The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
25 Feb 2025 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 18 Mar 2025
- Weakness
- CWE-79
24 Feb 2025 Oracle Agile Product Lifecycle Management (PLM) Remote code execution
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 17 Mar 2025
- Weakness
- CWE-502
24 Feb 2025 Adobe ColdFusion Remote code execution
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 17 Mar 2025
- Weakness
- CWE-502
21 Feb 2025 Microsoft Power Pages Access control flaw
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 14 Mar 2025
- Weakness
- CWE-284
20 Feb 2025 Craft CMS Remote code execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- craftcms craft cms 5.5.8, craftcms craft cms 4.13.8
- CISA due date
- 13 Mar 2025
- Weakness
- CWE-94
20 Feb 2025 Palo Alto Networks PAN-OS Path traversal
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.6, paloaltonetworks pan-os 10.2.12, paloaltonetworks pan-os 10.2.7, paloaltonetworks pan-os 10.1.14
- CISA due date
- 13 Mar 2025
- Weakness
- CWE-73
18 Feb 2025 Palo Alto Networks PAN-OS Authentication bypass
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.2, paloaltonetworks pan-os 10.2.7, paloaltonetworks pan-os 10.1.14
- CISA due date
- 11 Mar 2025
- Weakness
- CWE-306
18 Feb 2025 SonicWall SonicOS Authentication bypass
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Mar 2025
- Weakness
- CWE-287
13 Feb 2025 SimpleHelp SimpleHelp Path traversal
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- simple-help simplehelp 5.5.8
- CISA due date
- 6 Mar 2025
- Weakness
- CWE-22
12 Feb 2025 Apple iOS and iPadOS Access control flaw
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 18.3.1, apple iphone os 18.3.1, apple ipados 16.7.11, apple iphone os 16.7.11, apple ipados 15.8.4 and 1 older
- CISA due date
- 5 Mar 2025
- Weakness
- CWE-863
12 Feb 2025 Mitel SIP Phones Command injection
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 5 Mar 2025
- Weakness
- CWE-88
11 Feb 2025 Microsoft Windows Memory corruption
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.3107, microsoft windows server 2022 23h2 10.0.25398.1425, microsoft windows server 2022 10.0.20348.3148, microsoft windows server 2019 10.0.17763.6893, microsoft windows server 2016 10.0.14393.7785 and 7 older
- CISA due date
- 4 Mar 2025
- Weakness
- CWE-122
11 Feb 2025 Microsoft Windows Path traversal
Windows Storage Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1425, microsoft windows server 2022 10.0.20348.3148, microsoft windows server 2019 10.0.17763.6893, microsoft windows server 2016 10.0.14393.7785, microsoft windows 11 24h2 10.0.26100.3107 and 7 older
- CISA due date
- 4 Mar 2025
- Weakness
- CWE-59
11 Feb 2025 Zyxel DSL CPE Devices Command injection
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
- What to do
- The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CISA due date
- 4 Mar 2025
- Weakness
- CWE-78
11 Feb 2025 Zyxel DSL CPE Devices Command injection
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
- What to do
- The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CISA due date
- 4 Mar 2025
- Weakness
- CWE-78
7 Feb 2025 Trimble Cityworks Remote code execution
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- trimble cityworks 23.10, trimble cityworks 15.8.9
- CISA due date
- 28 Feb 2025
- Weakness
- CWE-502
6 Feb 2025 7-Zip Security flaw
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- 7-zip 24.09
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-693
6 Feb 2025 Microsoft Office Outlook Input validation flaw
Microsoft Outlook Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-20
6 Feb 2025 Audinate Dante Discovery Security flaw
mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-114
6 Feb 2025 Sophos CyberoamOS SQL injection
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-89
6 Feb 2025 Sophos XG Firewall Memory corruption
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sophos xg firewall firmware 17.5
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-120
5 Feb 2025 Linux Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 6.12.1, linux kernel 6.11.8, linux kernel 6.6.61, linux kernel 6.1.117, linux kernel 5.15.172 and 3 older
- CISA due date
- 26 Feb 2025
- Weakness
- CWE-787
4 Feb 2025 Apache OFBiz Access control flaw
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache ofbiz 18.12.16
- CISA due date
- 25 Feb 2025
- Weakness
- CWE-425
4 Feb 2025 Microsoft .NET Framework Information disclosure
.NET Framework Information Disclosure Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 25 Feb 2025
- Weakness
- CWE-209
4 Feb 2025 Paessler PRTG Network Monitor Command injection
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paessler prtg network monitor 21.2.68, paessler prtg network monitor 18.2.39
- CISA due date
- 25 Feb 2025
- Weakness
- CWE-78
4 Feb 2025 Paessler PRTG Network Monitor Security flaw
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paessler prtg network monitor 18.2.40.1683
- CISA due date
- 25 Feb 2025
29 Jan 2025 Apple Multiple Products Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 18.3, apple iphone os 18.3, apple tvos 18.3, apple ipados 17.7.6, apple macos 15.3 and 4 older
- CISA due date
- 19 Feb 2025
- Weakness
- CWE-416
24 Jan 2025 SonicWall SMA1000 Appliances Remote code execution
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sma8200v 12.4.3-02854, sonicwall sma7210 firmware 12.4.3-02854, sonicwall sma7200 firmware 12.4.3-02854, sonicwall sma6210 firmware 12.4.3-02854, sonicwall sma6200 firmware 12.4.3-02854
- CISA due date
- 14 Feb 2025
- Weakness
- CWE-502
23 Jan 2025 JQuery Cross-site scripting
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- oracle blockchain platform 21.1.2, oracle application express 20.2, oracle jd edwards enterpriseone orchestrator 9.2.5.0, oracle jd edwards enterpriseone tools 9.2.5.0, drupal 8.8.6 and 5 older
- CISA due date
- 13 Feb 2025
- Weakness
- CWE-79
16 Jan 2025 Aviatrix Controllers Command injection
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- aviatrix controller 7.2.4996, aviatrix controller 7.1.4191
- CISA due date
- 6 Feb 2025
- Weakness
- CWE-78
14 Jan 2025 Microsoft Windows Memory corruption
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.2894, microsoft windows server 2022 23h2 10.0.25398.1369, microsoft windows 11 24h2 10.0.26100.2894, microsoft windows 11 23h2 10.0.22631.4751, microsoft windows 11 22h2 10.0.22621.4751 and 2 older
- CISA due date
- 4 Feb 2025
- Weakness
- CWE-416
14 Jan 2025 Microsoft Windows Memory corruption
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.2894, microsoft windows server 2022 23h2 10.0.25398.1369, microsoft windows 11 24h2 10.0.26100.2894, microsoft windows 11 23h2 10.0.22631.4751, microsoft windows 11 22h2 10.0.22621.4751 and 2 older
- CISA due date
- 4 Feb 2025
- Weakness
- CWE-416
14 Jan 2025 Microsoft Windows Memory corruption
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.2894, microsoft windows server 2022 23h2 10.0.25398.1369, microsoft windows 11 24h2 10.0.26100.2894, microsoft windows 11 23h2 10.0.22631.4751, microsoft windows 11 22h2 10.0.22621.4751 and 2 older
- CISA due date
- 4 Feb 2025
- Weakness
- CWE-122
14 Jan 2025 Fortinet FortiOS and FortiProxy Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet fortiproxy 7.2.13, fortinet fortiproxy 7.0.20, fortinet fortios 7.0.17
- CISA due date
- 21 Jan 2025
- Weakness
- CWE-288
13 Jan 2025 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command injection
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 3 Feb 2025
- Weakness
- CWE-78
13 Jan 2025 Qlik Sense Input validation flaw
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 3 Feb 2025
- Weakness
- CWE-444
8 Jan 2025 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Memory corruption
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
- What to do
- Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
- CISA due date
- 15 Jan 2025
- Weakness
- CWE-121
7 Jan 2025 Mitel MiCollab Path traversal
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Jan 2025
- Weakness
- CWE-22
7 Jan 2025 Mitel MiCollab Path traversal
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Jan 2025
- Weakness
- CWE-22
7 Jan 2025 Oracle WebLogic Server Security flaw
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Jan 2025
30 Dec 2024 Palo Alto Networks PAN-OS Security flaw
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paloaltonetworks pan-os 11.2.3
- CISA due date
- 20 Jan 2025
- Weakness
- CWE-754
23 Dec 2024 Acclaim Systems USAHERDS Authentication bypass
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.
- CISA due date
- 13 Jan 2025
- Weakness
- CWE-798
19 Dec 2024 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command injection
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 27 Dec 2024
- Weakness
- CWE-77
18 Dec 2024 NUUO NVRmini2 Devices Authentication bypass
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CISA due date
- 8 Jan 2025
- Weakness
- CWE-306
18 Dec 2024 Reolink RLC-410W IP Camera Command injection
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
- What to do
- The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CISA due date
- 8 Jan 2025
- Weakness
- CWE-78
18 Dec 2024 Reolink Multiple IP Cameras Command injection
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
- What to do
- The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CISA due date
- 8 Jan 2025
- Weakness
- CWE-78
18 Dec 2024 NUUO NVRmini Devices Command injection
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CISA due date
- 8 Jan 2025
- Weakness
- CWE-78
17 Dec 2024 Cleo Multiple Products Command injection
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cleo harmony 5.8.0.24, cleo lexicom 5.8.0.24, cleo vltrader 5.8.0.24
- CISA due date
- 7 Jan 2025
- Weakness
- CWE-276
16 Dec 2024 Microsoft Windows Memory corruption
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.950, microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 6 Jan 2025
- Weakness
- CWE-822
16 Dec 2024 Adobe ColdFusion Access control flaw
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 6 Jan 2025
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.