The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
23 Apr 2026 Marimo Authentication bypass
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- coreweave marimo 0.23.0
- CISA due date
- 7 May 2026
- Weakness
- CWE-306
22 Apr 2026 Microsoft Defender Access control flaw
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft defender antimalware platform 4.18.26030.3011
- CISA due date
- 6 May 2026
- Weakness
- CWE-1220
20 Apr 2026 Cisco Catalyst SD-WAN Manager Information disclosure
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco catalyst sd-wan manager 20.18.2.1, cisco catalyst sd-wan manager 20.15.4.2, cisco catalyst sd-wan manager 20.12.5.3, cisco catalyst sd-wan manager 20.9.8.2
- CISA due date
- 23 Apr 2026
- Weakness
- CWE-200
20 Apr 2026 Cisco Catalyst SD-WAN Manager Security flaw
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco catalyst sd-wan manager 20.18, cisco catalyst sd-wan manager 20.15.4.2, cisco catalyst sd-wan manager 20.12.5.3, cisco catalyst sd-wan manager 20.9.8.2
- CISA due date
- 23 Apr 2026
- Weakness
- CWE-257
20 Apr 2026 Cisco Catalyst SD-WAN Manger Security flaw
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco catalyst sd-wan manager 20.18.2.1, cisco catalyst sd-wan manager 20.15.4.2, cisco catalyst sd-wan manager 20.12.5.3, cisco catalyst sd-wan manager 20.9.8.2
- CISA due date
- 23 Apr 2026
- Weakness
- CWE-648
20 Apr 2026 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.1.4, synacor zimbra collaboration suite 10.0.12
- CISA due date
- 23 Apr 2026
- Weakness
- CWE-79
20 Apr 2026 Quest KACE Systems Management Appliance (SMA) Authentication bypass
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- quest kace systems management appliance 14.1.101, quest kace systems management appliance 14.0.341, quest kace systems management appliance 13.2.183, quest kace systems management appliance 13.1.81, quest kace systems management appliance 13.0.385
- CISA due date
- 4 May 2026
- Weakness
- CWE-287
20 Apr 2026 Kentico Xperience Malicious file upload
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 4 May 2026
- Weakness
- CWE-22, CWE-434
20 Apr 2026 JetBrains TeamCity Path traversal
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jetbrains teamcity 2023.11.4
- CISA due date
- 4 May 2026
- Weakness
- CWE-23
20 Apr 2026 PaperCut NG/MF Authentication bypass
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- papercut mf 22.0.9, papercut ng 22.0.9, papercut mf 21.2.11, papercut ng 21.2.11, papercut mf 20.1.7 and 1 older
- CISA due date
- 4 May 2026
- Weakness
- CWE-287
16 Apr 2026 Apache ActiveMQ Remote code execution
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apache activemq 6.2.3, apache activemq broker 6.2.3, apache activemq 5.19.4, apache activemq broker 5.19.4
- CISA due date
- 30 Apr 2026
- Weakness
- CWE-20, CWE-94
14 Apr 2026 Microsoft SharePoint Server Input validation flaw
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20210
- CISA due date
- 28 Apr 2026
- Weakness
- CWE-20
14 Apr 2026 Microsoft Office Remote code execution
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 Apr 2026
- Weakness
- CWE-94
13 Apr 2026 Adobe Acrobat and Reader Security flaw
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe acrobat dc 26.001.21411, adobe acrobat reader dc 26.001.21411, adobe acrobat 24.001.30362, adobe acrobat 24.001.30360
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-1321
13 Apr 2026 Fortinet FortiClient EMS SQL injection
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Apr 2026
- Weakness
- CWE-89
13 Apr 2026 Microsoft Windows Path traversal
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7392, microsoft windows 11 25h2 10.0.26200.7392, microsoft windows 11 24h2 10.0.26100.7392
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-59
13 Apr 2026 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.531, microsoft windows server 2022 10.0.20348.2091, microsoft windows server 2019 10.0.17763.5122, microsoft windows server 2016 10.0.14393.6452, microsoft windows 11 23h2 10.0.22631.2715 and 7 older
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-125
13 Apr 2026 Microsoft Exchange Server Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-502
13 Apr 2026 Adobe Acrobat Memory corruption
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-416
13 Apr 2026 Microsoft Visual Basic for Applications (VBA) Security flaw
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-426
8 Apr 2026 Ivanti Endpoint Manager Mobile (EPMM) Remote code execution
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 11 Apr 2026
- Weakness
- CWE-94
6 Apr 2026 Fortinet FortiClient EMS Access control flaw
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 9 Apr 2026
- Weakness
- CWE-284
2 Apr 2026 TrueConf Client Security flaw
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- trueconf 8.5.3.884
- CISA due date
- 16 Apr 2026
- Weakness
- CWE-494
1 Apr 2026 Google Dawn Memory corruption
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 146.0.7680.177
- CISA due date
- 15 Apr 2026
- Weakness
- CWE-416
30 Mar 2026 Citrix NetScaler Memory corruption
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-60.58, citrix netscaler gateway 14.1-60.58, citrix netscaler application delivery controller 13.1-62.23, citrix netscaler gateway 13.1-62.23, citrix netscaler application delivery controller 13.1-37.262
- CISA due date
- 2 Apr 2026
- Weakness
- CWE-125
27 Mar 2026 F5 BIG-IP Memory corruption
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- f5 big-ip access policy manager 17.5.1.3, f5 big-ip access policy manager 17.1.3, f5 big-ip access policy manager 16.1.6.1, f5 big-ip access policy manager 15.1.10.8
- CISA due date
- 30 Mar 2026
- Weakness
- CWE-121
26 Mar 2026 Aquasecurity Trivy Security flaw
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- aquasec trivy action 0.35.0, aquasec setup-trivy 0.2.6
- CISA due date
- 9 Apr 2026
- Weakness
- CWE-506
25 Mar 2026 Langflow Remote code execution
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- langflow 1.8.2
- CISA due date
- 8 Apr 2026
- Weakness
- CWE-94, CWE-95, CWE-306
20 Mar 2026 Laravel Livewire Remote code execution
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- laravel livewire 3.6.4
- CISA due date
- 3 Apr 2026
- Weakness
- CWE-94
20 Mar 2026 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple tvos 26.1, apple visionos 26.1, apple watchos 26.1, apple ipados 18.7.2, apple iphone os 18.7.2 and 2 older
- CISA due date
- 3 Apr 2026
- Weakness
- CWE-120
20 Mar 2026 Apple Multiple Products Security flaw
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple tvos 26.1, apple visionos 26.1, apple watchos 26.1, apple ipados 18.7.2, apple iphone os 18.7.2 and 2 older
- CISA due date
- 3 Apr 2026
- Weakness
- CWE-667
20 Mar 2026 Craft CMS Remote code execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- craftcms craft cms 5.6.17, craftcms craft cms 4.14.15, craftcms craft cms 3.9.15
- CISA due date
- 3 Apr 2026
- Weakness
- CWE-94
20 Mar 2026 Apple Multiple Products Memory corruption
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple safari 18.6, apple ipados 18.6, apple iphone os 18.6, apple tvos 18.6, apple macos 15.6 and 4 older
- CISA due date
- 3 Apr 2026
- Weakness
- CWE-119
19 Mar 2026 Cisco Secure Firewall Management Center (FMC) Remote code execution
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 22 Mar 2026
- Weakness
- CWE-502
18 Mar 2026 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19127.20442
- CISA due date
- 21 Mar 2026
- Weakness
- CWE-502
18 Mar 2026 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.1.13, synacor zimbra collaboration suite 10.0.18
- CISA due date
- 1 Apr 2026
- Weakness
- CWE-79
16 Mar 2026 Wing FTP Server Information disclosure
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wftpserver wing ftp server 7.4.4
- CISA due date
- 30 Mar 2026
- Weakness
- CWE-209
13 Mar 2026 Google Chromium V8 Remote code execution
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 146.0.7680.75
- CISA due date
- 27 Mar 2026
- Weakness
- CWE-119
13 Mar 2026 Google Skia Memory corruption
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 146.0.7680.80
- CISA due date
- 27 Mar 2026
- Weakness
- CWE-787
11 Mar 2026 n8n Security flaw
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- n8n 1.120.4
- CISA due date
- 25 Mar 2026
- Weakness
- CWE-913
9 Mar 2026 Ivanti Endpoint Manager (EPM) Authentication bypass
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2024
- CISA due date
- 23 Mar 2026
- Weakness
- CWE-288
9 Mar 2026 SolarWinds Web Help Desk Remote code execution
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 12 Mar 2026
- Weakness
- CWE-502
9 Mar 2026 Omnissa Workspace One UEM Server-side request forgery
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware workspace one uem console 21.5.0.37, vmware workspace one uem console 21.2.0.27, vmware workspace one uem console 20.11.0.40, vmware workspace one uem console 20.0.8.36
- CISA due date
- 23 Mar 2026
- Weakness
- CWE-918
5 Mar 2026 Apple Multiple Products Memory corruption
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple safari 16.6, apple ipados 16.6, apple iphone os 16.6, apple ipados 15.8.7, apple iphone os 15.8.7 and 1 older
- CISA due date
- 26 Mar 2026
- Weakness
- CWE-416
5 Mar 2026 Apple iOS and iPadOS Memory corruption
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple ipados 17.0, apple iphone os 17.0, apple ipados 15.8.7, apple iphone os 15.8.7
- CISA due date
- 26 Mar 2026
- Weakness
- CWE-416
5 Mar 2026 Apple Multiple Products Memory corruption
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple safari 15.2, apple ipados 15.2, apple iphone os 15.2, apple tvos 15.2, apple macos 12.1 and 3 older
- CISA due date
- 26 Mar 2026
- Weakness
- CWE-190
5 Mar 2026 Rockwell Multiple Products Security flaw
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 26 Mar 2026
- Weakness
- CWE-522
5 Mar 2026 Hikvision Multiple Products Authentication bypass
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 26 Mar 2026
- Weakness
- CWE-287
3 Mar 2026 Broadcom VMware Aria Operations Command injection
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware cloud foundation 9.0.2.0, vmware aria operations 8.18.6, vmware cloud foundation 5.2.3
- CISA due date
- 24 Mar 2026
- Weakness
- CWE-77
3 Mar 2026 Qualcomm Multiple Chipsets Memory corruption
Memory corruption while using alignments for memory allocation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Mar 2026
- Weakness
- CWE-190
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.