 93%

↗

1066

CVE-2016-3351CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Internet Explorer and Edge Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

MicrosoftInternet Explorer and Edge

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 66.5–73.4
Coverage: 85%

↗

1067

CVE-2017-0005CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability

The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 72.5–73.3
Coverage: 99%

↗

1068

CVE-2016-6367CISA KEVSource-reported scopeEvidence supported

Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.

CiscoAdaptive Security Appliance (ASA)

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 71.6–73.2
Coverage: 95%

↗

1069

CVE-2017-0022CISA KEVSource-reported scopeEvidence supported

Microsoft XML Core Services Information Disclosure Vulnerability

Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.

MicrosoftXML Core Services

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 69.4–70.4
Coverage: 98%

↗

1070

CVE-2016-4655CISA KEVSource-reported scopeEvidence supported

Apple iOS Information Disclosure Vulnerability

The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.

AppleiOS

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 67.9–69.5
Coverage: 95%

↗

1071

CVE-2016-0162CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.

MicrosoftInternet Explorer

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-24
Due: 2022-06-14
Priority interval: 62.8–64.3
Coverage: 96%

↗

1072

CVE-2019-11708CISA KEVSource-reported scopeEvidence supported

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

MozillaFirefox and Thunderbird

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 83.5–86.5
Coverage: 93%

↗

1073

CVE-2019-13720CISA KEVSource-reported scopeEvidence supported

Google Chrome WebAudio Use-After-Free Vulnerability

Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

GoogleChrome WebAudio

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 80.2–81.3
Coverage: 95%

↗

1074

CVE-2019-18426CISA KEVSource-reported scopeEvidence supported

WhatsApp Cross-Site Scripting Vulnerability

A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

Meta PlatformsWhatsApp

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 79.6–81.2
Coverage: 95%

↗

1075

CVE-2019-11707CISA KEVSource-reported scopeEvidence supported

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

MozillaFirefox and Thunderbird

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 77.8–80.8
Coverage: 93%

↗

1076

CVE-2019-8720CISA KEVSource-reported scopeEvidence supported

WebKitGTK Memory Corruption Vulnerability

WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.

WebKitGTKWebKitGTK

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 64.5–77.6
Coverage: 85%

↗

1077

CVE-2019-5786CISA KEVSource-reported scopeEvidence supported

Google Chrome Blink Use-After-Free Vulnerability

Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.

GoogleChrome Blink

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 74.5–76.1
Coverage: 93%

↗

1078

CVE-2018-5002CISA KEVSource-reported scopeEvidence supported

Adobe Flash Player Stack-based Buffer Overflow Vulnerability

Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.

AdobeFlash Player

Required actionThe impacted product is end-of-life and should be disconnected if still in use.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 75.2–76.0
Coverage: 98%

↗

1079

CVE-2021-30883CISA KEVSource-reported scopeEvidence supported

Apple Multiple Products Memory Corruption Vulnerability

Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.

AppleMultiple Products

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 72.2–76.0
Coverage: 94%

↗

1080

CVE-2020-1027CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Kernel Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 71.2–75.1
Coverage: 96%

↗

1081

CVE-2020-0638CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Update Notification Manager Privilege Escalation Vulnerability

Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.

MicrosoftUpdate Notification Manager

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 62.6–74.8
Coverage: 85%

↗

1082

CVE-2019-1130CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 62.1–74.7
Coverage: 85%

↗

1083

CVE-2019-7286CISA KEVSource-reported scopeEvidence supported

Apple Multiple Products Memory Corruption Vulnerability

Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.

AppleMultiple Products

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 71.0–73.2
Coverage: 93%

↗

1084

CVE-2019-1385CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 63.3–73.1
Coverage: 85%

↗

1085

CVE-2019-0880CISA KEVSource-reported scopeEvidence supported

Microsoft Windows Privilege Escalation Vulnerability

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 69.4–72.4
Coverage: 97%

↗

1086

CVE-2019-0703CISA KEVSource-reported scopeEvidence supported

Microsoft Windows SMB Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 69.5–70.9
Coverage: 99%

↗

1087

CVE-2018-8589CISA KEVSource-reported scopeEvidence supported

Microsoft Win32k Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.

MicrosoftWin32k

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 66.5–69.5
Coverage: 94%

↗

1088

CVE-2019-7287CISA KEVSource-reported scopeEvidence supported

Apple iOS Memory Corruption Vulnerability

Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.

AppleiOS

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 66.4–68.0
Coverage: 93%

↗

1089

CVE-2019-0676CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.

MicrosoftInternet Explorer

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 64.6–67.2
Coverage: 93%

↗

1090

CVE-2022-20821CISA KEVSource-reported scopeEvidence supported

Cisco IOS XR Open Port Vulnerability

Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.

CiscoIOS XR

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 65.7–67.2
Coverage: 93%

↗

1091

CVE-2021-1048CISA KEVSource-reported scopeEvidence supported

Android Kernel Use-After-Free Vulnerability

Android kernel contains a use-after-free vulnerability that allows for privilege escalation.

AndroidKernel

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 64.2–65.7
Coverage: 93%

↗

1092

CVE-2021-0920CISA KEVSource-reported scopeEvidence supported

Android Kernel Race Condition Vulnerability

Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.

AndroidKernel

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-23
Due: 2022-06-13
Priority interval: 63.1–64.0
Coverage: 98%

↗

1093

CVE-2022-30525CISA KEVSource-reported scopeEvidence supported

Zyxel Multiple Firewalls OS Command Injection Vulnerability

A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

ZyxelMultiple Firewalls

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-16
Due: 2022-06-06
Priority interval: 91.8–95.3
Coverage: 95%

↗

1094

CVE-2022-22947CISA KEVSource-reported scopeEvidence supported

VMware Spring Cloud Gateway Code Injection Vulnerability

Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

VMwareSpring Cloud Gateway

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-16
Due: 2022-06-06
Priority interval: 91.8–92.5
Coverage: 99%

↗

1095

CVE-2022-1388CISA KEVKnown ransomwareSource-reported scopeEvidence supported

F5 BIG-IP Missing Authentication Vulnerability

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

F5BIG-IP

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-10
Due: 2022-05-31
Priority interval: 91.0–91.9
Coverage: 100%

↗

1096

CVE-2014-0160CISA KEVSource-reported scopeEvidence supported

OpenSSL Information Disclosure Vulnerability

The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.

OpenSSLOpenSSL

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-04
Due: 2022-05-25
Priority interval: 90.4–90.6
Coverage: 100%

↗

1097

CVE-2014-0322CISA KEVSource-reported scopeEvidence supported

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.

MicrosoftInternet Explorer

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-04
Due: 2022-05-25
Priority interval: 83.1–84.6
Coverage: 95%

↗

1098

CVE-2014-4113CISA KEVSource-reported scopeEvidence supported

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

MicrosoftWin32k

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-04
Due: 2022-05-25
Priority interval: 82.8–83.6
Coverage: 99%

↗

1099

CVE-2019-8506CISA KEVSource-reported scopeEvidence supported

Apple Multiple Products Type Confusion Vulnerability

A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

AppleMultiple Products

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-04
Due: 2022-05-25
Priority interval: 76.8–79.7
Coverage: 94%

↗

1100

CVE-2021-1789CISA KEVSource-reported scopeEvidence supported

Apple Multiple Products Type Confusion Vulnerability

A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

AppleMultiple Products

Required actionApply updates per vendor instructions.

Evidence reason details

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Added: 2022-05-04
Due: 2022-05-25
Priority interval: 76.5–78.8
Coverage: 98%

↗