The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
10 Nov 2026 Cisco BroadWorks XML external entity
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco broadworks application delivery platform ri.2026.07, cisco broadworks profile server 2026.07, cisco broadworks xtended services platform 2026.07, cisco broadworks application server 2026.0
- CISA due date
- 24 Nov 2026 (still open)
- Weakness
- CWE-611
10 Nov 2026 Google Chromium Memory corruption
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 157.0.8103.50
- CISA due date
- 24 Nov 2026 (still open)
- Weakness
- CWE-416
10 Nov 2026 Microsoft Office Security flaw
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Nov 2026 (still open)
- Weakness
- CWE-356
10 Nov 2026 Barracuda Networks Barracuda Email Security Gateway (ESG) Authentication bypass
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- barracuda email security gateway 900 firmware 9.4.0.030, barracuda email security gateway 800 firmware 9.4.0.030, barracuda email security gateway 600 firmware 9.4.0.030, barracuda email security gateway 400 firmware 9.4.0.030, barracuda email security gateway 300 firmware 9.4.0.030
- CISA due date
- 13 Nov 2026 (still open)
- Weakness
- CWE-288
On Hacker News
Barracuda ESG pre-auth remote root (CVE-2026-116606)10 Nov 2026 Openwave Messaging Limited Webtop Media Transcoder Security flaw
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- openwave webtop media transcoder 1.1.22.0
- CISA due date
- 24 Nov 2026 (still open)
- Weakness
- CWE-669
10 Nov 2026 Barracuda Networks Multiple Products Command injection
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- barracuda email security gateway 900 firmware 9.4.0.029, barracuda email security gateway 800 firmware 9.4.0.029, barracuda email security gateway 600 firmware 9.4.0.029, barracuda email security gateway 400 firmware 9.4.0.029, barracuda email security gateway 300 firmware 9.4.0.029 and 4 older
- CISA due date
- 13 Nov 2026 (still open)
- Weakness
- CWE-78
On Hacker News
Barracuda ESG pre-auth remote root (CVE-2026-116606)9 Nov 2026 IBM Aspera Faspex Access control flaw
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ibm aspera faspex 5.0.19.1
- CISA due date
- 12 Nov 2026 (still open)
- Weakness
- CWE-863
9 Nov 2026 OpenBSD OpenSSH Security flaw
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- openbsd openssh 10.6
- CISA due date
- 12 Nov 2026 (still open)
- Weakness
- CWE-394
9 Nov 2026 SignalWire FreeSwitch Command injection
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- freeswitch 1.11.3
- CISA due date
- 12 Nov 2026 (still open)
- Weakness
- CWE-77, CWE-78, CWE-749
9 Nov 2026 GPUStack Authentication bypass
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gpustack 2.2.0
- CISA due date
- 12 Nov 2026 (still open)
- Weakness
- CWE-287, CWE-290, CWE-346
6 Nov 2026 SonicWall SonicOS SSLVPN Security flaw
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sonicos 8.2.2-8015, sonicwall sonicos 7.3.4-7015
- CISA due date
- 20 Nov 2026 (still open)
- Weakness
- CWE-308
On Hacker News
SonicWall SonicOS SSLVPN auth bypass (CVE-2026-19868)4 Nov 2026 Apple Multiple Products Authentication bypass
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple safari 17.5, apple ipados 17.5, apple iphone os 17.5, apple tvos 17.5, apple ipados 16.7.8 and 5 older
- CISA due date
- 18 Nov 2026 (still open)
- Weakness
- CWE-287
3 Nov 2026 WordPress Core Race condition
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 5.8.19, wordpress 5.7.21, wordpress 5.6.23, wordpress 5.5.24, wordpress 5.4.25 and 7 older
- CISA due date
- 6 Nov 2026
- Weakness
- CWE-367
30 Oct 2026 Ivanti Connect Secure Security flaw
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti connect secure 25.1.1.3
- CISA due date
- 13 Nov 2026 (still open)
- Weakness
- CWE-340
30 Oct 2026 Ivanti Connect Secure Authentication bypass
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti connect secure 25.1.1.3
- CISA due date
- 2 Nov 2026
- Weakness
- CWE-306, CWE-862, CWE-345
29 Oct 2026 GitLab Community Edition and Enterprise Edition Memory corruption
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 19.4.2, gitlab 19.3.5, gitlab 19.2.8, ruby-lang ruby 4.0.8, ruby-lang ruby 3.4.12 and 1 older
- CISA due date
- 1 Nov 2026
- Weakness
- CWE-190
29 Oct 2026 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Security flaw
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco secure firewall threat defense 10.0.3, cisco adaptive security appliance software 9.24.1.27, cisco adaptive security appliance software 9.23.1.48, cisco adaptive security appliance software 9.22.3.200, cisco adaptive security appliance software 9.20.4.50 and 6 older
- CISA due date
- 1 Nov 2026
- Weakness
- CWE-690
28 Oct 2026 Linux Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 7.0.10, linux kernel 6.18.33, linux kernel 6.12.91, linux kernel 6.6.141, linux kernel 6.1.174 and 7 older
- CISA due date
- 31 Oct 2026
- Weakness
- CWE-456
28 Oct 2026 Broadcom VMware ESX Security flaw
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware esxi 9.0.2.0100
- CISA due date
- 11 Nov 2026
- Weakness
- CWE-778
27 Oct 2026 Adobe Commerce and Magento Malicious file upload
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe i\/o events 1.21.0
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-434
27 Oct 2026 Google Brotli Memory corruption
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- nodejs node.js 26.12.1, nodejs node.js 24.22.1, nodejs node.js 22.23.4, microsoft .net 10.0.14, microsoft .net 9.0.22 and 7 older
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-252, CWE-787
26 Oct 2026 PHP Group PHP Memory corruption
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 12.1.4, paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.4, paloaltonetworks pan-os 10.2.7 and 4 older
- CISA due date
- 29 Oct 2026
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
26 Oct 2026 PHP Group PHP Memory corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 12.1.4, paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.4, paloaltonetworks pan-os 10.2.7 and 4 older
- CISA due date
- 29 Oct 2026
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
23 Oct 2026 Arista VeloCloud Orchestrator SQL injection
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- arista velocloud orchestrator 6.4.2.12, arista velocloud orchestrator 6.1.3.10, arista velocloud orchestrator 5.2.3.18
- CISA due date
- 26 Oct 2026
- Weakness
- CWE-89
23 Oct 2026 Collabora Online – Built-in CODE Server Command injection
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- collabora online - built-in code server 26.4.303
- CISA due date
- 26 Oct 2026
- Weakness
- CWE-78
20 Oct 2026 Plex Media Server Path traversal
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- plex media server 1.43.3.10861
- CISA due date
- 23 Oct 2026
- Weakness
- CWE-73
20 Oct 2026 Plex Media Server Server-side request forgery
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- plex media server 1.43.3.10861
- CISA due date
- 3 Nov 2026
- Weakness
- CWE-918
20 Oct 2026 Plex Media Server Cross-site scripting
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- plex media server 1.43.3.10861
- CISA due date
- 23 Oct 2026
- Weakness
- CWE-84
20 Oct 2026 Plex Media Server Server-side request forgery
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- plex media server 1.43.3.10861
- CISA due date
- 3 Nov 2026
- Weakness
- CWE-918
20 Oct 2026 Siemens Software Center Security flaw
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- siemens software center 4.0.9.8
- CISA due date
- 3 Nov 2026
- Weakness
- CWE-427
20 Oct 2026 EG Secure Solutions SiteGuard Server Edition Command injection
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- e-guardian siteguard 8.00, e-guardian siteguard 7.00, e-guardian siteguard 3.10
- CISA due date
- 23 Oct 2026
- Weakness
- CWE-78
16 Oct 2026 BeyondTrust Remote Support Authentication bypass
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 19 Oct 2026
- Weakness
- CWE-290
16 Oct 2026 Fortinet Multiple Products Path traversal
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortios 7.6.5, fortinet fortiproxy 7.6.5, fortinet fortiproxy 7.4.12, fortinet fortios 7.4.10, fortinet fortiswitchmanager 7.2.8 and 2 older
- CISA due date
- 19 Oct 2026
- Weakness
- CWE-22
15 Oct 2026 Atlassian Multiple Products Access control flaw
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- atlassian jira data center 11.3.12, atlassian bitbucket data center 10.5.1, atlassian jira data center 10.3.26, atlassian confluence data center 10.2.19, atlassian bitbucket data center 10.2.8 and 7 older
- CISA due date
- 18 Oct 2026
- Weakness
- CWE-552
14 Oct 2026 Cisco Secure Email Gateway Path traversal
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco asyncos 16.5.0-780, cisco asyncos 15.5.5-014
- CISA due date
- 17 Oct 2026
- Weakness
- CWE-23
14 Oct 2026 AhsayCBS Command injection
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ahsay cloud backup suite 10.3.4.45, ahsay cloud backup suite 9.15.2.70
- CISA due date
- 17 Oct 2026
- Weakness
- CWE-77, CWE-78
14 Oct 2026 AhsayCBS Authentication bypass
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ahsay cloud backup suite 10.3.4.45, ahsay cloud backup suite 9.15.2.70
- CISA due date
- 17 Oct 2026
- Weakness
- CWE-287
14 Oct 2026 Palo Alto Networks PAN-OS Remote code execution
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 10.2.0
- CISA due date
- 17 Oct 2026
- Weakness
- CWE-94
13 Oct 2026 Microsoft Windows Command injection
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.5761, microsoft windows server 2019 10.0.17763.9376, microsoft windows server 2016 10.0.14393.9612, microsoft windows 11 26h2 10.0.26300.9711, microsoft windows 11 26h1 10.0.28000.3231 and 7 older
- CISA due date
- 16 Oct 2026
- Weakness
- CWE-77
13 Oct 2026 Ivanti Connect Secure Authentication bypass
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti connect secure 25.1.3.0, ivanti connect secure 25.1.1.2
- CISA due date
- 16 Oct 2026
- Weakness
- CWE-290
8 Oct 2026 Strapi Information disclosure
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- strapi 4.8.0
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-312
8 Oct 2026 ONLYOFFICE Docs Path traversal
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- onlyoffice document server 5.6.3
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-22
8 Oct 2026 Apache Struts Command injection
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apache struts 2.3.28.1, apache struts 2.3.24.3, apache struts 2.3.20.3
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-77
8 Oct 2026 ISC BIND Denial of service
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- juniper junos 13.2, juniper junos 12.1, isc bind 9.10.2, isc bind 9.9.7, hpe vcx 9.8.18
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-19
8 Oct 2026 ProFTPD Access control flaw
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-284
4 Oct 2026 Citrix NetScaler Memory corruption
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.41, citrix netscaler gateway 14.1-73.41, citrix netscaler application delivery controller 13.1-64.28, citrix netscaler gateway 13.1-64.28, citrix netscaler application delivery controller 13.1-37.282
- CISA due date
- 7 Oct 2026
- Weakness
- CWE-119
2 Oct 2026 Zammad GmbH Zammad Privilege escalation
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- zammad 7.2.2
- CISA due date
- 5 Oct 2026
- Weakness
- CWE-269
2 Oct 2026 Zammad GmbH Zammad Security flaw
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Oct 2026
- Weakness
- CWE-384
1 Oct 2026 Fortinet FortiMail Path traversal
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortimail 8.0.2, fortinet fortimail 7.6.7, fortinet fortimail 7.4.9
- CISA due date
- 4 Oct 2026
- Weakness
- CWE-22, CWE-158
30 Sep 2026 Cisco Catalyst SD-WAN Manager Security flaw
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco catalyst sd-wan manager 26.1.2.1, cisco catalyst sd-wan manager 20.18.4.1, cisco catalyst sd-wan manager 20.15.6.1, cisco catalyst sd-wan manager 20.12.8.2, cisco catalyst sd-wan manager 20.9.10.1
- CISA due date
- 3 Oct 2026
- Weakness
- CWE-177
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.