The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
26 Oct 2026 PHP Group PHP Memory corruption
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 12.1.4, paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.4, paloaltonetworks pan-os 10.2.7 and 4 older
- CISA due date
- 29 Oct 2026
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
26 Oct 2026 PHP Group PHP Memory corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- paloaltonetworks pan-os 12.2.4, paloaltonetworks pan-os 12.1.4, paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.4, paloaltonetworks pan-os 10.2.7 and 4 older
- CISA due date
- 29 Oct 2026
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
22 Jan 2026 Synacor Zimbra Collaboration Suite (ZCS) Security flaw
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.1.13, synacor zimbra collaboration suite 10.0.18
- CISA due date
- 12 Feb 2026
- Weakness
- CWE-98
7 Jul 2025 PHPMailer Command injection
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- phpmailer project phpmailer 5.2.18
- CISA due date
- 28 Jul 2025
- Weakness
- CWE-77, CWE-88
12 Jun 2024 PHP Group PHP Command injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- php 8.3.8, php 8.2.20, php 8.1.29
- CISA due date
- 3 Jul 2024
- Weakness
- CWE-78
13 Nov 2023 Juniper Junos OS Security flaw
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- juniper junos 20.4
- CISA due date
- 17 Nov 2023
- Weakness
- CWE-473
On Hacker News
Fileless Remote Code Execution on Juniper Firewalls13 Nov 2023 Juniper Junos OS Security flaw
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- juniper junos 20.4
- CISA due date
- 17 Nov 2023
- Weakness
- CWE-473
25 Aug 2022 PEAR Archive_Tar Path traversal
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.1.3, drupal 9.0.11, drupal 8.9.13, drupal 7.78
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-22, CWE-59
25 Aug 2022 PEAR Archive_Tar Input validation flaw
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.0.9, drupal 8.9.10, drupal 8.8.12, drupal 7.75, php archive tar 1.4.12
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-74
25 Mar 2022 PHP FastCGI Process Manager (FPM) Memory corruption
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- php 7.3.11, php 7.2.24, php 7.1.33, tenable.sc 5.19.0
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-120
25 Mar 2022 PHP Command injection
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.8.2, apple mac os x 10.7.5, php 5.4.2, php 5.3.12
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
25 Mar 2022 phpMyAdmin Remote code execution
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- phpmyadmin 3.1.3.1, phpmyadmin 2.11.9.5
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-94
15 Feb 2022 PHPUnit Remote code execution
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- phpunit project phpunit 5.6.3
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-94
3 Nov 2021 vBulletin Input validation flaw
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-74
3 Nov 2021 ThinkPHP Remote code execution
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- thinkphp 3.2.4
- CISA due date
- 3 May 2022
- Weakness
- CWE-306, CWE-94
3 Nov 2021 vBulletin Remote code execution
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
On Hacker News
Protection against CVE-2019-16759 in vBulletin3 Nov 2021 ThinkPHP noneCms Input validation flaw
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.