The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
25 Feb 2026 Cisco Catalyst SD-WAN Controller and Manager Authentication bypass
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco catalyst sd-wan manager 20.18.2.1, cisco sd-wan vbond orchestrator 20.18.2.1, cisco sd-wan vsmart controller 20.18.2.1, cisco catalyst sd-wan manager 20.15.4.2, cisco sd-wan vbond orchestrator 20.15.4.2 and 7 older
- CISA due date
- 27 Feb 2026
- Weakness
- CWE-287
25 Feb 2026 Cisco SD-WAN Path traversal
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco catalyst sd-wan manager 20.7.2, cisco sd-wan vbond orchestrator 20.7.2, cisco sd-wan vedge cloud 20.7.2, cisco sd-wan vsmart controller 20.7.2, cisco sd-wan 20.7.2 and 5 older
- CISA due date
- 27 Feb 2026
- Weakness
- CWE-25, CWE-282
24 Feb 2026 Soliton Systems K.K FileZen Command injection
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- soliton filezen 5.0.11
- CISA due date
- 17 Mar 2026
- Weakness
- CWE-78
20 Feb 2026 Roundcube Webmail Cross-site scripting
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- roundcube webmail 1.6.12, roundcube webmail 1.5.12
- CISA due date
- 13 Mar 2026
- Weakness
- CWE-79
20 Feb 2026 Roundcube Webmail Remote code execution
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- roundcube webmail 1.6.11, roundcube webmail 1.5.10
- CISA due date
- 13 Mar 2026
- Weakness
- CWE-502
18 Feb 2026 Dell RecoverPoint for Virtual Machines (RP4VMs) Authentication bypass
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- dell recoverpoint for virtual machines 6.0
- CISA due date
- 21 Feb 2026
- Weakness
- CWE-798
18 Feb 2026 GitLab Server-side request forgery
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 13.8.4, gitlab 13.7.7, gitlab 13.6.7
- CISA due date
- 11 Mar 2026
- Weakness
- CWE-918
17 Feb 2026 Google Chromium Memory corruption
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 145.0.7632.76, google chrome 145.0.7632.75
- CISA due date
- 10 Mar 2026
- Weakness
- CWE-416
17 Feb 2026 TeamT5 ThreatSonar Anti-Ransomware Malicious file upload
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- teamt5 threatsonar anti-ransomware 3.5.0
- CISA due date
- 10 Mar 2026
- Weakness
- CWE-434
17 Feb 2026 Synacor Zimbra Collaboration Suite Server-side request forgery
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 8.8.15
- CISA due date
- 10 Mar 2026
- Weakness
- CWE-918
17 Feb 2026 Microsoft Windows Memory corruption
Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Mar 2026
- Weakness
- CWE-119, CWE-121
13 Feb 2026 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) Command injection
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- beyondtrust remote support 25.3.2, beyondtrust privileged remote access 25.1
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-78
12 Feb 2026 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple ipados 26.3, apple iphone os 26.3, apple macos 26.3, apple tvos 26.3, apple visionos 26.3 and 1 older
- CISA due date
- 5 Mar 2026
- Weakness
- CWE-119
12 Feb 2026 SolarWinds Web Help Desk Security flaw
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- solarwinds web help desk 2026.1
- CISA due date
- 15 Feb 2026
- Weakness
- CWE-693
12 Feb 2026 Notepad++ Security flaw
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- notepad-plus-plus notepad\+\+ 8.8.9
- CISA due date
- 5 Mar 2026
- Weakness
- CWE-494
12 Feb 2026 Microsoft Configuration Manager SQL injection
Microsoft Configuration Manager Remote Code Execution Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Mar 2026
- Weakness
- CWE-89
10 Feb 2026 Microsoft Windows Privilege escalation
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-269
10 Feb 2026 Microsoft Windows Denial of service
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-476
10 Feb 2026 Microsoft Windows Memory corruption
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-843
10 Feb 2026 Microsoft Office Security flaw
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-807
10 Feb 2026 Microsoft Windows Security flaw
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-693
10 Feb 2026 Microsoft Windows Security flaw
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-693
5 Feb 2026 SmarterTools SmarterMail Authentication bypass
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- smartertools smartermail 100.0.9511
- CISA due date
- 26 Feb 2026
- Weakness
- CWE-306
5 Feb 2026 React Native Community CLI Command injection
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- react-native-community react native community cli 19.1.2
- CISA due date
- 26 Feb 2026
- Weakness
- CWE-78
3 Feb 2026 Sangoma FreePBX Command injection
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sangoma filestore 17.0.3
- CISA due date
- 24 Feb 2026
- Weakness
- CWE-78
3 Feb 2026 SolarWinds Web Help Desk Remote code execution
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- solarwinds web help desk 2026.1
- CISA due date
- 6 Feb 2026
- Weakness
- CWE-502
3 Feb 2026 GitLab Community and Enterprise Editions Server-side request forgery
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 14.5.2, gitlab 14.4.4, gitlab 14.3.6
- CISA due date
- 24 Feb 2026
- Weakness
- CWE-918
3 Feb 2026 Sangoma FreePBX Authentication bypass
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Feb 2026
- Weakness
- CWE-287
29 Jan 2026 Ivanti Endpoint Manager Mobile (EPMM) Remote code execution
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 1 Feb 2026
- Weakness
- CWE-94
27 Jan 2026 Fortinet Multiple Products Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortianalyzer 7.6.6, fortinet fortimanager 7.6.6, fortinet fortinac-f 7.6.6, fortinet fortios 7.6.6, fortinet fortios 7.4.11 and 2 older
- CISA due date
- 30 Jan 2026
- Weakness
- CWE-288
26 Jan 2026 GNU InetUtils Command injection
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-88
26 Jan 2026 SmarterTools SmarterMail Authentication bypass
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- smartertools smartermail 100.0.9511
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-288
26 Jan 2026 Microsoft Office Security flaw
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-807
26 Jan 2026 SmarterTools SmarterMail Malicious file upload
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- smartertools smartermail 100.0.9413
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-434
26 Jan 2026 Linux Kernel Memory corruption
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 8.1.7, paloaltonetworks pan-os 8.0.16, paloaltonetworks pan-os 7.1.23, f5 big-ip access policy manager 14.1.0.6, f5 big-ip access policy manager 14.0.1.1 and 7 older
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-190
23 Jan 2026 Broadcom VMware vCenter Server Memory corruption
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware cloud foundation 5.2
- CISA due date
- 13 Feb 2026
- Weakness
- CWE-787
22 Jan 2026 Synacor Zimbra Collaboration Suite (ZCS) Security flaw
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.1.13, synacor zimbra collaboration suite 10.0.18
- CISA due date
- 12 Feb 2026
- Weakness
- CWE-98
22 Jan 2026 Prettier eslint-config-prettier Security flaw
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- homarr 1.30.0
- CISA due date
- 12 Feb 2026
- Weakness
- CWE-506
22 Jan 2026 Versa Concerto Authentication bypass
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- versa-networks concerto 12.1.2
- CISA due date
- 12 Feb 2026
- Weakness
- CWE-288
22 Jan 2026 Vitejs Access control flaw
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vitejs vite 6.2.4, vitejs vite 6.1.3, vitejs vite 6.0.13, vitejs vite 5.4.16, vitejs vite 4.5.11
- CISA due date
- 12 Feb 2026
- Weakness
- CWE-200, CWE-284
21 Jan 2026 Cisco Unified Communications Manager Remote code execution
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco unified communications manager 14su5, cisco unified communications manager im and presence service 14su5, cisco unity connection 14su5
- CISA due date
- 11 Feb 2026
- Weakness
- CWE-94
13 Jan 2026 Microsoft Windows Information disclosure
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7623, microsoft windows server 2022 23h2 10.0.25398.2092, microsoft windows server 2022 10.0.20348.4648, microsoft windows server 2019 10.0.17763.8276, microsoft windows server 2016 10.0.14393.8783 and 7 older
- CISA due date
- 3 Feb 2026
- Weakness
- CWE-200
12 Jan 2026 Gogs Path traversal
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 2 Feb 2026
- Weakness
- CWE-22
On Hacker News
Gogs 0-Day Exploited in the Wild7 Jan 2026 Hewlett Packard Enterprise (HPE) OneView Remote code execution
A remote code execution issue exists in HPE OneView.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 Jan 2026
- Weakness
- CWE-94
7 Jan 2026 Microsoft Office Remote code execution
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 Jan 2026
- Weakness
- CWE-94
29 Dec 2025 MongoDB and MongoDB Server Security flaw
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- mongodb 8.2.3, mongodb 8.0.17, mongodb 7.0.28, mongodb 6.0.27, mongodb 5.0.32 and 1 older
- CISA due date
- 19 Jan 2026
- Weakness
- CWE-130
22 Dec 2025 Digiever DS-2105 Pro Access control flaw
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 12 Jan 2026
- Weakness
- CWE-862
19 Dec 2025 WatchGuard Firebox Memory corruption
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- watchguard fireware 2025.1.4, watchguard fireware 12.11.6, watchguard fireware 12.5.15
- CISA due date
- 26 Dec 2025
- Weakness
- CWE-787
17 Dec 2025 ASUS Live Update Security flaw
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- asus live update 3.6.8
- CISA due date
- 7 Jan 2026
- Weakness
- CWE-506
17 Dec 2025 SonicWall SMA1000 appliance Access control flaw
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma8200v 12.5.0-02283, sonicwall sma8200v 12.4.3-03245, sonicwall sma7210 firmware 12.5.0-02283, sonicwall sma7210 firmware 12.4.3-03245, sonicwall sma7200 firmware 12.5.0-02283 and 5 older
- CISA due date
- 24 Dec 2025
- Weakness
- CWE-862, CWE-250
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.