The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
17 Dec 2025 Cisco Multiple Products Input validation flaw
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco asyncos 16.0.4-016, cisco asyncos 16.0.4-010, cisco asyncos 15.5.4-012, cisco asyncos 15.5.4-007, cisco asyncos 15.0.5-016 and 1 older
- CISA due date
- 24 Dec 2025
- Weakness
- CWE-20
16 Dec 2025 Fortinet Multiple Products Weak cryptography
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortiproxy 7.6.4, fortinet fortios 7.6.4, fortinet fortiproxy 7.4.11, fortinet fortios 7.4.9, fortinet fortiproxy 7.2.15 and 5 older
- CISA due date
- 23 Dec 2025
- Weakness
- CWE-347
15 Dec 2025 Apple Multiple Products Memory corruption
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple safari 26.2, apple ipados 26.2, apple iphone os 26.2, apple macos 26.2, apple tvos 26.2 and 4 older
- CISA due date
- 5 Jan 2026
- Weakness
- CWE-416
15 Dec 2025 Gladinet CentreStack and Triofox Authentication bypass
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gladinet centrestack 16.12.10420.56791, gladinet triofox 16.12.10420.56791
- CISA due date
- 5 Jan 2026
- Weakness
- CWE-798
12 Dec 2025 Google Chromium Memory corruption
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 143.0.7499.110, google chrome 143.0.7499.109, microsoft edge chromium 143.0.3650.80, apple safari 26.2, apple ipados 26.2 and 7 older
- CISA due date
- 2 Jan 2026
- Weakness
- CWE-787, CWE-119
12 Dec 2025 Sierra Wireless AirLink ALEOS Malicious file upload
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sierrawireless aleos 4.11.0, sierrawireless aleos 4.9.4, sierrawireless aleos 4.4.9
- CISA due date
- 2 Jan 2026
- Weakness
- CWE-434
11 Dec 2025 OSGeo GeoServer XML external entity
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- geoserver 2.26.2, geoserver 2.25.6
- CISA due date
- 1 Jan 2026
- Weakness
- CWE-611
9 Dec 2025 Microsoft Windows Memory corruption
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7392, microsoft windows server 2022 23h2 10.0.25398.2025, microsoft windows server 2022 10.0.20348.4467, microsoft windows server 2019 10.0.17763.8146, microsoft windows 11 25h2 10.0.26200.7392 and 5 older
- CISA due date
- 30 Dec 2025
- Weakness
- CWE-416
9 Dec 2025 RARLAB WinRAR Path traversal
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- rarlab winrar 7.12
- CISA due date
- 30 Dec 2025
- Weakness
- CWE-22
8 Dec 2025 Array Networks ArrayOS AG Command injection
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- arraynetworks arrayos ag 9.4.5.9
- CISA due date
- 29 Dec 2025
- Weakness
- CWE-78
8 Dec 2025 D-Link Routers Memory corruption
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 29 Dec 2025
- Weakness
- CWE-120
5 Dec 2025 Meta React Server Components Remote code execution
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vercel next.js 16.0.7, vercel next.js 15.5.7, vercel next.js 15.4.8, vercel next.js 15.3.6, vercel next.js 15.2.6 and 2 older
- CISA due date
- 12 Dec 2025
- Weakness
- CWE-502
3 Dec 2025 OpenPLC ScadaBR Malicious file upload
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Dec 2025
- Weakness
- CWE-434
2 Dec 2025 Android Framework Security flaw
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Dec 2025
2 Dec 2025 Android Framework Authentication bypass
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Dec 2025
- Weakness
- CWE-306
28 Nov 2025 OpenPLC ScadaBR Cross-site scripting
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 19 Dec 2025
- Weakness
- CWE-79
21 Nov 2025 Oracle Fusion Middleware Authentication bypass
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 12 Dec 2025
- Weakness
- CWE-306
19 Nov 2025 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 142.0.7444.175
- CISA due date
- 10 Dec 2025
- Weakness
- CWE-843
18 Nov 2025 Fortinet FortiWeb Command injection
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortiweb 8.0.2, fortinet fortiweb 7.6.6, fortinet fortiweb 7.4.11, fortinet fortiweb 7.2.12, fortinet fortiweb 7.0.12
- CISA due date
- 25 Nov 2025
- Weakness
- CWE-78
14 Nov 2025 Fortinet FortiWeb Path traversal
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortiweb 8.0.2, fortinet fortiweb 7.6.5, fortinet fortiweb 7.4.10, fortinet fortiweb 7.2.12, fortinet fortiweb 7.0.12
- CISA due date
- 21 Nov 2025
- Weakness
- CWE-23
12 Nov 2025 WatchGuard Firebox Memory corruption
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- watchguard fireware 12.11.4, watchguard fireware 12.5.13
- CISA due date
- 3 Dec 2025
- Weakness
- CWE-787
12 Nov 2025 Microsoft Windows Memory corruption
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7092, microsoft windows server 2022 23h2 10.0.25398.1965, microsoft windows server 2022 10.0.20348.4346, microsoft windows server 2019 10.0.17763.8027, microsoft windows 11 25h2 10.0.26200.7092 and 5 older
- CISA due date
- 3 Dec 2025
- Weakness
- CWE-362
12 Nov 2025 Gladinet Triofox Access control flaw
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gladinet triofox 16.7.10368.56560
- CISA due date
- 3 Dec 2025
- Weakness
- CWE-284
10 Nov 2025 Samsung Mobile Devices Memory corruption
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 1 Dec 2025
- Weakness
- CWE-787
4 Nov 2025 CWP Control Web Panel Command injection
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- control-webpanel webpanel 0.9.8.1205
- CISA due date
- 25 Nov 2025
- Weakness
- CWE-78
4 Nov 2025 Gladinet CentreStack and Triofox Access control flaw
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gladinet centrestack 16.10.10408.56683
- CISA due date
- 25 Nov 2025
- Weakness
- CWE-552
30 Oct 2025 Broadcom VMware Aria Operations and VMware Tools Privilege escalation
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- vmware tools 13.0.5.0, vmware open vm tools 12.5.4, vmware tools 12.5.4, vmware aria operations 8.18.5, vmware telco cloud platform 5.0.1
- CISA due date
- 20 Nov 2025
- Weakness
- CWE-267
30 Oct 2025 XWiki Platform Remote code execution
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- xwiki 16.4.1, xwiki 15.10.11
- CISA due date
- 20 Nov 2025
- Weakness
- CWE-95
28 Oct 2025 Dassault Systèmes DELMIA Apriso Access control flaw
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- 3ds delmia apriso 2025
- CISA due date
- 18 Nov 2025
- Weakness
- CWE-862
28 Oct 2025 Dassault Systèmes DELMIA Apriso Remote code execution
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 18 Nov 2025
- Weakness
- CWE-94
24 Oct 2025 Microsoft Windows Remote code execution
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.6905, microsoft windows server 2022 23h2 10.0.25398.1916, microsoft windows server 2022 10.0.20348.4297, microsoft windows server 2019 10.0.17763.7922, microsoft windows server 2016 10.0.14393.8524
- CISA due date
- 14 Nov 2025
- Weakness
- CWE-502
24 Oct 2025 Adobe Commerce and Magento Input validation flaw
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 14 Nov 2025
- Weakness
- CWE-20
22 Oct 2025 Motex LANSCOPE Endpoint Manager Security flaw
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- motex lanscope endpoint manager 9.4.6.3, motex lanscope endpoint manager 9.4.5.4, motex lanscope endpoint manager 9.4.4.6, motex lanscope endpoint manager 9.4.3.8, motex lanscope endpoint manager 9.4.2.6 and 4 older
- CISA due date
- 12 Nov 2025
- Weakness
- CWE-940
20 Oct 2025 Oracle E-Business Suite Authentication bypass
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-918
20 Oct 2025 Microsoft Windows Access control flaw
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1665, microsoft windows server 2022 10.0.20348.3745, microsoft windows server 2019 10.0.17763.7434, microsoft windows server 2016 10.0.14393.8148, microsoft windows 11 24h2 10.0.26100.4270 and 7 older
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-284
20 Oct 2025 Kentico Xperience CMS Authentication bypass
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-288
20 Oct 2025 Kentico Xperience CMS Authentication bypass
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-288
20 Oct 2025 Apple Multiple Products Security flaw
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple safari 15.6, apple ipados 15.6, apple iphone os 15.6, apple tvos 15.6, apple macos 12.5 and 1 older
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-129
15 Oct 2025 Adobe Experience Manager (AEM) Forms Access control flaw
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Nov 2025
- Weakness
- CWE-863
14 Oct 2025 Microsoft Windows Access control flaw
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1913, microsoft windows server 2022 10.0.20348.4294, microsoft windows server 2019 10.0.17763.7919, microsoft windows 11 25h2 10.0.26200.6899, microsoft windows 11 24h2 10.0.26100.6899 and 6 older
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-284
14 Oct 2025 IGEL OS Weak cryptography
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.7919, microsoft windows server 2016 10.0.14393.8519, igel os 11.01.100, microsoft windows 11 25h2 10.0.26200.6899, microsoft windows 11 24h2 10.0.26100.6899 and 7 older
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-324
14 Oct 2025 Microsoft Windows Memory corruption
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1913, microsoft windows server 2022 10.0.20348.4294, microsoft windows server 2019 10.0.17763.7919, microsoft windows 11 25h2 10.0.26200.6899, microsoft windows 11 24h2 10.0.26100.6899 and 6 older
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-822
14 Oct 2025 SKYSEA Client View Authentication bypass
SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-287
9 Oct 2025 Grafana Labs Grafana Path traversal
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- grafana 8.2.7, grafana 8.1.8, grafana 8.0.7
- CISA due date
- 30 Oct 2025
- Weakness
- CWE-22
7 Oct 2025 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.1.5, synacor zimbra collaboration suite 10.0.13
- CISA due date
- 28 Oct 2025
- Weakness
- CWE-79
6 Oct 2025 Oracle E-Business Suite Authentication bypass
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
- Weakness
- CWE-287
6 Oct 2025 Microsoft Windows Security flaw
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.2366, microsoft windows server 2016 10.0.14393.4825, microsoft windows server 2004 10.0.19041.1415, microsoft windows 11 21h2 10.0.22000.376, microsoft windows 10 2004 10.0.19041.1415 and 7 older
- CISA due date
- 27 Oct 2025
6 Oct 2025 Linux Kernel Memory corruption
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 5.12, linux kernel 5.10.31, linux kernel 5.4.113, linux kernel 4.19.188, linux kernel 4.14.231 and 2 older
- CISA due date
- 27 Oct 2025
- Weakness
- CWE-787
On Hacker News
CVE-2021-22555: Turning \x00\x00 into 10000$ 71 comments6 Oct 2025 Microsoft Windows Memory corruption
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
- Weakness
- CWE-787
6 Oct 2025 Microsoft Windows Security flaw
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.