The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
18 Aug 2026 Broadcom VMware vCenter Path traversal
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware vcenter server 9.1.0.0300, vmware vcenter server 9.0.2.0100, vmware vcenter server 8.0
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-22
On Hacker News
Patch-diffing VMware vCenter to auth bypass and RCE5 Aug 2026 JetBrains TeamCity Remote code execution
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jetbrains teamcity 2026.1.3, jetbrains teamcity 2025.11.7
- CISA due date
- 8 Aug 2026
- Weakness
- CWE-502
29 Jul 2026 Cisco Secure Firewall Management Center (FMC) Security flaw
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 1 Aug 2026
- Weakness
- CWE-259
14 Jul 2026 SonicWall SMA1000 Appliances Remote code execution
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-94
14 Jul 2026 SonicWall SMA1000 Appliances Server-side request forgery
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-918
On Hacker News
CVE-2026-15409: SonicWall SMA 1000 SSRF Zero-Day1 Jul 2026 Microsoft SharePoint Server Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20280
- CISA due date
- 4 Jul 2026
- Weakness
- CWE-502
25 Jun 2026 PTC Windchill and FlexPLM Remote code execution
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ptc windchill pdmlink 11.0m030
- CISA due date
- 28 Jun 2026
- Weakness
- CWE-20, CWE-502
12 Jun 2026 Oracle PeopleSoft Enterprise PeopleTools Authentication bypass
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 15 Jun 2026
- Weakness
- CWE-306
8 Jun 2026 Check Point Security Gateway Authentication bypass
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- checkpoint gaia embedded r82.00.10, checkpoint gaia os r81.20, checkpoint gaia embedded r81.10.17
- CISA due date
- 11 Jun 2026
- Weakness
- CWE-287
29 May 2026 Palo Alto Networks PAN-OS Security flaw
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 10.2.7
- CISA due date
- 1 Jun 2026
- Weakness
- CWE-565
27 May 2026 Nx Console Security flaw
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Jun 2026
- Weakness
- CWE-506
27 May 2026 TanStack Security flaw
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Jun 2026
- Weakness
- CWE-506
30 Apr 2026 WebPros cPanel & WHM and WP2 (WordPress Squared) Authentication bypass
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cpanel 136.0.5, cpanel 134.0.20, cpanel 132.0.29, cpanel 130.0.19, cpanel 126.0.54 and 7 older
- CISA due date
- 3 May 2026
- Weakness
- CWE-306
28 Apr 2026 ConnectWise ScreenConnect Path traversal
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- connectwise screenconnect 23.9.8
- CISA due date
- 12 May 2026
- Weakness
- CWE-22
24 Apr 2026 SimpleHelp SimpleHelp Path traversal
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- simple-help simplehelp 5.5.8
- CISA due date
- 8 May 2026
- Weakness
- CWE-22
24 Apr 2026 SimpleHelp SimpleHelp Access control flaw
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- simple-help simplehelp 5.5.8
- CISA due date
- 8 May 2026
- Weakness
- CWE-862
22 Apr 2026 Microsoft Defender Access control flaw
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft defender antimalware platform 4.18.26030.3011
- CISA due date
- 6 May 2026
- Weakness
- CWE-1220
20 Apr 2026 JetBrains TeamCity Path traversal
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jetbrains teamcity 2023.11.4
- CISA due date
- 4 May 2026
- Weakness
- CWE-23
20 Apr 2026 PaperCut NG/MF Authentication bypass
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- papercut mf 22.0.9, papercut ng 22.0.9, papercut mf 21.2.11, papercut ng 21.2.11, papercut mf 20.1.7 and 1 older
- CISA due date
- 4 May 2026
- Weakness
- CWE-287
13 Apr 2026 Microsoft Windows Path traversal
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7392, microsoft windows 11 25h2 10.0.26200.7392, microsoft windows 11 24h2 10.0.26100.7392
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-59
13 Apr 2026 Microsoft Exchange Server Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-502
19 Mar 2026 Cisco Secure Firewall Management Center (FMC) Remote code execution
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 22 Mar 2026
- Weakness
- CWE-502
9 Mar 2026 SolarWinds Web Help Desk Remote code execution
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 12 Mar 2026
- Weakness
- CWE-502
13 Feb 2026 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) Command injection
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- beyondtrust remote support 25.3.2, beyondtrust privileged remote access 25.1
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-78
5 Feb 2026 SmarterTools SmarterMail Authentication bypass
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- smartertools smartermail 100.0.9511
- CISA due date
- 26 Feb 2026
- Weakness
- CWE-306
26 Jan 2026 SmarterTools SmarterMail Authentication bypass
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- smartertools smartermail 100.0.9511
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-288
26 Jan 2026 SmarterTools SmarterMail Malicious file upload
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- smartertools smartermail 100.0.9413
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-434
19 Dec 2025 WatchGuard Firebox Memory corruption
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- watchguard fireware 2025.1.4, watchguard fireware 12.11.6, watchguard fireware 12.5.15
- CISA due date
- 26 Dec 2025
- Weakness
- CWE-787
5 Dec 2025 Meta React Server Components Remote code execution
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vercel next.js 16.0.7, vercel next.js 15.5.7, vercel next.js 15.4.8, vercel next.js 15.3.6, vercel next.js 15.2.6 and 2 older
- CISA due date
- 12 Dec 2025
- Weakness
- CWE-502
20 Oct 2025 Oracle E-Business Suite Authentication bypass
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-918
6 Oct 2025 Oracle E-Business Suite Authentication bypass
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
- Weakness
- CWE-287
6 Oct 2025 Microsoft Windows Security flaw
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.2366, microsoft windows server 2016 10.0.14393.4825, microsoft windows server 2004 10.0.19041.1415, microsoft windows 11 21h2 10.0.22000.376, microsoft windows 10 2004 10.0.19041.1415 and 7 older
- CISA due date
- 27 Oct 2025
29 Sep 2025 Fortra GoAnywhere MFT Remote code execution
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortra goanywhere managed file transfer 7.8.4, fortra goanywhere managed file transfer 7.6.3
- CISA due date
- 20 Oct 2025
- Weakness
- CWE-502, CWE-77
12 Aug 2025 RARLAB WinRAR Path traversal
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- dtsearch 2023.01, rarlab winrar 7.13
- CISA due date
- 2 Sep 2025
- Weakness
- CWE-35
22 Jul 2025 Microsoft SharePoint Authentication bypass
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.18526.20424
- CISA due date
- 23 Jul 2025
- Weakness
- CWE-287
22 Jul 2025 Microsoft SharePoint Remote code execution
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Jul 2025
- Weakness
- CWE-94
20 Jul 2025 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.18526.20508
- CISA due date
- 21 Jul 2025
- Weakness
- CWE-502
10 Jul 2025 Citrix NetScaler ADC and Gateway Memory corruption
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-43.56, citrix netscaler gateway 14.1-43.56, citrix netscaler application delivery controller 13.1-58.32, citrix netscaler gateway 13.1-58.32, citrix netscaler application delivery controller 13.1-37.235 and 1 older
- CISA due date
- 11 Jul 2025
- Weakness
- CWE-125
25 Jun 2025 Fortinet FortiOS Authentication bypass
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Jul 2025
- Weakness
- CWE-798
15 May 2025 SAP NetWeaver Remote code execution
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Jun 2025
- Weakness
- CWE-502
5 May 2025 Langflow Remote code execution
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- langflow 1.3.0
- CISA due date
- 26 May 2025
- Weakness
- CWE-306
29 Apr 2025 SAP NetWeaver Malicious file upload
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 20 May 2025
- Weakness
- CWE-434
8 Apr 2025 Microsoft Windows Memory corruption
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1551, microsoft windows server 2022 10.0.20348.3453, microsoft windows server 2019 10.0.17763.7136, microsoft windows server 2016 10.0.14393.7969, microsoft windows 11 24h2 10.0.26100.3775 and 7 older
- CISA due date
- 29 Apr 2025
- Weakness
- CWE-416
7 Apr 2025 CrushFTP Authentication bypass
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- crushftp 11.3.1, crushftp 10.8.4
- CISA due date
- 28 Apr 2025
- Weakness
- CWE-305
4 Apr 2025 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Memory corruption
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
- What to do
- Apply mitigations as set forth in the CISA instructions linked below.
- Fixed in (NVD)
- ivanti zero trust access gateway 22.8, ivanti connect secure 22.7, ivanti policy secure 22.7
- CISA due date
- 11 Apr 2025
- Weakness
- CWE-121
18 Mar 2025 Fortinet FortiOS and FortiProxy Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortiproxy 7.2.13, fortinet fortiproxy 7.0.20, fortinet fortios 7.0.17
- CISA due date
- 8 Apr 2025
- Weakness
- CWE-288
11 Mar 2025 Microsoft Windows Security flaw
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-707
4 Mar 2025 VMware ESXi Memory corruption
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-123
3 Mar 2025 Microsoft Windows Denial of service
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-404
18 Feb 2025 SonicWall SonicOS Authentication bypass
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Mar 2025
- Weakness
- CWE-287
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.