The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
26 Aug 2026 Microsoft SQL Server Input validation flaw
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sql server 2017 14.0.3192.2, microsoft sql server 2017 14.0.2027.2, microsoft sql server 2016 13.0.5366.0, microsoft sql server 2016 13.0.5101.9, microsoft sql server 2016 13.0.4604.0 and 1 older
- CISA due date
- 29 Aug 2026
- Weakness
- CWE-20
26 Aug 2026 Red Hat Automatic Bug Reporting Tool Path traversal
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 9 Sep 2026
- Weakness
- CWE-59
26 Aug 2026 Red Hat Libuser Race condition
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- libuser project libuser 0.60-7, libuser project libuser 0.56.13-8
- CISA due date
- 9 Sep 2026
- Weakness
- CWE-264, CWE-367
25 Aug 2026 Gitea Remote code execution
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitea 1.27.1
- CISA due date
- 28 Aug 2026
- Weakness
- CWE-94
24 Aug 2026 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Access control flaw
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Aug 2026
- Weakness
- CWE-284
21 Aug 2026 Synacor Zimbra Collaboration Suite (ZCS) Command injection
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.1.20
- CISA due date
- 24 Aug 2026
- Weakness
- CWE-78
20 Aug 2026 TrueConf Server Remote code execution
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- trueconf server 5.5.5.10010, trueconf server 5.5.5.10009, trueconf server 5.4.9.10072, trueconf server 5.4.9.10019, trueconf server 5.3.9.10015 and 1 older
- CISA due date
- 3 Sep 2026
- Weakness
- CWE-94
20 Aug 2026 TrueConf Server Authentication bypass
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- trueconf server 5.5.5.10010, trueconf server 5.5.5.10009, trueconf server 5.4.9.10072, trueconf server 5.4.9.10019, trueconf server 5.3.9.10015 and 1 older
- CISA due date
- 23 Aug 2026
- Weakness
- CWE-306
19 Aug 2026 MLflow Server-side request forgery
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- lfprojects mlflow 3.15.0
- CISA due date
- 2 Sep 2026
- Weakness
- CWE-918
18 Aug 2026 Apple macOS Authentication bypass
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple macos 26.6.1, apple macos 15.7.9, apple macos 14.8.9
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-287
18 Aug 2026 Broadcom VMware vCenter Path traversal
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware vcenter server 9.1.0.0300, vmware vcenter server 9.0.2.0100, vmware vcenter server 8.0
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-22
On Hacker News
Patch-diffing VMware vCenter to auth bypass and RCE18 Aug 2026 Microsoft SharePoint Authentication bypass
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-1390
18 Aug 2026 Microsoft Internet Key Exchange (IKE) Service Extensions Memory corruption
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.2274, microsoft windows server 2022 10.0.20348.5020, microsoft windows server 2019 10.0.17763.8644, microsoft windows server 2016 10.0.14393.9060, microsoft windows 11 26h1 10.0.28000.1836 and 7 older
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-415
17 Aug 2026 Ray-Project Ray Remote code execution
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- anyscale ray 2.52.0
- CISA due date
- 20 Aug 2026
- Weakness
- CWE-94, CWE-352
11 Aug 2026 Metabase SQL injection
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- metabase 1.63.5, metabase 1.62.9, metabase 1.61.11, metabase 1.60.17, metabase 1.59.21 and 7 older
- CISA due date
- 14 Aug 2026
- Weakness
- CWE-89
11 Aug 2026 Microsoft Windows Ancillary Function Driver for WinSock Memory corruption
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.33222, microsoft windows server 2022 10.0.20348.5440, microsoft windows server 2019 10.0.17763.9115, microsoft windows server 2016 10.0.14393.9418, microsoft windows 11 26h1 10.0.28000.2704 and 7 older
- CISA due date
- 25 Aug 2026
- Weakness
- CWE-416
11 Aug 2026 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Security flaw
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 14 Aug 2026
- Weakness
- CWE-244
7 Aug 2026 Progress LoadMaster Command injection
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- progress connection manager for objectscale 7.2.63.2, progress ecs connection manager 7.2.63.2, progress moveit web application firewall 7.2.63.2, progress loadmaster 7.2.63.2, progress loadmaster 7.2.54.18
- CISA due date
- 10 Aug 2026
- Weakness
- CWE-77
5 Aug 2026 JetBrains TeamCity Remote code execution
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jetbrains teamcity 2026.1.3, jetbrains teamcity 2025.11.7
- CISA due date
- 8 Aug 2026
- Weakness
- CWE-502
4 Aug 2026 IBM Langflow Remote code execution
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- langflow 1.10.1
- CISA due date
- 7 Aug 2026
- Weakness
- CWE-94
4 Aug 2026 Apache Tomcat Weak cryptography
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 7 Aug 2026
- Weakness
- CWE-311
4 Aug 2026 N-able N-central Authentication bypass
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 7 Aug 2026
- Weakness
- CWE-288
3 Aug 2026 N-able N-central Authentication bypass
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- n-able n-central 2026.3
- CISA due date
- 6 Aug 2026
- Weakness
- CWE-288
29 Jul 2026 Cisco Secure Firewall Management Center (FMC) Security flaw
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 1 Aug 2026
- Weakness
- CWE-259
27 Jul 2026 Arista VeloCloud Orchestrator Command injection
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- arista velocloud orchestrator 6.4.2.4, arista velocloud orchestrator 6.1.3.4, arista velocloud orchestrator 5.2.3.14
- CISA due date
- 30 Jul 2026
- Weakness
- CWE-78
27 Jul 2026 Fortinet FortiOS Information disclosure
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortios 7.6.2, fortinet fortios 7.4.7
- CISA due date
- 10 Aug 2026
- Weakness
- CWE-200
22 Jul 2026 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 25 Jul 2026
- Weakness
- CWE-502
22 Jul 2026 Check Point SmartConsole Authentication bypass
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- checkpoint multi-domain security management r81.20, checkpoint quantum security management r81.20
- CISA due date
- 25 Jul 2026
- Weakness
- CWE-287
21 Jul 2026 WordPress Core Security flaw
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 7.0.2, wordpress 6.9.5
- CISA due date
- 24 Jul 2026
- Weakness
- CWE-436
21 Jul 2026 WordPress Core SQL injection
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 7.0.2, wordpress 6.9.5, wordpress 6.8.6
- CISA due date
- 4 Aug 2026
- Weakness
- CWE-89
21 Jul 2026 Langflow Security flaw
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Jul 2026
- Weakness
- CWE-829
21 Jul 2026 DD-WRT Memory corruption
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- dd-wrt 45724
- CISA due date
- 24 Jul 2026
- Weakness
- CWE-121
16 Jul 2026 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 19 Jul 2026
- Weakness
- CWE-502
16 Jul 2026 Fortinet FortiSandbox Command injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 19 Jul 2026
- Weakness
- CWE-78
16 Jul 2026 Fortinet FortiSandbox Command injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortisandbox 5.0.6, fortinet fortisandbox cloud 5.0.6, fortinet fortisandbox paas 5.0.6, fortinet fortisandbox 4.4.9
- CISA due date
- 19 Jul 2026
- Weakness
- CWE-78
15 Jul 2026 Oracle E-Business Suite Authentication bypass
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 18 Jul 2026
- Weakness
- CWE-269, CWE-287, CWE-306
15 Jul 2026 KNX Association KNX Protocol Connection Authorization Option 1 Security flaw
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 29 Jul 2026
- Weakness
- CWE-645
14 Jul 2026 Microsoft SharePoint Server Authentication bypass
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-306
14 Jul 2026 Microsoft Active Directory Federation Services Access control flaw
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.33158, microsoft windows server 2022 10.0.20348.5386, microsoft windows server 2019 10.0.17763.9020, microsoft windows server 2016 10.0.14393.9339, microsoft windows 10 1809 10.0.17763.9020 and 1 older
- CISA due date
- 28 Jul 2026
- Weakness
- CWE-1220
14 Jul 2026 SonicWall SMA1000 Appliances Remote code execution
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-94
14 Jul 2026 SonicWall SMA1000 Appliances Server-side request forgery
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-918
On Hacker News
CVE-2026-15409: SonicWall SMA 1000 SSRF Zero-Day13 Jul 2026 Cisco IOS Cross-site request forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Jul 2026
- Weakness
- CWE-352
10 Jul 2026 Balbooa Forms Malicious file upload
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- balbooa forms 2.4.1
- CISA due date
- 13 Jul 2026
- Weakness
- CWE-434
10 Jul 2026 iCagenda Malicious file upload
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- joomlic icagenda 4.0.8, joomlic icagenda 3.9.15
- CISA due date
- 13 Jul 2026
- Weakness
- CWE-434
7 Jul 2026 Joomlack Page Builder Malicious file upload
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- joomlack page builder ck 3.6.0
- CISA due date
- 10 Jul 2026
- Weakness
- CWE-284
7 Jul 2026 Langflow Access control flaw
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- langflow 1.9.1
- CISA due date
- 10 Jul 2026
- Weakness
- CWE-639
7 Jul 2026 JoomShaper SP Page Builder Malicious file upload
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ollyo sp page builder 6.6.2
- CISA due date
- 10 Jul 2026
- Weakness
- CWE-434
7 Jul 2026 Adobe ColdFusion Path traversal
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Jul 2026
- Weakness
- CWE-22
1 Jul 2026 Microsoft SharePoint Server Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20280
- CISA due date
- 4 Jul 2026
- Weakness
- CWE-502
29 Jun 2026 SimpleHelp SimpleHelp Weak cryptography
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- simple-help simplehelp 5.5.16
- CISA due date
- 2 Jul 2026
- Weakness
- CWE-347
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.