ByteOS

Product:Flash Player

Added At:25 Mar, 2022

Due At:15 Apr, 2022

Adobe Flash Player Remote Code Execution Vulnerability

Unspecified vulnerability in Adobe Flash Player allows for remote code execution.

Used in Ransomware

Unknown

CWE

N/A

Required Action:

The impacted product is end-of-life and should be disconnected if still in use.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2016-4171

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:16 Jun, 2016 | 14:00

Updated At:17 Nov, 2025 | 19:40

▼CVE Numbering Authority (CNA)

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://security.gentoo.org/glsa/201606-08	vendor-advisory x_refsource_GENTOO
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html	vendor-advisory x_refsource_SUSE
https://www.kb.cert.org/vuls/id/748992	third-party-advisory x_refsource_CERT-VN
https://access.redhat.com/errata/RHSA-2016:1238	vendor-advisory x_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html	vendor-advisory x_refsource_SUSE
http://www.securitytracker.com/id/1036094	vdb-entry x_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html	vendor-advisory x_refsource_SUSE
http://www.securityfocus.com/bid/91184	vdb-entry x_refsource_BID
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html	x_refsource_CONFIRM

Hyperlink: https://security.gentoo.org/glsa/201606-08

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-03.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://www.kb.cert.org/vuls/id/748992

Resource:

third-party-advisory

x_refsource_CERT-VN

Hyperlink: https://access.redhat.com/errata/RHSA-2016:1238

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://www.securitytracker.com/id/1036094

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://www.securityfocus.com/bid/91184

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-18.html

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://security.gentoo.org/glsa/201606-08	vendor-advisory x_refsource_GENTOO x_transferred
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html	x_refsource_CONFIRM x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html	vendor-advisory x_refsource_SUSE x_transferred
https://www.kb.cert.org/vuls/id/748992	third-party-advisory x_refsource_CERT-VN x_transferred
https://access.redhat.com/errata/RHSA-2016:1238	vendor-advisory x_refsource_REDHAT x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html	vendor-advisory x_refsource_SUSE x_transferred
http://www.securitytracker.com/id/1036094	vdb-entry x_refsource_SECTRACK x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html	vendor-advisory x_refsource_SUSE x_transferred
http://www.securityfocus.com/bid/91184	vdb-entry x_refsource_BID x_transferred
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html	x_refsource_CONFIRM x_transferred

Hyperlink: https://security.gentoo.org/glsa/201606-08

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-03.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://www.kb.cert.org/vuls/id/748992

Resource:

third-party-advisory

x_refsource_CERT-VN

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2016:1238

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://www.securitytracker.com/id/1036094

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://www.securityfocus.com/bid/91184

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-18.html

Resource:

x_refsource_CONFIRM

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-03-25

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171	government-resource
https://github.com/cisagov/vulnrichment/issues/196	issue-tracking

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171

Resource:

government-resource

Hyperlink: https://github.com/cisagov/vulnrichment/issues/196

Resource:

issue-tracking

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:16 Jun, 2016 | 14:59

Updated At:21 Apr, 2026 | 21:07

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-03-25	2022-04-15	Adobe Flash Player Remote Code Execution Vulnerability	The impacted product is end-of-life and should be disconnected if still in use.

Date Added: 2022-03-25

Due Date: 2022-04-15

Vulnerability Name: Adobe Flash Player Remote Code Execution Vulnerability

Required Action: The impacted product is end-of-life and should be disconnected if still in use.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*

>>flash_player>>Versions up to 11.2.202.621(inclusive)

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*

>>flash_player>>Versions up to 21.0.0.242(inclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>mac_os_x>>*

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

>>windows>>*

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>mac_os_x>>*

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>*

Google LLC

>>chrome_os>>*

cpe:2.3:o:google:chrome_os:*:*:*:*:*:*:*:*

Linux Kernel Organization, Inc

>>linux_kernel>>*

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

>>windows>>*

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*

>>flash_player>>Versions up to 21.0.0.242(inclusive)

cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*

>>windows_8.1>>*

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*

>>flash_player>>Versions up to 21.0.0.242(inclusive)

cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*

>>flash_player>>Versions up to 18.0.0.352(inclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>mac_os_x>>*

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

>>windows>>*

cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*

>>windows_10>>*

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*

>>flash_player>>Versions up to 21.0.0.242(inclusive)

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*

>>flash_player>>Versions up to 21.0.0.242(inclusive)

cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

>>enterprise_linux_desktop>>5.0

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

>>enterprise_linux_desktop>>6.0

cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*

>>enterprise_linux_server>>5.0

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

>>enterprise_linux_server>>6.0

cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

>>enterprise_linux_workstation>>5.0

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

>>enterprise_linux_workstation>>6.0

openSUSE

>>opensuse>>13.1

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

openSUSE

>>opensuse>>13.2

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*

>>linux_enterprise_desktop>>12

cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*

>>linux_enterprise_desktop>>12

cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*

>>linux_enterprise_workstation_extension>>12

cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*

>>linux_enterprise_workstation_extension>>12

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html	psirt@adobe.com	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html	psirt@adobe.com	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html	psirt@adobe.com	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/91184	psirt@adobe.com	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036094	psirt@adobe.com	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2016:1238	psirt@adobe.com	Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html	psirt@adobe.com	Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html	psirt@adobe.com	Vendor Advisory
https://security.gentoo.org/glsa/201606-08	psirt@adobe.com	Third Party Advisory
https://www.kb.cert.org/vuls/id/748992	psirt@adobe.com	Third Party Advisory US Government Resource
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/91184	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036094	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2016:1238	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://security.gentoo.org/glsa/201606-08	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.kb.cert.org/vuls/id/748992	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
https://github.com/cisagov/vulnrichment/issues/196	134c704f-9b21-4f2e-91b3-4a467353bcc0	Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html

Source: psirt@adobe.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html

Source: psirt@adobe.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html

Source: psirt@adobe.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/91184

Source: psirt@adobe.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1036094

Source: psirt@adobe.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://access.redhat.com/errata/RHSA-2016:1238

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-03.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-18.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/201606-08

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: https://www.kb.cert.org/vuls/id/748992

Source: psirt@adobe.com

Resource:

Third Party Advisory

US Government Resource

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/91184

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1036094

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://access.redhat.com/errata/RHSA-2016:1238

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-03.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-18.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/201606-08

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://www.kb.cert.org/vuls/id/748992

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

US Government Resource

Hyperlink: https://github.com/cisagov/vulnrichment/issues/196

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

Issue Tracking

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

US Government Resource

Similar CVEs

7423Records found

CVE-2022-20390

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-9.8||CRITICAL

EPSS-0.15% / 35.38%

7 Day CHG~0.00%

Published-13 Sep, 2022 | 19:14

Updated-03 Aug, 2024 | 02:10

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002

Vendor-n/a Google LLC

Product-android Android

CVE-2010-1760

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.22% / 79.41%

7 Day CHG~0.00%

Published-19 Aug, 2010 | 20:00

Updated-29 Apr, 2026 | 01:13

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150.

Vendor-n/a Apple Inc.

Product-webkit n/a

CVE-2021-39616

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-9.8||CRITICAL

EPSS-0.32% / 55.61%

7 Day CHG~0.00%

Published-11 Feb, 2022 | 17:40

Updated-04 Aug, 2024 | 02:13

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438

Vendor-n/a Google LLC

Product-android Android

CVE-2010-1233

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-1.83% / 83.28%

7 Day CHG~0.00%

Published-01 Apr, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Multiple integer overflows in Google Chrome before 4.1.249.1036 allow remote attackers to have an unspecified impact via vectors involving WebKit JavaScript objects.

Vendor-n/a Google LLC

Product-chrome n/a

CVE-2021-38656

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-8.19% / 92.37%

7 Day CHG~0.00%

Published-15 Sep, 2021 | 11:24

Updated-04 Aug, 2024 | 01:51

Microsoft Word Remote Code Execution Vulnerability

Product-365_apps Microsoft 365 Apps for Enterprise

CWE ID-CWE-416

Use After Free

CVE-2016-6980

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.65% / 86.08%

7 Day CHG~0.00%

Published-26 Sep, 2016 | 17:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4263.

Vendor-n/a Adobe Inc.

Product-digital_editions n/a

CWE ID-CWE-416

Use After Free

CVE-2010-1378

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.23% / 45.74%

7 Day CHG~0.00%

Published-15 Nov, 2010 | 22:00

Updated-29 Apr, 2026 | 01:13

OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication via an arbitrary certificate issued by a legitimate Certification Authority.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

CWE ID-CWE-295

Improper Certificate Validation

CVE-2016-6944

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.65% / 86.08%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-1091, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc n/a

CWE ID-CWE-416

Use After Free

CVE-2023-23536

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 46.01%

7 Day CHG~0.00%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 16:15

The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-ipados iphone_os macos iOS and iPadOS watchOS macOS tvOS

CVE-2023-23540

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.08% / 22.78%

7 Day CHG~0.00%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 16:15

The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.4, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-ipados iphone_os macos iOS and iPadOS macOS

CVE-2010-1205

Matching Score-8

Assigner-MITRE Corporation

Vendor-libpng n/a Canonical Ltd.Apple Inc.openSUSE Google LLC SUSE Mozilla Corporation Debian GNU/Linux VMware (Broadcom Inc.)Fedora Project

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-14.82% / 94.65%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-29 Apr, 2026 | 01:13

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.

Product-thunderbird debian_linux ubuntu_linux seamonkey mac_os_x linux_enterprise_server fedora chrome mac_os_x_server workstation itunes firefox player libpng iphone_os safari opensuse n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-38647

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-94.39% / 99.97%

7 Day CHG~0.00%

Published-15 Sep, 2021 | 11:24

Updated-30 Oct, 2025 | 19:13

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

Open Management Infrastructure Remote Code Execution Vulnerability

CVE-2010-1230

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.30% / 53.74%

7 Day CHG~0.00%

Published-01 Apr, 2010 | 22:00

Updated-29 Apr, 2026 | 01:13

Google Chrome before 4.1.249.1036 does not have the expected behavior for attempts to delete Web SQL Databases and clear the Strict Transport Security (STS) state, which has unspecified impact and attack vectors.

Vendor-n/a Google LLC

Product-chrome n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-12813

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-20.96% / 95.76%

7 Day CHG~0.00%

Published-17 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:45

Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Adobe Inc.

Product-digital_editions Adobe Digital Editions

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-1228

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.25% / 48.26%

7 Day CHG~0.00%

Published-01 Apr, 2010 | 22:00

Updated-29 Apr, 2026 | 01:13

Multiple race conditions in the sandbox infrastructure in Google Chrome before 4.1.249.1036 have unspecified impact and attack vectors.

Vendor-n/a Google LLC

Product-chrome n/a

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2022-47211

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-2.00% / 83.98%

7 Day CHG~0.00%

Published-13 Dec, 2022 | 00:00

Updated-22 Jul, 2025 | 17:49

Microsoft Office Graphics Remote Code Execution Vulnerability

Product-365_apps Microsoft 365 Apps for Enterprise

CVE-2015-8413

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-68.38% / 98.62%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-7630

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-20.93% / 95.76%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7633, and CVE-2015-7634.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-7009

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.02% / 86.91%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2023-23401

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-1.25% / 79.73%

7 Day CHG~0.00%

Published-14 Mar, 2023 | 16:55

Updated-01 Jan, 2025 | 00:48

Windows Media Remote Code Execution Vulnerability

CWE ID-CWE-681

Incorrect Conversion between Numeric Types

CVE-2012-3503

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 80.13%

7 Day CHG~0.00%

Published-25 Aug, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

Vendor-n/a The Foreman Red Hat, Inc.

Product-enterprise_linux_server katello n/a

CWE ID-CWE-798

Use of Hard-coded Credentials

CVE-2015-8409

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-2.62% / 85.96%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows iphone_os flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-8403

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-15.42% / 94.79%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-8408

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.54% / 90.45%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8428

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-77.92% / 99.03%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows flash_player iphone_os air_sdk android linux_kernel air_sdk_\&_compiler n/a

CVE-2021-38654

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-8.19% / 92.37%

7 Day CHG~0.00%

Published-15 Sep, 2021 | 11:24

Updated-04 Aug, 2024 | 01:51

Microsoft Office Visio Remote Code Execution Vulnerability

Product-365_apps office Microsoft 365 Apps for Enterprise Microsoft Office 2019

CWE ID-CWE-129

Improper Validation of Array Index

CVE-2015-8432

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-12.87% / 94.19%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows iphone_os flash_player air_sdk android linux_kernel air_sdk_\&_compiler n/a

CVE-2012-2864

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-10||HIGH

EPSS-5.70% / 90.60%

7 Day CHG~0.00%

Published-22 Aug, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, allows remote attackers to execute arbitrary code via unspecified vectors that trigger an "array overflow."

Vendor-n/a Samsung Acer Inc.Google LLC

Product-series_5_chromebook ac700_chromebook series_5_550_chromebook cr-48_chromebook chrome_os n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1988

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-7.15% / 91.73%

7 Day CHG~0.00%

Published-20 May, 2010 | 17:00

Updated-29 Apr, 2026 | 01:13

Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via JavaScript code that performs certain string concatenation and substring operations, a different vulnerability than CVE-2009-1571.

Vendor-n/a Mozilla Corporation Microsoft Corporation

Product-firefox windows_xp n/a

CVE-2019-20530

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.07% / 21.75%

7 Day CHG~0.00%

Published-24 Mar, 2020 | 17:39

Updated-05 Aug, 2024 | 02:46

An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), P(9.0), and Q(10.0) software. Arbitrary code execution is possible on the lock screen. The Samsung ID is SVE-2019-15266 (December 2019).

Vendor-n/a Google LLC

Product-android n/a

CWE ID-CWE-345

Insufficient Verification of Data Authenticity

CVE-2016-6978

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.02% / 86.91%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-1985

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||CRITICAL

EPSS-3.23% / 87.34%

7 Day CHG~0.00%

Published-30 Jan, 2016 | 15:00

Updated-06 May, 2026 | 22:30

HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Vendor-n/a HP Inc.Microsoft Corporation

Product-operations_manager windows n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2016-6942

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.02% / 86.91%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7639

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.37% / 91.88%

7 Day CHG~0.00%

Published-18 Oct, 2015 | 10:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2010-1118

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-36.59% / 97.23%

7 Day CHG~0.00%

Published-25 Mar, 2010 | 20:31

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.

Vendor-n/a Microsoft Corporation

Product-internet_explorer windows_7 n/a

CVE-2021-38661

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-1.11% / 78.50%

7 Day CHG~0.00%

Published-15 Sep, 2021 | 11:24

Updated-04 Aug, 2024 | 01:51

HEVC Video Extensions Remote Code Execution Vulnerability

Product-hevc_video_extensions HEVC Video Extensions

CVE-2010-1809

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.86% / 75.38%

7 Day CHG~0.00%

Published-09 Sep, 2010 | 21:00

Updated-29 Apr, 2026 | 01:13

The Accessibility component in Apple iOS before 4.1 on the iPhone and iPod touch does not perform the expected VoiceOver announcement associated with the location services icon, which has unspecified impact and attack vectors.

Vendor-n/a Apple Inc.

Product-ipod_touch iphone_os n/a

CVE-2015-7637

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.37% / 91.88%

7 Day CHG~0.00%

Published-18 Oct, 2015 | 10:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player air_sdk android air linux_kernel n/a

CVE-2024-9956

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-7.8||HIGH

EPSS-0.02% / 5.88%

7 Day CHG~0.00%

Published-15 Oct, 2024 | 20:14

Updated-03 Nov, 2025 | 21:18

Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Google LLC

Product-android chrome Chrome chrome

CVE-2015-7642

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.37% / 91.88%

7 Day CHG~0.00%

Published-18 Oct, 2015 | 10:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2010-1229

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.43% / 62.99%

7 Day CHG~0.00%

Published-01 Apr, 2010 | 22:00

Updated-29 Apr, 2026 | 01:13

The sandbox infrastructure in Google Chrome before 4.1.249.1036 does not properly use pointers, which has unspecified impact and attack vectors.

Vendor-n/a Google LLC

Product-chrome n/a

CVE-2023-23415

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.89% / 89.80%

7 Day CHG~0.00%

Published-14 Mar, 2023 | 16:55

Updated-01 Jan, 2025 | 00:48

Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability

Product-windows_10_21h2 windows_10_1809 windows_server_2016 windows_server_2012 windows_server_2008 windows_10_1507 windows_11_21h2 windows_10_22h2 windows_server_2022 windows_10_20h2 windows_11_22h2 windows_server_2019 windows_10_1607 Windows Server 2022 Windows 10 Version 1607 Windows 11 version 22H2 Windows Server 2019 (Server Core installation)Windows Server 2008 Service Pack 2 Windows 10 Version 1809 Windows Server 2016 (Server Core installation)Windows 11 version 21H2 Windows Server 2012 (Server Core installation)Windows 10 Version 20H2 Windows Server 2016 Windows 10 Version 1507 Windows 10 Version 21H2 Windows Server 2008 R2 Service Pack 1 Windows Server 2008 Service Pack 2 (Server Core installation)Windows Server 2008 R2 Service Pack 1 (Server Core installation)Windows Server 2012 R2 Windows Server 2019 Windows Server 2012 Windows Server 2008 Service Pack 2 Windows Server 2012 R2 (Server Core installation)Windows 10 Version 22H2

CWE ID-CWE-122

Heap-based Buffer Overflow

CVE-2015-8064

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-15.42% / 94.79%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows iphone_os flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2016-6946

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.65% / 86.08%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc n/a

CWE ID-CWE-416

Use After Free

CVE-2015-8435

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-12.87% / 94.19%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2010-1297

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-92.84% / 99.78%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 18:00

Updated-21 Apr, 2026 | 21:12

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Vendor-n/a Microsoft Corporation openSUSE SUSE Adobe Inc.Apple Inc.

Product-acrobat mac_os_x linux_enterprise windows flash_player air opensuse n/a Flash Player

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-39052

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.6||MEDIUM

EPSS-0.51% / 66.62%

7 Day CHG~0.00%

Published-13 Dec, 2021 | 17:55

Updated-17 Sep, 2024 | 00:01

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-spectrum_copy_data_management linux_kernel Spectrum Copy Data Management

CVE-2015-8417

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-11.15% / 93.64%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8426

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-77.92% / 99.03%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows flash_player iphone_os air_sdk android linux_kernel air_sdk_\&_compiler n/a

CVE-2015-8423

Matching Score-8

Matching Score-8